zone.stratos.space.getSpaceCredential

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the key to bind), otherwise from the DPoP-authenticated user (the session proof key is bound). Membership is checked live against the enrollment store. App-axis (client attestation) gating is enforced here: spaces configured with an app allow-list require a valid client attestation whose attested client_id is listed; spaces that are open ignore any attestation supplied.",
      "errors": [
        {
          "description": "The supplied delegation token failed verification, or its target space does not match the requested space.",
          "name": "InvalidToken"
        },
        {
          "description": "The identified user is not enrolled in the boundary corresponding to the requested space.",
          "name": "NotEnrolled"
        },
        {
          "description": "The requested space URI is malformed or its space DID does not match this service's DID.",
          "name": "UnknownSpace"
        },
        {
          "description": "The requested space gates on client app identity (appAccess allowList) but no valid client attestation was supplied.",
          "name": "AttestationRequired"
        },
        {
          "description": "A valid client attestation was supplied but its attested client_id is not in the space's app allow-list.",
          "name": "ClientNotAllowed"
        },
        {
          "description": "No DPoP key was available to bind the credential to: the delegation path requires a standalone DPoP proof in the DPoP header, and unbound credentials are refused outside development mode.",
          "name": "ProofRequired"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "clientAttestation": {
              "description": "Optional client-attestation JWT (an OAuth private_key_jwt client assertion to the space authority). Required only for spaces gated on client app identity (appAccess allowList); the allow-list is evaluated against the attested client_id. Ignored for open spaces.",
              "type": "string"
            },
            "delegationToken": {
              "description": "Optional space-delegation JWT. When present, the caller's identity is taken from this token (its target space must equal `space`) instead of the DPoP session.",
              "type": "string"
            },
            "space": {
              "description": "The space's at:// URI (at://{did}/space/{type}/{skey}). Mirrors the upstream space-ref string format (atproto#5187); declared as a plain string until @atproto/lexicon supports that format. Its space DID must equal this service's DID.",
              "type": "string"
            }
          },
          "required": [
            "space"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "credential": {
              "description": "The compact-serialized space-credential JWT.",
              "type": "string"
            },
            "expiresAt": {
              "description": "The credential's expiry time (matches the JWT `exp` claim).",
              "format": "datetime",
              "type": "string"
            }
          },
          "required": [
            "credential",
            "expiresAt"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "zone.stratos.space.getSpaceCredential",
  "lexicon": 1
}