Lexicon Reference

All AT Protocol lexicons defined by the Stratos service. Lexicons describe every XRPC method, record type, and shared definition available in this namespace (zone.stratos.*).

GET Query — read-only XRPC callPOST Procedure — write XRPC callWS Subscription — WebSocket streamRECORD Record type stored in reposDEFS Shared type definitions

Core Definitions

DEFSzone.stratos.defs

Type Definitions

source— Indicates this record requires hydration from an external service. The stub record on the PDS contains minimal data; full content is fetched from the service endpoint.

Field	Type	Required	Description
vary	string	✓	Indicates when hydration is needed. 'authenticated' means full content requires viewer authentication.
subject	#subjectRef	✓	Reference to the full record at the hydration service.
service	string (did)	✓	DID of the hydration service, optionally with fragment identifying the service entry (e.g., 'did:plc:abc123#atproto_pns').

subjectRef— A strong reference to a record, including its content hash for verification.

Field	Type	Required	Description
uri	string (at-uri)	✓	AT-URI of the record at the hydration service.
cid	string (cid)	✓	CID of the full record content for integrity verification.

Actor

RECORDzone.stratos.actor.enrollment

A record indicating the user is enrolled in a Stratos service. Published to the user's PDS during OAuth enrollment for endpoint discovery by AppViews. Multiple enrollment records are supported — one per Stratos service.

Record Schema

Field	Type	Required	Description
service	string (uri)	✓	The Stratos service endpoint URL where this user's private data is stored.
boundaries	#Domain[]	—	Service-qualified boundaries the user has access to on this Stratos service, each in '{serviceDid}/{domainName}' format.
signingKey	string	✓	The user's public key as a did:key string, used for user-level record signing. For 'stratos' custody this is a P-256 key generated by the Stratos service; for 'pds' custody this is the user's own '#atproto' key from their DID document.
attestation	#serviceAttestation	✓	Service attestation vouching for the user's enrollment, boundaries, and signing key.
createdAt	string (datetime)	✓	Timestamp when the enrollment was created.
custody	string	—	Who hosts and signs this enrollment's repo. 'stratos' is the Stratos-hosted, Stratos-signed repo. 'pds' is the user's own spaces-capable PDS, signing with their own '#atproto' key. Defaults to 'stratos' when absent.
repoHost	string (uri)	—	The repo host endpoint when custody is 'pds'. Absent for 'stratos' custody.

Type Definitions

serviceAttestation— An attestation signed by the Stratos service key. The signed payload is DAG-CBOR encoded {boundaries, did, signingKey} with sorted keys.

Field	Type	Required	Description
sig	bytes	✓	Raw signature bytes of the DAG-CBOR encoded attestation payload, signed by the service key.
signingKey	string	✓	The Stratos service's public key as a did:key string, used to verify the attestation signature.

Admin

POSTzone.stratos.admin.addAdmin

Grant admin access to a DID. Requires admin authorization.

Request Body application/json

Name	Type	Required	Description
did	string (did)	✓	The DID to grant admin access to.

Response application/json

Name	Type	Required	Description
did	string (did)	✓

GETzone.stratos.admin.getRepoHost

Resolve repository hosts for an enrolled member's spaces. Requires admin authorization.

Parameters

Name	Type	Required	Description
did	string (did)	✓	The enrolled member DID.

Response application/json

Name	Type	Required	Description
did	string (did)	✓
custody	string	✓	Who hosts the member repository.
isService	boolean	✓	Whether this is a service enrollment.
resolutions	#resolution[]	✓

Type Definitions

resolution

Field	Type	Required	Description
boundary	#Domain	✓
spaceUri	string (uri)	✓
host	string (uri)	—
source	string	—

GETzone.stratos.admin.listAdmins

List everyone holding admin access. Requires admin authorization.

Response application/json

Name	Type	Required	Description
admins	#admin[]	✓
viewer	string (did)	✓	The DID of the requesting admin.

Type Definitions

admin

Field	Type	Required	Description
did	string (did)	✓
source	string	✓	Where the grant comes from. Config admins cannot be revoked through the API.
addedAt	string (datetime)	—	When access was granted. Absent for config admins.
addedBy	string (did)	—	Who granted access. Absent for config admins.

GETzone.stratos.admin.listEnrollments

List enrollments in this Stratos service. Requires admin authorization.

Parameters

Name	Type	Required	Description
limit	integer	—	Maximum number of enrollments to return.
cursor	string	—	Pagination cursor from a previous response.
boundary	string	—	Only return members holding this boundary.
active	boolean	—	Only return active or inactive enrollments.
custody	string	—	Only return enrollments with this repo custody.

Response application/json

Name	Type	Required	Description
enrollments	#enrollment[]	✓
cursor	string	—	Cursor for the next page. Absent on the last page.
total	integer	—	Total number of enrollments in the service. Absent when any filter is applied.

Type Definitions

enrollment

Field	Type	Required	Description
did	string (did)	✓	The enrolled DID.
enrolledAt	string (datetime)	✓	When the DID was enrolled.
active	boolean	✓	Whether the enrollment is currently active.
isService	boolean	—	Whether this is a service enrollment rather than a user.
custody	string	✓	Who hosts the member repository.
repoHost	string (uri)	—	The repository host recorded for a PDS-custody member.
boundaries	#Domain[]	✓

GETzone.stratos.admin.listPdsSyncStatus

List queued PDS enrollment-record sync jobs. Shows which members' PDS records are still behind this service's boundary state. Requires admin authorization.

Parameters

Name	Type	Required	Description
limit	integer	—	Maximum number of jobs per page.
cursor	string	—	Opaque pagination cursor from a previous response.

Response application/json

Name	Type	Required	Description
jobs	#job[]	✓
cursor	string	—	Pass to the next call to continue. Absent on the last page.

Type Definitions

job

Field	Type	Required	Description
did	string (did)	✓	The member whose PDS enrollment record is behind.
status	string	✓	A 'pending' job is retried by the worker. A 'failed' job is terminal until a fresh admin mutation or a requeue revives it.
attemptCount	integer	✓	Number of attempts made so far.
nextAttemptAt	string (datetime)	✓	When the worker may next attempt this job.
firstQueuedAt	string (datetime)	✓	When sync intent was first recorded for this member.
updatedAt	string (datetime)	✓	When the job was last written.
lastError	string	—	Message from the most recent failed attempt. Absent when no attempt has failed.
generation	integer	✓	Fencing token. Every fresh sync intent increases it. An attempt writes its bookkeeping only while its own generation is still current, so a superseded attempt cannot clear or delay a newer job.

POSTzone.stratos.admin.removeAdmin

Revoke admin access from a DID. Config-provided admins cannot be revoked here, and an admin cannot revoke their own access.

Request Body application/json

Name	Type	Required	Description
did	string (did)	✓	The DID to revoke admin access from.

Response application/json

Name	Type	Required	Description
did	string (did)	✓

Errors

NotFoundThe DID does not hold admin access.

POSTzone.stratos.admin.requeuePdsSync

Move every terminally failed PDS enrollment-record sync job back to 'pending'. Use this after a fault that every attempt saw alike, such as a signing key rotation or clock skew, which marks many jobs failed at once. Requires admin authorization.

Response application/json

Name	Type	Required	Description
requeued	integer	✓	Number of jobs moved from 'failed' back to 'pending'.

POSTzone.stratos.admin.setActive

Activate or deactivate an enrolled member. Requires admin authorization. Deactivation is reversible and preserves the member's boundaries.

Request Body application/json

Name	Type	Required	Description
did	string (did)	✓	The member to update.
active	boolean	✓	Whether the member's enrollment should be active.

Response application/json

Name	Type	Required	Description
did	string (did)	✓
active	boolean	✓

Errors

NotFoundThe DID is not enrolled.

Boundary

DEFSzone.stratos.boundary.defs

Type Definitions

Domain— A specific domain to define exposure boundary.

Field	Type	Required	Description
value	string	✓	Service-qualified boundary identifier in the format '{serviceDid}/{domainName}', e.g. 'did:web:stratos.example.com/engineering'.

Domains— A collection of domains that define the exposure boundary for a record.

Field	Type	Required	Description
values	#Domain[]	✓	The single domain that can access this record. Exactly one domain per record (one record, one space); the array shape is retained for wire compatibility.

Enrollment

GETzone.stratos.enrollment.status

Check enrollment status for a DID in this Stratos service.

Parameters

Name	Type	Required	Description
did	string (did)	✓	The DID to check enrollment for.

Response application/json

Name	Type	Required	Description
did	string (did)	✓	The DID that was checked.
enrolled	boolean	✓	Whether the DID is enrolled in this Stratos service.
eligible	boolean	—	Whether the DID is eligible to enroll. Only included when the DID is not enrolled. Omitted when the eligibility check cannot complete.
active	boolean	—	Whether the enrollment is active. Only included when enrolled.
enrolledAt	string (datetime)	—	When the DID was enrolled, if enrolled.
signingKey	string (did)	—	The service-held signing key DID for this enrollment. Only included when enrolled.
enrollmentRkey	string	—	Record key of the zone.stratos.actor.enrollment record on the user's PDS. Only included when enrolled.
boundaries	#Domain[]	—	Authoritative boundaries assigned. Only included when request is authenticated.

POSTzone.stratos.enrollment.unenroll

Unenroll from the Stratos service, revoking the session and deleting the enrollment record from the user's PDS.

Request Body application/json

Name	Type	Required	Description

Response application/json

Name	Type	Required	Description
success	boolean	—

Errors

NotEnrolled

AuthRequired

Feed

GETzone.stratos.feed.getTimeline

Fetch a timeline of posts.

Parameters

Name	Type	Required	Description
limit	integer	—
cursor	string	—

Response application/json

Name	Type	Required	Description
feed	#feedViewPost[]	✓
cursor	string	—

RECORDzone.stratos.feed.post

Record containing a private Stratos post with domain boundary restrictions. When stored on user's PDS as a stub, only 'source' and 'createdAt' are present. Full content is available from the hydration service.

Record Schema

Field	Type	Required	Description
source	#source	—	When present, indicates this is a stub record. Full content should be hydrated from the referenced service.
text	string	—	The primary post content. May be an empty string, if there are embeds. Omitted in stub records.
boundary	#Domains	—	Limit exposure to defined domains. Omitted in stub records.
facets	facet[]	—	Annotations of text (mentions, URLs, hashtags, etc)
reply	#replyRef	—
embed	images | images | video | external | record | recordWithMedia	—
langs	string (language)[]	—	Indicates human language of post primary text content.
labels	#selfLabels	—	Self-label values for this post. Effectively content warnings.
tags	string[]	—	Additional hashtags, in addition to any included in post text and facets.
createdAt	string (datetime)	✓	Client-declared timestamp when this post was originally created.

Type Definitions

replyRef— Reference to parent and root posts for replies. Must reference stratos posts only.

Field	Type	Required	Description
root	strongRef	✓
parent	strongRef	✓

Identity

GETzone.stratos.identity.resolveEnrollments

Resolve enrollment boundaries for a DID. Returns the boundary domains the user is enrolled in.

Parameters

Name	Type	Required	Description
did	string (did)	✓	The DID to resolve enrollment boundaries for.

Response application/json

Name	Type	Required	Description
did	string (did)	✓
enrolled	boolean	✓	Whether the DID is enrolled in this Stratos service.
boundaries	string[]	✓	Boundary domains the user is enrolled in. Empty if not enrolled.

Repository

GETzone.stratos.repo.hydrateRecord

Hydrate a single record by URI. Returns the record if viewer has boundary access.

Parameters

Name	Type	Required	Description
uri	string (at-uri)	✓	The AT-URI of the record to hydrate
cid	string (cid)	—	Optional CID to verify record version

Response application/json

Name	Type	Required	Description
uri	string (at-uri)	✓
cid	string (cid)	✓
value	unknown	✓

Errors

RecordNotFoundThe requested record does not exist

RecordBlockedAccess to the record is blocked due to boundary restrictions

POSTzone.stratos.repo.hydrateRecords

Hydrate multiple records by URI. Returns records filtered by viewer's boundary access.

Request Body application/json

Name	Type	Required	Description
uris	string (at-uri)[]	✓	Array of AT-URIs to hydrate (max 100)

Response application/json

Name	Type	Required	Description
records	#recordView[]	✓	Successfully hydrated records
notFound	string (at-uri)[]	✓	URIs that were not found
blocked	string (at-uri)[]	✓	URIs blocked due to boundary restrictions

Type Definitions

recordView

Field	Type	Required	Description
uri	string (at-uri)	✓
cid	string (cid)	✓
value	unknown	✓

POSTzone.stratos.repo.importRepo

Import a repository from a CAR file. Verifies record CID integrity and re-signs with the destination service key. The caller must be enrolled as the DID in the CAR's commit block.

Response application/json

Name	Type	Required	Description
imported	integer	✓	Number of records successfully imported.

Errors

InvalidCarThe CAR file is malformed, has missing blocks, or contains records with mismatched CIDs.

RepoAlreadyExistsThe destination already has records for this DID. Import is only supported for empty repos.

POSTzone.stratos.repo.uploadBlob

Upload a new blob, to be referenced from a Stratos repository record. The blob will be deleted if it is not referenced within a time window (eg, minutes). Blob restrictions (mimetype, size, etc) are enforced when the reference is created. Requires auth, implemented by Stratos service.

Response application/json

Name	Type	Required	Description
blob	blob	✓

Server

GETzone.stratos.server.listDomains

Returns the list of boundary domains available on this Stratos service.

Response application/json

Name	Type	Required	Description
domains	string[]	✓	The boundary domains available on this service.

Sync

GETzone.stratos.sync.getBlob

Get a blob by CID with boundary-based access control.

Parameters

Name	Type	Required	Description
did	string (did)	✓
cid	string (cid)	✓

Errors

BlobNotFound

Forbidden

GETzone.stratos.sync.getRepo

Export the full repository as a CAR file. Returns all record blocks, MST nodes, and the signed commit.

Parameters

Name	Type	Required	Description
did	string (did)	✓	The DID of the repo to export.
since	string (tid)	—	Optional revision cursor. If provided, only blocks newer than this revision are included.

Errors

RepoNotFoundThe requested repo does not exist or has no commits.

GETzone.stratos.sync.listRecordPaths

Full-state recovery: enumerate a repo's record paths and their current CIDs, mirroring listRecords semantics. Record values are inlined by default; excludeValues returns metadata only. Boundary-gated: the caller only observes records within its enrolled boundaries. Intended as the fallback when the oplog (listRepoOps) returns OplogTruncated: the caller enumerates paths, diffs locally, and fetches misses. Callers must authenticate with a signed service JWT via the Authorization: Bearer header.

Parameters

Name	Type	Required	Description
did	string (did)	✓	The DID of the repo to enumerate.
collection	string (nsid)	—	Optional single collection to enumerate. When omitted, all collections are enumerated.
cursor	string	—	Opaque pagination cursor from a previous response.
limit	integer	—	Maximum number of rows to return in this page.
excludeValues	boolean	—	When true, record values are omitted and only path metadata is returned.

Response application/json

Name	Type	Required	Description
records	#recordPath[]	✓	The record paths in this page.
cursor	string	—	Opaque pagination cursor to fetch the next page. Absent when enumeration is complete.

Type Definitions

recordPath— A record path with its current CID and optionally its value.

Field	Type	Required	Description
collection	string (nsid)	✓	The record collection.
rkey	string	✓	The record key.
cid	string (cid)	✓	The CID (string form) of the current record value.
value	unknown	—	The current record value, inlined by default. Omitted when excludeValues is true.

Errors

RepoNotFoundThe requested repo does not exist.

AuthRequiredService authentication is required.

GETzone.stratos.sync.listRepoOps

Incremental pull sync of a repo's operation log (oplog), mirroring com.atproto.space.listRepoOps semantics. Returns record operations after the `since` revision, with current record values inlined by default. Boundary-gated: the caller only observes operations for records within its enrolled boundaries. The response reaches the head of the oplog when `cursor` is absent; the repo's current signed commit is then included (unless the repo has no commits yet), consistent with the operations returned. When a concurrent write is detected, a cursor is returned instead of the commit; that response can carry no operations and repeat the cursor you sent, so poll again while a cursor is present and do not read an unchanged cursor as a stall. A write that commits after the head probe is not detected; it falls outside this snapshot and arrives on a later poll. Callers must authenticate with a signed service JWT via the Authorization: Bearer header. The oplog is a droppable transport optimization; if `since` predates retained history the OplogTruncated error is returned (stricter than upstream, which silently restarts) so the caller falls back to full-state recovery (listRecordPaths).

Parameters

Name	Type	Required	Description
did	string (did)	✓	The DID of the repo to sync.
since	string (tid)	—	A revision (TID): the caller's own sync position. Only operations after this revision are returned. Omit to start from the beginning of retained history. Use `cursor` to continue a paginated response.
limit	integer	—	Maximum number of operations to return in this page.
cursor	string	—	Opaque pagination cursor from a previous response. Takes precedence over `since` when both are supplied.
excludeValues	boolean	—	When true, record values are omitted and only operation metadata is returned.

Response application/json

Name	Type	Required	Description
ops	#repoOp[]	✓	The operations in this page, in ascending revision order.
cursor	string	—	Opaque pagination cursor to fetch the next page. Absent once the response reaches the head of the oplog. Can repeat the cursor you sent when a concurrent write was detected.
commit	#signedCommit	—	The repo's current signed MST commit. Included when the response reaches the head of the oplog; omitted on backfill responses and when the repo has no commits yet (no writes) - in that case there is nothing to sign and also no ops to sync.

Type Definitions

repoOp— A single record operation in the oplog. `cid` null means delete; `prev` null means create.

Field	Type	Required	Description
rev	string (tid)	✓	The revision of the commit that produced this operation. Atomic multi-writes share one rev.
collection	string (nsid)	✓	The record collection.
rkey	string (record-key)	✓	The record key.
cid	string (cid)	✓	The CID (string form) of the current record value. Null for a delete.
prev	string (cid)	✓	The CID (string form) of the record value this operation superseded. Null for a create, or when the superseded value predates the returned window.
value	unknown	—	The current record value, inlined by default for create/update ops. Omitted when excludeValues is true, for a delete, or when the value has been superseded by a later operation.

signedCommit— A signed MST v3 commit, as persisted (read verbatim, not re-signed).

Field	Type	Required	Description
did	string (did)	✓	The DID of the repo.
version	integer	✓	The commit version (3).
data	string (cid)	✓	The CID (string form) of the MST root node.
rev	string (tid)	✓	The commit revision.
prev	string (cid)	—	The CID (string form) of the previous commit. Absent for the first commit.
sig	string	✓	The commit signature, base64-encoded (the exact persisted bytes).

Errors

OplogTruncatedThe requested `since` revision falls outside retained history: it predates the oldest retained event (compacted), postdates the newest (not a rev this repo issued), or there is no retained log to check it against. Also returned for an unusable `cursor`: malformed, predating retained history (compacted between pages), or beyond the newest retained event. The caller must fall back to full-state recovery. Stricter than upstream, which restarts from the beginning of retained history instead of erroring.

RepoNotFoundThe requested repo does not exist.

AuthRequiredService authentication is required.

WSzone.stratos.sync.subscribeRecords

Subscribe to stratos events. When 'did' is provided, subscribes to record updates for that account. When omitted, subscribes to service-level events (enrollments). Callers must authenticate with a signed service JWT via the Authorization: Bearer header.

Parameters

Name	Type	Required	Description
did	string (did)	—	The DID of the account to subscribe to. If omitted, subscribes to service-level enrollment events.
cursor	integer	—	The last known event sequence number to resume from.
domain	string	—	Optional domain filter. Only events for records with this domain in their boundary will be emitted.

Message Types

commitenrollmentinfo

Type Definitions

commit— A commit event containing record operations.

Field	Type	Required	Description
seq	integer	✓	The sequence number of this event.
did	string (did)	✓	The DID of the account.
time	string (datetime)	✓	Timestamp of when the event was sequenced.
rev	string (tid)	✓	The repo revision.
ops	#recordOp[]	✓	List of record operations in this commit.

recordOp— A single record operation within a commit.

Field	Type	Required	Description
action	string	✓	The type of operation.
path	string	✓	The record path (collection/rkey).
cid	cid-link	—	The CID of the record. Present for create and update operations.
record	unknown	—	The record content. Present for create and update operations.

info— An informational message about the subscription state.

Field	Type	Required	Description
name	string	✓	The type of info message.
message	string	—	Additional details about the info message.

enrollment— An enrollment event indicating a user has enrolled or unenrolled from the service.

Field	Type	Required	Description
did	string (did)	✓	The DID of the user.
action	string	✓	The enrollment action.
service	string (uri)	—	The Stratos service endpoint URL.
boundaries	string[]	—	The boundaries assigned to the user.
time	string (datetime)	✓	Timestamp of the enrollment event.

Errors

FutureCursorCursor is in the future.

AuthRequiredAuthentication is required.