Mutation

No description in the schema.

Unified signup mutation for all token-based and open-mode registration paths.

In invite-only mode, exactly one of instanceInviteToken or workspaceInviteToken must be supplied. In open mode, all token fields must be absent. Refused with FORBIDDEN when serverInfo.signupRequiresKeys is true: new accounts then sign up with signupWithKey.

On success, sets session and CSRF cookies via AuthIntent.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

An encrypted message under a client-chosen id, in the group's current epoch. Sending the same id and envelope again answers the stored message.

A new envelope carrying an encrypted message's complete new content.

No description in the schema.

No description in the schema.

Leave a channel or group (not a DM).

Add (invite) workspace members to a channel or group the caller belongs to.

Remove a member from a channel or group: Owner/Moderator may remove anyone, others only themselves.

Archive or unarchive a channel (Owner/Moderator). Archived channels are read-only.

No description in the schema.

No description in the schema.

Set the viewer's level for one conversation they can read; level: null goes back to the workspace default. muteConversation/unmuteConversation keep working alongside.

Accept the caller's pending invitation (Conversation.pendingMemberIds): they become a member and a member's device adds theirs to the group. Needs a device set up for encryption (VALIDATION otherwise); already a member, it changes nothing; NOT_FOUND when the caller was not invited.

Decline the caller's pending invitation; NOT_FOUND when there is none.

Join a public, unarchived channel. Idempotent.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

Add the statement's plugin to the workspace's registry. Owner or Moderator.

Change an entry's statement, status or bundle URL. Owner or Moderator.

Remove an entry from the workspace's registry. Owner or Moderator.

Join a workspace on another host: the relay presents the caller's identity, proof and delegation, and records the subscription.

Make another member the workspace's owner. The caller becomes a moderator; a workspace has exactly one owner, so this is the only way the owner role moves (setMemberRole never grants it). Both role changes are announced with MemberRoleChanged.

Errors

• UNAUTHENTICATED: no session.
• FORBIDDEN: the caller is not the owner.
• NOT_FOUND: userId is not a member.
• VALIDATION: the direct space, a guest as the new owner, or the caller themself.

Delete the workspace for good: its members, channels and conversations with their messages and files, invites, pins, workspace state, keybinds, pipelines, macros, plugins and custom emoji, and the notification rules scoped to it. Every member gets MemberLeft for themself and their event stream for the workspace ends; after that the workspace answers NOT_FOUND or FORBIDDEN like one they never joined.

Errors

• UNAUTHENTICATED: no session.
• FORBIDDEN: the caller is not the owner.
• VALIDATION: the direct space, or confirmName is not the workspace's name.

Set a workspace's DM rules: the floor for DMs to its members from outside their workspaces, and how a DM from a fellow member arrives unless the recipient chose. The workspace's Owner only; anyone else gets FORBIDDEN.

Set how a DM from the members of one of the caller's workspaces arrives, whatever the workspace's default. NOT_FOUND unless the caller is a member.

No description in the schema.

Replace a pipeline's definition. Allowed for its creator and for an Owner or Moderator of its workspace; anyone else gets FORBIDDEN.

Delete a pipeline. Allowed for its creator and for an Owner or Moderator of its workspace; anyone else gets FORBIDDEN.

Switch a pipeline on or off. Allowed for its creator and for an Owner or Moderator of its workspace; anyone else gets FORBIDDEN.

Report a message to the workspace moderators. Any member who can read it, once per message (CONFLICT on a second report). Audited (chat.report_message).

Close an open report as resolved or dismissed (Owner/Moderator). Audited (admin.resolve_report).

Report an encrypted message by revealing its content and franking key; the server checks them against its receipt before the moderators see them.

Report a DM request as abuse; a pending one is ignored too.

Mark an abuse report resolved; NOT_FOUND when there is no such report. Instance operators only; anyone else gets FORBIDDEN.

Replace the viewer's notification settings in the workspace (default level, keywords, daily do-not-disturb window, digest, reactions). Keywords: at most 20, each 2 to 40 characters.

Mark the viewer's notifications read: the given ids, or every notification created at or before allBefore (exactly one of the two). Returns how many changed.

Start a key login: a single-use challenge for a device to sign. No session needed.

Sign in with a login statement signed by an enrolled device key. Sets the same session cookie as login.

Bind a key identity to the signed-in account. The calling session becomes the new device's and every other session of the account ends. Afterwards the password no longer signs in.

Append a rotation to the key log. A rotation signed by the recovery key works without a session, revokes every device and session, and enrolls the device given with it.

Create an account from a key identity alone, with no password. The registration mode applies as for signupWithInvite (exactly one token in invite-only mode, none in open mode). An instance invite bound to an email address gives the account that address (EMAIL_TAKEN when another account has it); otherwise the account has no email. Signs the new account in on the device that signed up, setting the same session and CSRF cookies as signupWithInvite.

Store key packages of the session's device, all or none. A last-resort package replaces the device's previous one.

One key package per device waiting to be added; devices with none usable are left out.

Add a device certified by the current identity key.

Revoke a device, signed by the identity key or by the device itself. Ends its sessions.

Start linking a new device to the signed-in account. Cancels the account's previous live link. The link lives 10 minutes.

The new device's sealed offer. No session needed: the link id is the capability.

The old device's sealed answer, carrying the new device's certificate. The link then lives another 10 minutes.

Called by the new device right after its first loginWithKey.

Cancel a link from either device, with or without a session.

Move the session device's cursor up to upTo.

Cancel the caller's subscriptions at every host, then delete their queue, requests, contacts and blocks on this relay.

No description in the schema.

No description in the schema.

End every session of the signed-in account except this one. Returns how many ended.

No description in the schema.

No description in the schema.

No description in the schema.

Announce that the caller is typing in a direct conversation. Typing is announced in direct conversations only: the mutation answers true when it emitted a TypingStarted event and false when it did not, which is in a channel or a group, or on a repeat inside the throttle window.

No description in the schema.

FEATURE_DISABLED while the operator has disabled email. Without SMTP the reset mail is logged instead of sent.

No description in the schema.

Update fields on the authenticated user's profile.

Returns the full updated User so the client can refresh local cache without an extra me { ... } round-trip.

Errors

• UNAUTHENTICATED — no session.
• FORBIDDEN — displayName from a member whose relay is another server; their display name comes from their profile card.
• VALIDATION — displayName > 64 chars, statusText > 256 chars, bio > 2000 chars, or avatarUrl not under /api/files/.
• NOT_FOUND — caller's user row missing (should not happen in practice).
• INTERNAL — repository failure.

Examples

mutation Update($input: UpdateMyProfileInput!) {
updateMyProfile(input: $input) {
id username displayName avatarUrl statusText bio
}
}

Change a member's role. Owner: any role but OWNER, never their own. Moderator: MEMBER <-> GUEST only. Audited (admin.set_member_role).

Remove a member from the workspace (Owner/Moderator; nobody can kick the owner, and a moderator cannot kick a moderator). They may re-join with a new invite. Audited.

Remove a member and block them from re-joining until expiresAt (or until unbanned when omitted). Same targeting rules as kickMember. Audited.

Lift a ban (Owner/Moderator). Returns whether a ban existed. Audited.

Time a member out until until (at most 30 days ahead): they keep reading but every write fails with TIMED_OUT. Same targeting rules as kickMember. Audited.

End a member's timeout early. Returns whether one was in force. Audited.

Set a channel's slow mode, in seconds (0 to 21600; 0 turns it off). Owner/Moderator. Audited (chat.set_slow_mode).

Turn the viewer's manual do-not-disturb pause on (until turned off, or until until) or off. While paused, notifications are still recorded but arrive quiet.

Publish a profile card signed by the current identity key.

A Commit for the group's current epoch, or an incarnation's first Commit (epoch 0). STALE_EPOCH names the current incarnation and epoch when another Commit came first.

Acknowledge Welcomes of the session's device; answers how many were acknowledged now.

Ask the group's other devices to remove and add the session's device again.

Add a contact, or replace its relay URLs (1 to 8 of at most 256 bytes each).

No description in the schema.

Release the request's held items, let later ones flow, and add the sender as a contact.

Delete the request's held items and drop later items of the conversation.

Ignore a principal's pending requests and refuse its invites and key package claims.

No description in the schema.

Pin the host at hostOrigin as hostServerId and fetch a login challenge from it for a join, with the workspace inviteToken names (the invite is not used).

Present fresh delegations of the caller's devices to their hosts; one entry per delegation, in order.

Apply a device revocation on this host directly, as an app does when a host did not acknowledge it through the relay. Needs no session: it acts only on the revocation's signature, and attempts are limited per IP. Returns the host's signed acknowledgement.

Schedule the signed-in account for deletion once the grace period ends (14 days unless the operator set RIM_ACCOUNT_DELETION_GRACE_DAYS, 0 to 30). Every other session of the account ends now; this one keeps working, and cancelAccountDeletion keeps the account until the grace period ends. me.deletionScheduledFor shows the pending deletion.

Then the account is purged: its sessions, devices, keys, workspace memberships, plaintext messages, files and personal settings are removed, workspaces where it was the only member are deleted, and its username becomes free. The user row stays as a tombstone (deleted-<id prefix>, "Deleted account", no email, password or key) that cannot sign in and shows in no member list or search; it stays the author of the account's encrypted messages, which are kept so the conversations' history does not shift, and of a deleted message others replied to. The tombstone keeps the account's key identity id, so the same key identity cannot sign up on this server again.

Errors

• UNAUTHENTICATED: no session.
• FORBIDDEN: a person from another server, who deletes their account at their relay.
• VALIDATION: confirmUsername is not the account's username, or the account owns a workspace that has other members: hand it over (transferWorkspaceOwnership) or delete it (deleteWorkspace) first.
• CONFLICT: a deletion is already pending.

Cancel the signed-in account's pending deletion during its grace period. Returns whether a deletion was pending.

Errors

• UNAUTHENTICATED: no session.

Block a principal on this server: its pending DM requests are ignored, and the account holding it here has its sessions ended, its invites with uses left revoked and its email refused. Returns one outcome per account blocked, the principal's first. Instance operators only; anyone else gets FORBIDDEN.

Lift a principal's block and its account's email block. Ended sessions and revoked invites stay ended. Instance operators only; anyone else gets FORBIDDEN.

Block an address or range, or replace the reason and expiry of its block. A running server applies it within 30 seconds. Instance operators only; anyone else gets FORBIDDEN.

Lift the block on an address or range, named as it was blocked or in any form naming the same range. Returns whether there was one. A running server applies it within 30 seconds. Instance operators only; anyone else gets FORBIDDEN.

Set who outside the caller's workspaces may start a DM with them: REQUESTS, or NONE. REQUESTS under a floor that refuses such DMs is VALIDATION, naming it.