Objects

When the grace period ends and the account is purged. Until then the account works as before and cancelAccountDeletion keeps it.

Unpadded base64url SHA-256 of an encrypted conversation's blob.

Opaque cursor pointing after the last item; pass to after on next query.

The arguments the command accepts, in order. Clients build the palette form and the AI tool schema from them.

AI-optimised natural-language description; falls back to description when absent. Sanitized at registration time, so the frontend can trust this field even when rendering inside a prompt template.

Example phrases a user might speak/type to invoke this command. Individually sanitized at registration; bounded in count and length.

true when an AI agent may call the command. Only these commands appear on the AI surface and in commandDiscover. Always false while the instance has the AI command surface off.

Classification tier driving audit verbosity, mutating-call caps, and the UX confirm-modal placement.

Populated iff status == CONFIRMATION_REQUIRED. Carries the server-issued challenge (token + argsHash + expiresAt). The frontend presents the modal, then re-issues the original executeCommand mutation with confirmation: { inBandToken: { ... } }.

Channels only: visible to its members alone. Fixed at creation.

Slow mode: minimum seconds between two messages of the same non-moderator member; 0 when off.

When the conversation became end-to-end encrypted; null for plaintext. Messages from then on are encrypted.

Members invited to an encrypted conversation who have no device set up for encryption yet. They cannot read or send; they join with acceptConversationInvite once a device is ready, without the history before that, or declineConversationInvite. Not in memberIds or memberCount.

Whether the viewer is a member (for channels: has joined it).

The viewer's own notification level for this conversation; null inherits the workspace default.

The level that applies to the viewer now: NONE while muted, else notificationLevel, else the workspace default.

The conversation's current MLS group; null for plaintext, before the first Commit, and for a pending member.

The conversation this one succeeds, on the host that held it; null for any other.

For a DM: whether the other member's DM request for it is still pending, so the caller sees their messages wait for acceptance; false once it is accepted or ignored, when there is none, and for another member whose relay is another server. Null for groups and channels.

Store this and pass it as after next time. Opaque.

More changes follow cursor; ask again with it right away.

The conversation's own level; null inherits the workspace default.

What applies now: NONE while muted, else level, else the workspace default.

Whether the workspace was deleted.

The client-chosen device id from the certificate.

The device key in tagged form, <algorithm>:<base64url> (today always ed25519:…).

Key log seq whose identity key signed the certificate.

The new device's sealed offer, while OFFERED or ANSWERED.

The workspace, for WORKSPACE.

The sender's profile card as the host sent it.

Up to three items of the conversation, held while the request is pending.

The report's id.

The local user who filed the report; null for one the operator filed from the abuse address.

The reporter's username; null with reporterUserId.

The principal reported (rimp1_…); null for a report naming only a server.

The username of the account holding the reported principal here; null when no local account holds it.

The server reported (rims1_…); null for a report naming only a principal.

The DM request the report was filed on; null for one filed otherwise.

Why the report was filed.

When the report was filed.

When the report was resolved; null while it is open.

Whether the report is resolved.

The account's user id.

The account's username.

The account's principal (rimp1_…); null for an account that never enrolled a key.

When the account was created.

The address or range in CIDR form, IPv4 or IPv6.

Why the address or range was blocked.

When the block lifts; null for a block that lasts until it is removed.

When the block was made, or its reason and expiry last replaced.

Whether the block has expired and is no longer in force.

The block now in force.

False when the range was blocked already; its reason and expiry were replaced.

The principal blocked (rimp1_…).

The username of the account holding the principal here; null when no local account holds it.

Why the principal was blocked.

When the principal was blocked.

The principal blocked; null for an account of a cascade that has no key identity.

False when it was blocked already; its reason was replaced.

The local account blocked; null when no local account holds the principal.

The reason recorded; a cascade's accounts carry an "(invited by …)" suffix.

How many of the account's sessions were ended.

How many pending DM requests from the principal were ignored.

How many of the account's invites with uses left were revoked.

Whether the account's email is now refused at signup and password login.

The accounts the account's invites created, oldest first.

Whether the principal was blocked.

Whether the account's email was blocked and no longer is.

None for workspace invites that were issued without an expiry.

Populated only when token_type == WORKSPACE.

Oldest entry first.

Every device, revoked ones included, oldest first.

Copy into the login statement's nonce.

The new session's CSRF token, the value of the rim_csrf cookie. A client that cannot read that cookie keeps it in memory and sends it in the X-CSRF-Token header.

The forwarded message; null when the viewer cannot read its conversation or it is gone.

The MLS envelope of an encrypted message, whose text is always null; null for plaintext messages.

The message's position in its conversation's change sequence, as a decimal string. Increases with every change; compare it to a cached copy to keep the newer one.

When the text last changed; null for a never-edited message.

The message. Deleted messages come back with isDeleted: true and null text.

The epoch the message was sent in.

The MLSMessage; null once the message is deleted.

sentAt in microseconds since the Unix epoch, as decimal text, as the receipt covers it.

When the reported message was sent; null when its details are not shown.

Set when the server verified a franked report of an encrypted message.

The client device id that sent the reported encrypted message.

The exact content bytes of a verified report, unpadded base64url. Only messageReport fills it; null in lists and once retention cleared it.

When the verified content is deleted: 90 days after the report was resolved or dismissed; null while it is open.

The epoch the Commit was created in; the group moved to the next.

The epoch the next Commit must be created in.

MLS-active devices of members that are not in the group yet.

Devices in the group that no longer belong: their member left, they were revoked, or they uploaded no key package for 60 days.

Unclaimed one-time key packages that can still be handed out (valid for 14 more days).

How often the last-resort key package was handed out; past 5 the device replaces it.

The earliest expiry among the available one-time key packages.

The mls-readd statement as the device signed it.

The epoch the device joins at.

Their choice for DMs from outside their workspaces.

Their choice for each of their workspaces' members.

What applies to DMs from outside: their choice, or NONE under a floor that refuses them.

The floor that refuses DMs from outside; null when none does.

Null when the viewer can no longer read the conversation.

The message (timeline or thread reply); null when the viewer can no longer read the conversation or the message is gone.

The latest reaction's emoji; null unless reason is REACTION.

Who added the latest reaction; null unless reason is REACTION.

Applies to every conversation without its own level.

Lower-cased; a whole-word, case-insensitive hit notifies (level MENTIONS or ALL).

The manual do-not-disturb pause (setDoNotDisturb, notifications.dnd).

When the manual pause ends; null while dndPaused is false or the pause has no end.

Whether reactions to the viewer's messages notify them (level MENTIONS or ALL).

Where to fetch the bundle. Not signed: the hash decides whether the bytes are right.

Not revoked and uploaded key packages in the last 60 days: the device is set up for encryption and belongs in its member's encrypted groups.

This server's id (rims1_…).

host, relay or both.

The space holding the DMs and groups this relay's users start with anyone.

Server id of the relay that served it.

The workspace the invite names, for the delegation; null without an invite.

The member's user id at the host.

owner, moderator, member or guest.

Whether the device uploaded key packages recently enough to be added to groups.

The discovery document as JSON text, for the app to verify and pin.

active, lapsed or ended; refused for a delegation the host did not accept.

When the host stops honouring the delegation that keeps it active.

Why a delegation was refused (not_member, expired, relay_key, …).

The host's signed revocation-ack, checked against its key.

Relevance score of the match. Informational, or for a sort within the page: results are paginated by recency (sentAt, id), not by rank.

ts_headline snippet with <mark>...</mark> highlights around matched terms. None when the query had no free-text component (a purely operator-based search, e.g. from:@alice).

The requesting actor's effective role in this server. Display/affordance signal only — not an authorization boundary. Every mutation independently re-checks the role server-side (defense in depth); this field just lets the client avoid rendering controls the viewer can't use. Non-null: every viewer who can query a Server is necessarily a member of it (query-level visibility already guards non-members), so there is no "not a member" variant to represent here.

The account holding the owner role; null when there is none, as in the direct space or once the owner's account is deleted. Workspace metadata: every member sees it, guests included.

The workspace's floor for DMs to its members from people outside their workspaces; null in the direct space, which has no rules. Every member sees it.

How a DM from a fellow member arrives unless the recipient chose; null in the direct space. Every member sees it.

Null for a ban that lasts until it is lifted.

The banned user (null if the account no longer exists).

The feature's name, as RIM_FEATURES_DISABLED takes it: attachments, link_previews, email, custom_emoji, workspace_plugins or ai_commands. A client ignores a name it does not know.

Why an unavailable feature is unavailable; null otherwise.

The server's release version, e.g. 0.1.0.

The major version of this GraphQL API.

Every optional feature with its state on this instance.

Days a command audit row is kept before it is exported and deleted; null keeps rows forever.

A short text the operator shows people on this instance, at most 500 characters; null when there is none.

The terms of service a signup accepts, an absolute http(s) URL; null when the instance has none. A signup sends it back as acceptedTermsUrl.

The instance-wide caps, so a client can show "5 of 5" before it tries.

Whether new accounts sign up with a key only: signupWithInvite is refused with FORBIDDEN and signupWithKey is the signup. Password sign-in of existing accounts works either way.

DMs from people on other servers, and from people here outside the recipient's workspaces (RIM_DM_INBOUND): a floor for every account here.

DMs people here start with people on other servers (RIM_DM_OUTBOUND).

The server ids the PARTNERS settings name (RIM_DM_PARTNERS).

The workspace every new account joins as a Member, so a client can open it after a signup; null when the server names none (RIM_DEFAULT_WORKSPACE).

Workspaces one user owns.

Members of one workspace; the direct space has no cap.

Channels of one workspace, public and private.

Devices on one account: the stricter of the instance cap and the relay quota.

DM requests one user sends to strangers per day: the stricter of the instance cap and the relay quota.

Macros of one workspace.

Pipelines of one workspace.

Plugins of one workspace's registry.

Invites one user creates per day.

Uses one invite may have.

Bytes of one message's text.

Hours after its creation during which an account cannot create a workspace or send a DM request to a stranger, and sends messages at a lower rate; me.probationEndsAt says when the caller's ends.

Pending invitations to encrypted conversations one user holds; past it, adding them to one more answers VALIDATION.

End of the member's timeout while one is in force, else null.

The member's key identity (rimp1_…), once enrolled; null for a password-only account.

The new session's CSRF token, the value of the rim_csrf cookie. A client that cannot read that cookie keeps it in memory and sends it in the X-CSRF-Token header.

16 bytes, unpadded base64url. The server keeps only its hash, so it is shown once.

Key-based principal id (rimp1_...) once the account enrolled a key; null before. Plugins see this id, and the host maps a provisional rimp0_ id to it once.

When the account leaves probation, while it is in it. Read on me only; null for everyone else and once probation is over.

When the account's pending deletion runs, after its grace period (requestAccountDeletion); null while none is pending, and always null except on me. Once it runs, the account is purged and only a tombstone named "Deleted account" stays as the author of its encrypted messages.

Whether the account is an instance operator, who may run the instance moderation queue (instanceReports and the other instance… roots). Read on me only; false for everyone else.

The floor for DMs to its members from outside their workspaces.

How a DM from a fellow member arrives unless the recipient chose.

Their choice, or the workspace's default when they made none.

The workspace's default.

The workspace owner's display name, else username; null when the workspace has no owner.

The exact text of rim-plugin.json inside the statement.

Chosen by the publisher: it proves nothing about who they are.

This server's key log of the publisher when they are enrolled here, else the one stored with the entry.

Who approved the entry last; null once that account is deleted, and for a guest who shares no conversation with them.