Query

The commands the caller may run on surface (default PALETTE), sorted by id.

A command the server runs is listed only when commandContext.workspaceId names a workspace the caller is a member of, their role there may run it, and they hold each of its required capabilities. The commands the client runs itself are listed in every context. A listed command is one executeCommand runs for the caller in that context, apart from a confirmation, a timeout in force and the arguments given. Naming the direct space makes the caller a guest of it.

AI lists only the AI-callable commands, plus the caller's AI-callable macros of the workspace, and fails with FEATURE_DISABLED while the AI command surface is off.

The AI-callable commands the caller may run, for an AI agent to discover its tools.

Filtered as commands filters: a command the server runs is listed only when workspaceId names a workspace the caller is a member of, their role there may run it, and they hold each of its required capabilities; the commands the client runs itself are always listed. A listed command is one executeCommand runs for the caller in that workspace, apart from a confirmation, a timeout in force and the arguments given.

With intentPhrase the commands are ranked by how well the phrase matches their intent samples, title and natural-language description. limit defaults to 50 and is capped at 100. workspaceId scopes the list to one workspace, including its AI-callable macros.

Limited to 5 calls per 60-second sliding window per user; more fail with RATE_LIMITED. Fails with FEATURE_DISABLED while the AI command surface is off.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

No description in the schema.

The message change feed: for each conversation, the messages created, edited or deleted after its cursor (timeline and thread replies alike), oldest change first. A client cache stores each returned cursor and passes it back as after.

No description in the schema.

No description in the schema.

No description in the schema.

Message reports of the workspace (all statuses when status is omitted), ordered createdAt ASC, id ASC. Owner/Moderator only. The message body is included only when the moderator can read the conversation.

One report of the workspace. Owner/Moderator only. For a verified report of an encrypted message it includes frankedContent, and records that the moderator viewed it (e2ee.report_viewed).

Full-text search over the messages of a workspace the caller can read. input.query accepts free text plus the operators from:@user, in:#channel, has:link, has:attachment, after:YYYY-MM-DD and before:YYYY-MM-DD.

Results are cursor-paginated by recency, (sentAt, id), like every other message list. They are not ordered by rank: a relevance score is neither unique nor stable, so paging by it would skip or repeat results. rank and headline come with every item for display or a sort within the page.

No description in the schema.

No description in the schema.

No description in the schema.

Active bans of the workspace, newest first. Owner/Moderator only.

Pin the server at origin through this relay and return its discovery document.

The server's release version, API version, features, audit retention, instance notice, terms URL, limits and DM settings. Readable without a session.

Presence of the workspace's members who sent a heartbeat. A guest sees only the members they share a conversation with, as in the member directory.

No description in the schema.

No description in the schema.

The workspace's plugin registry, ordered by plugin id. Any member, guests included.

No description in the schema.

The caller's own macros in the workspace. FORBIDDEN for a non-member.

No description in the schema.

No description in the schema.

Query the command audit log. Owners and moderators of a workspace read its whole log by setting filter.serverId. Everyone reads their own rows by setting filter.actorUserId to themselves. A filter with neither is rejected.

Preview a registration token without consuming it.

Returns minimal metadata so the frontend can render the correct signup copy before the user submits credentials. Rate-limited at 30 req / 5 min per IP; no authentication required.

The viewer's notification settings in the workspace (defaults until first saved).

The viewer's notifications in the workspace, newest first (createdAt DESC, id DESC). AFTER pages go to older notifications. Defaults: unreadOnly false, dir AFTER, limit 50 (clamped to 1..=100).

Unread notifications of the viewer in the workspace (the bell badge).

The signed-in account's key log, devices and profile card on this server.

The public key log of a principal enrolled on this server, oldest first; empty when none is. No session needed: a person who lost every device reads the head here to sign a recovery rotation (rotateIdentityKey).

The session device's stored key packages, per cipher suite.

One of the signed-in account's device links: its state, expiry and, once the new device sent it, the sealed offer.

The sealed answer for the new device, null until the old device sends it. No session needed: the link id is the capability.

The certified devices of principals who share a workspace with the caller (the direct space included); an empty list for any other principal. At most 100 ids.

Where the revocation of one of the caller's devices stands at each host holding them.

This server's id, roles and direct space. Readable without a session; a signed-in local user of a relay becomes a guest of the direct space, if not one yet.

The session device's queued host events above after (its cursor when omitted). limit is 1 to 500, 200 by default.

Abuse reports filed with this server, oldest first. Instance operators only; anyone else gets FORBIDDEN.

No description in the schema.

No description in the schema.

No description in the schema.

Return the deployment-wide registration mode.

Used by the login page to decide whether to render a "Sign up" link. No authentication required — this is public configuration metadata.

The session device's unacknowledged Welcomes, oldest first.

Accepted Commits of an incarnation after afterEpoch (exclusive; from 0 when null), oldest first. limit is 1 to 100, 50 by default.

A principal's identity: a local one directly, else fetched from relayUrl (pinning it) and cached for 24 hours.

The caller's contacts, oldest first.

The caller's DM requests, newest first.

The current seq of each named event stream of a space hosted here that the caller can see; streams the caller cannot see are left out.

The caller's subscriptions to workspaces on other hosts.

The principals this server refuses, newest first. Instance operators only; anyone else gets FORBIDDEN.

This server's IP deny list, expired blocks included, oldest first. Instance operators only; anyone else gets FORBIDDEN.

Who may start a DM with the caller: their choice for people outside their workspaces, for each workspace's members, and what applies once the operator's and the workspaces' floors are taken in, with where a refusing floor comes from.