Capabilities
Generated at from
openvibe-contracts v0.33.0 and
openvibe-sdk v0.5.0.
A capability is an action a principal may invoke, checked at the owning service against the token's grants. Highlighted rows can be granted to apps: only active capabilities whose visibility is public (or partner, when staff put one in a project's allowance). first-party and internal capabilities are never granted to apps.
| Capability | Owner | Visibility | Status | Description | Quota class |
|---|---|---|---|---|---|
| ai.provider.manage | ai | internal | active | Register, update, enable and disable providers and models (secrets only as env references, never values), reset circuit breakers, set quotas and purge the cache. | ai-admin |
| ai.run.create | ai | first-party | active | Create workflow runs (POST /api/v1/runs and the direct chat/generate/summarize/classify/extract/enrich/embed operations), cancel or retry the caller's own runs and attach citations to them. A token's `ns` claim limits which workflow namespaces it may run (live.*, wiki.*, ...). Quotas are checked before any provider call. | ai-run |
| ai.run.read | ai | first-party | active | Read the caller's own runs, their citations and request-log metadata (hashes, tokens, latency; never raw prompts). | ai-read |
| ai.usage.read | ai | internal | active | Read usage, quota windows, request logs, the audit log, cache statistics, the admin summary and any caller's runs. | ai-read |
| ai.workflow.manage | ai | internal | active | Create new versions of prompt templates, workflow definitions and routing profiles, and change their lifecycle status (draft, active, deprecated, archived; routes active/disabled). Every change is audited; edits never overwrite a version. | ai-admin |
| billing.balance.read | billing | internal | active | Read a subject's balances (spendable credit, creator payable, pending payouts) and transaction history. | ledger-read |
| billing.cashout.manage | billing | internal | active | Operator payouts: list cashouts, approve one after its escrow period with the payout reference from the provider (required), or deny it (reversal back to creator payable). Separately controlled from every other capability (ADR-012 rule 10). | ledger-admin |
| billing.cashout.request | billing | internal | active | Request a cashout of creator payable into escrow (minimum and escrow period enforced by Billing), or recycle creator payable into the subject's own spendable credit. Bought credit is never withdrawable. | ledger-write |
| billing.entitlement.check | billing | internal | active | Is a subject entitled to a streamer's subscription right now, and until when. Answered from Billing alone (works with Live offline). | ledger-read |
| billing.intent.create | billing | internal | active | Start a checkout: create a payment intent priced by Billing (never by the client) for a Vibes purchase or a channel subscription, and get the provider checkout URL or PowerChat app_ref. Also reads intents and captures approved PayPal orders. | ledger-write |
| billing.ledger.admin | billing | internal | active | Operate the ledger: economy freeze switch (writes refused, reads served, webhooks queued), reconciliation runs, balanced manual adjustments with a reason, settling a verified provider receipt, provider-event reprocessing, the renewal sweep and import holds. | ledger-admin |
| billing.subscription.manage | billing | internal | active | Start or renew a channel subscription paid from credit (the streamer share is credited on every period), and cancel at period end (Stripe subscriptions are cancelled at Stripe). Receipt-paid subscriptions through the API additionally need billing.ledger.admin. | ledger-write |
| billing.transfer.create | billing | internal | active | Give CREDIT to someone (tip, donation, paid interaction): user_credit of the giver to creator_payable of the recipient. Self-dealing is refused by subject. Also refunds a credit-funded transfer back to its giver (e.g. a media request that never played). Idempotent by Idempotency-Key. | ledger-write |
| blog.blog.configure | blog | first-party | active | Change a blog's title, description, language and feed settings (RSS, Atom, JSON Feed on/off, item count, full text or summaries). Only an owner of the blog (or staff on the official blog) acting through X-OV-Subject. | blog-write |
| blog.blog.create | blog | first-party | active | Get-or-create the blog of the acting member (X-OV-Subject, a usr_ subject): one member blog per subject, created on first use, owned by that subject, handle = the Network username unless another free handle is given. The charter's blog.create as a three-segment id. Browsers use their Network user JWT instead. | blog-write |
| blog.feed.read | blog | first-party | active | Read a blog's JSON Feed through the API (public, published, listable posts only; the same items as /@handle/feed.json). Browsers and crawlers read the public RSS, Atom and JSON Feed URLs without any capability. | blog-read |
| blog.member.manage | blog | first-party | active | List, add, change and remove a blog's members (owner, editor, author) by Network subject. A member blog keeps at least one owner. Owners only. | blog-write |
| blog.post.create | blog | first-party | active | Create a draft post (revision 1) on a blog the acting member belongs to. With X-OV-Origin: ai the draft is AI-generated output (OpenVibe.AI blog.draft_post; authorship.workflow { id, runId } required): never attributed to the person, noindex, and not publishable until a person reviews it. | blog-write |
| blog.post.delete | blog | first-party | active | Delete a post: readers get 410, Search a tombstone, the Community thread is hidden; immutable revisions are kept. Editors, owners, the author, and staff (moderation). | blog-write |
| blog.post.publish | blog | first-party | active | Make a revision the published one (idempotent). AI-generated revisions are refused (409 post.review_required) until a person has recorded an approving review. | blog-write |
| blog.post.read | blog | first-party | active | Read posts that are not public (drafts, scheduled, members-only, private), their revisions and diffs, for the member in X-OV-Subject. Published public posts need no capability. | blog-read |
| blog.post.schedule | blog | first-party | active | Schedule a publish of a revision (or an unpublish) at a future time, or cancel it. Idempotent per (post, action, time, revision); applied by Blog's worker with leases, so a restart never publishes twice; a job that cannot succeed emits blog.schedule.failed. | blog-write |
| blog.post.unpublish | blog | first-party | active | Take a published post down (readers get 404, Search a tombstone, feeds and sitemaps drop it). Editors, owners, the author, and staff (moderation). | blog-write |
| blog.post.update | blog | first-party | active | Edit a post: content becomes a new immutable revision (expected_revision required; 412 revision.conflict when someone saved first), slug changes leave 301 redirects, visibility, taxonomy, series, media attachments (OpenVibe.Media object ids) and revert as a new revision. Authors edit their own posts; editors and owners every post of the blog. | blog-write |
| blog.theme.set | blog | first-party | active | Choose a blog's theme from the small set of openvibe-shared token presets (vibe, paper, slate, sand, nord, high-contrast). There is no site-local theme engine and no custom CSS. Owners only. | blog-write |
| chat.live_bridge.write | chat | internal | planned | Live's remaining modules (AI viewers, chat relays, donations and alerts, /api/mod, recaps, news, calls, emotes, deploy notices) push to chat clients and write chat rows through OpenVibe.Chat: ChatServer calls in order (broadcasts, DMs with the participant check, TTS, channel sounds, disconnects, user updates, cache invalidations) and allow-listed chat-table writes, applied once per idempotency key, with placeholder ids mapped per Live boot. Transitional: shrinks as those modules move out of Live. | internal-write |
| chat.message.send | chat | first-party | active | Send a chat message to a room the actor is a member of (browsers over the chat socket; first-party services over Chat's service API). | chat-send |
| chat.presence.read | chat | internal | planned | Who is connected to chat where: connection and per-stream viewer counts, slow modes, and signed-in/anonymous sockets with their addresses — for Live's synchronous reads (health, AI viewer pacing, moderation by address). Internal: carries IP addresses. | internal-read |
| codes.release.manage grantable | codes | public | active | An app manages release metadata for ITSELF with its own token (audience openvibe.codes): create a release from a validated app or mod manifest, publish, deprecate (with a reason and an optional replacement) and revoke it. The token's sub must be app:<the app in the path>; people manage releases in the portal with their project role instead. Trust tiers are not part of this capability (staff metadata only). | codes-release-write |
| codes.release.read grantable | codes | public | active | Read public release metadata: an app's published, deprecated and revoked releases with their manifests, compatibility ranges and the app's trust tier (metadata only; it never grants anything). Drafts are never returned. Public; no token needed. | codes-read |
| community.comment.moderate | community | internal | active | Moderation of discussions: set a comment thread's visibility (public, hidden, locked — e.g. when the owner service hides the entity), delete any comment or forum post, pin and lock forum threads, read hidden threads, administer the Discord relay. Acting as itself (no X-OV-Subject) the service is the moderator; acting for a person it must vouch with X-OV-Staff: 1 that the person is staff. | community-moderate |
| community.comment.write | community | first-party | active | Typed comment threads as a service: resolve the thread of any EntityRef (browsers are limited to an allowlist of types), and comment, vote and delete one's own comments as the acting subject (X-OV-Subject), or comment as origin "ai" (never attributed to a person, roadmap 33). Ownership and limits are checked by Community. | community-write |
| community.paste.create grantable | community | public | active | Create a paste (text or screenshot). A service token creates it for the acting subject named in X-OV-Subject, or as origin "ai" for derived pastes (roadmap 33). | community-write |
| community.paste.moderate | community | internal | active | Staff moderation of any paste or comment (censor, delete, bulk). The caller vouches that the acting subject is staff. | community-moderate |
| community.paste.write | community | first-party | active | Edit, delete, fork, like, copy and comment on pastes as the acting subject (X-OV-Subject). Ownership is checked by Community, never by the caller. | community-write |
| community.post.create grantable | community | public | active | Forum writes as a service: create threads and replies in a space, vote on threads, and edit or delete one's own posts, as the acting subject (X-OV-Subject) or as origin "ai" (no author, labelled as AI). Space visibility (public, members, staff), locks and limits are checked by Community. | community-write |
| community.pulse.write | community | first-party | active | Publish public activity of the calling service's own entities to Pulse (EntityRef + title + url + origin user|ai|system + occurred_at), or retract it. Only visibility public is accepted; the ref's service must be the caller's. Provenance is kept: the first record's origin, actor (X-OV-Subject, never for ai/system) and time stand. | community-write |
| coupons.coupon.lookup | coupons | first-party | active | Read a merchant's active codes (status, confidence, report aggregates, restrictions, expiry or unknown, evidence) or one code. Public data only, the same response for every caller; anonymous callers may use the routes with tighter rate limits. The charter's coupons.lookup. | coupons-lookup |
| coupons.coupon.submit | coupons | first-party | active | Submit a coupon code for a merchant (by merchant id, host or URL) on behalf of a person (X-OV-Subject) or as AI output (X-OV-Origin: ai, held for staff review). The code starts with status unknown; a status, confidence or 'verified' field is refused. A site no merchant covers becomes a pending merchant for staff review. The charter's coupons.submit. | coupons-write |
| coupons.merchant.manage | coupons | first-party | active | Create merchants with their domain rules (never on a public suffix), add domain rules, and approve or disable merchants. Approving a pending merchant publishes the codes members submitted for it; disabling one takes its codes out of active results and Search. | coupons-write |
| coupons.merchant.resolve | coupons | first-party | active | Resolve a hostname to an active merchant (normalized host, eTLD+1 from a bundled public-suffix subset, subdomain rules; path rules never match host-only lookups). Public data only; anonymous callers may use the route with tighter rate limits. | coupons-lookup |
| coupons.report.create | coupons | first-party | active | Report that a code worked or failed, on behalf of a person (X-OV-Subject). One report per person, code and UTC day; only the latest per person counts; rate-limited per person; AI output (X-OV-Origin: ai) is refused. The response carries aggregates only, never a reporter. The charter's coupons.report. | coupons-report |
| coupons.status.update | coupons | first-party | active | Moderate a code: disable it, mark it expired, or return it to active results (its status is then recomputed from people's reports and time). reported_working and reported_failed cannot be set by anyone. | coupons-write |
| deals.flag.create | deals | first-party | active | Report a problem with an offer for the acting person (expired, price_wrong, duplicate, spam, other). One open report per person and offer; rate-limited. Flags never change an offer by themselves. | deals-write |
| deals.offer.expire | deals | first-party | active | Mark an active offer expired (the person who submitted it, or a moderator). Unknown expiry is never assumed; offers with a stated end expire on their own. | deals-write |
| deals.offer.merge | deals | first-party | active | Duplicate resolution (moderation): merge an offer into another, or unmerge it. Nothing is copied or deleted: votes, observations, sources and comments stay where they were written and the canonical offer reads across the group (a voter counts once). Audited with the tallies before and after; reversible. | deals-moderation |
| deals.offer.moderate | deals | first-party | active | Moderation: disable or enable an offer, record a person's review of imported or AI-assisted text (reviews are recorded for a usr_ subject only), read and resolve flags including vote-ring flags. Audited. | deals-moderation |
| deals.offer.submit | deals | first-party | active | Submit a deal for the acting person (X-OV-Subject): a link, title and what the person sees now (price with its currency, shipping, condition, availability — each optional, never defaulted). The first observation is recorded with its time. A link already posted answers 409 offer.duplicate with the existing offer. With X-OV-Origin: ai the text is AI-assisted: disclosed and noindex until a person reviews it. Rate-limited per person. | deals-write |
| deals.offer.update | deals | first-party | active | Edit an offer the acting person submitted (title, description, category, stated expiry, product link), or record a new observation of any active offer for the acting person (POST …/observations: price with currency, shipping, condition, availability, with the time it was observed). Prices are never edited in place; each observation is a new row. Services may state observed_at (never in the future). | deals-write |
| deals.product.resolve | deals | first-party | active | Resolve a product by its aliases (gtin, mpn, sku, exact name, url), creating it when none matches (create: false to only look up). Aliases that already name another product are reported as conflicts, never re-pointed. | deals-write |
| deals.vote.remove | deals | first-party | active | Remove the acting person's vote on an offer (kept as a removed row for history). Same abuse controls as deals.vote.set. | deals-vote |
| deals.vote.set | deals | first-party | active | Set the acting person's vote (+1 / -1) on an offer. Server-authoritative: weight and hotness are computed by Deals (hot@1), never taken from the request. Rate-limited per person, per IP hash and per offer; no votes on one's own offer; vote-ring detection flags moderators. | deals-vote |
| deals.watch.create | deals | first-party | active | Create a keyword, product or price-below watch, or a saved search (never notifies), for the acting person. A watch notifies at most once per observation (deals.watch.matched, internal; Deals never emails). | deals-write |
| deals.watch.delete | deals | first-party | active | Delete one of the acting person's watches or saved searches. | deals-write |
| deals.watch.read | deals | first-party | active | List the acting person's watches and saved searches with their notification counts. | deals-read |
| events.app.publish grantable | events | public | active | Publish durable events (events.event-envelope@1) as a developer app (ADR-014). The app token (sub app:app_<ULID>, project_id prj_<ULID>, env) may publish only event types app.<project_key>.<name>[.<more>], where project_key is 'p' followed by the project's ULID in lowercase (prj_01JAB... -> p01jab...). source must be 'app-' followed by the app's ULID in lowercase; actor is the app (or the on_behalf_of user). Events stores the token's env with each event: sandbox events are never delivered to production subscriptions nor shown to production apps. Rate and retained bytes are limited per project and environment by OpenVibe.Events. | events-app-publish |
| events.app.read grantable | events | public | active | Pull events as a developer app (ADR-014): only the app's own project's events (app.<project_key>.*, same environment as the token) plus first-party platform events with visibility public. Topic patterns must start with a literal segment; app.* patterns must name the caller's own project_key. Checkpoints are stored per app. | events-app-read |
| events.app.subscribe grantable | events | public | active | Manage webhook subscriptions as a developer app (ADR-014). Topic patterns are limited to the scope of events.app.read (own project's app.<project_key>.* events in the token's environment, plus public platform events). Endpoints must be https URLs whose host resolves only to public IP addresses; OpenVibe.Events re-checks the resolved address when it delivers and never follows redirects. Deliveries are signed with the subscription secret (X-OpenVibe-Signature: sha256=<HMAC of the raw body>). Subscriptions carry project_id and env; sandbox events reach sandbox subscriptions only. | events-app-subscribe |
| events.delivery.admin | events | internal | active | Operator access: inspect deliveries (including the dead-letter queue) and replay events to any subscription. | events-admin |
| events.event.publish | events | internal | active | Publish durable events (events.event-envelope@1) as the calling service: source must be the principal's service slug and event_type must use a prefix that source owns. Idempotent on event_id. | events-publish |
| events.event.read | events | internal | active | Read retained events of every visibility with a seq cursor (pull consumers), keep per-consumer checkpoints, and open realtime streams as a service principal. | events-read |
| events.subscription.manage | events | internal | active | Create, list, disable and enable the calling service's own webhook subscriptions (topic pattern + allow-listed internal endpoint, HMAC-signed deliveries with retry and dead letters). | events-subscribe |
| games.mod.manage | games | first-party | active | Manage mod installs in the browser game's registry (ADR-013): install a mods/mod-manifest.v1 manifest with its games-content@1 pack, approve or revoke individual capabilities of an install, enable, disable, and revoke an install for good (its effects end on the next server tick). Every action is audited and published as a games.mod.* event. Trust tiers are metadata and never grant anything. Also accepted from an openvibe.network owner/admin session. | games-admin |
| games.mod.read grantable | games | public | active | Read the browser game's installed mods: manifest, content pack, status, trust tier, requested and granted capabilities. Public; no token needed. | games-read |
| games.prop.place grantable | games | public | active | Runtime binding for mods (games-content@1): place and remove inert props (existing content items without health, storage, shop, machine or vehicle-part capabilities) in the world, owned by the mod so players cannot pick them up or move them. The props exist only while the capability is granted and the install enabled: revoking either despawns them on the next tick. | games-mod-runtime |
| games.world.announce grantable | games | public | active | Runtime binding for mods (games-content@1): broadcast a short server announcement to every player in the world, prefixed with the mod's name, at most once a minute per announcement. Checked at call time against the install's approved capabilities; a revoked grant stops it on the next tick. | games-mod-runtime |
| host.deploy.create | host | first-party | active | Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI. | host-deploy |
| host.domain.manage | host | first-party | active | Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability. | host-manage |
| host.site.manage | host | first-party | active | Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes and takedowns (stop serving a site or a whole project while keeping its content for review; lift) additionally need a Network staff user. | host-manage |
| identity.subject.resolve | network | first-party | active | Resolve a subject (or a legacy service-local id) to its canonical SubjectRef and display projection. | identity-read |
| live.chat_context.read | live | internal | planned | OpenVibe.Chat reads the Live data chat decisions depend on and caches it (Wave 6): user projections and token resolution (Live's own rules, with the Network subject), streams, slots and channels, channel moderation settings and moderators, active bans, follows, IP approvals, cosmetics and tags, the chat site settings (tts_*, GIF and soundboard keys only), anon first-seen, arena-cached TTS clips and the chat profile card. Read-only; no secrets beyond the chat settings. | internal-read |
| live.chat_effects.write | live | internal | planned | OpenVibe.Chat asks Live for the side effects chat triggers in data Live still owns (Wave 6): anon numbers, IP log, viewer counts and snapshots, /color, /ban /timeout /unban rows, IP approvals, /slow persistence, alert sounds, channel creation, TTS site settings, the per-message reactions (OpenCoins chat bonus, AI chat viewers, PowerChat relay), AI mod commands, arena commands, the media queue, hardware commands, /paste, translation, DM notifications and Media asset sync. Live re-checks the acting person (moderator, owner, admin) on every effect that acts for one, and refuses all of them unless CHAT_AUTHORITY=chat. | internal-write |
| live.chat_mirror.write | live | internal | planned | OpenVibe.Chat copies every change to the tables it owns into Live's tables of the same name and ids (a read mirror for Live's remaining readers and the rollback path). Only the twelve chat tables; only columns Live has; Live-only columns are kept; refused unless CHAT_AUTHORITY=chat. Retired when Live stops reading chat tables. | internal-write |
| live.follower.read | live | internal | active | Read who follows the channel behind a stream (Network subject or Network user id per follower), for OpenVibe.Network's go-live notifications from live.stream.started. Loopback only. | standard |
| live.lineage.resolve | live | internal | active | Resolve the canonical channel and owner behind a slug, nested slug, channel, stream, slot, VOD, clip, Media object, owner subject or legacy id, with the stream/VOD/clip lineage and how it was decided (roadmap §15.10, D20). A display name alone resolves nothing. Loopback only. | standard |
| live.tips_delivery.write | live | internal | active | OpenVibe.Tips' live-chat adapter: announce a settled tip in the creator's Live chat (donation line, paid message, TTS, media request at no charge). Owned by Live (docs/live-patch.diff adds the route); proposed here for Live's manifest. | standard |
| media.object.read grantable | media | public | active | Read object metadata / bytes in a namespace. | media-read |
| media.object.upload grantable | media | public | active | Upload a file object into an app namespace. | media-upload |
| mods.grant.manage | network | first-party | planned | Planned (ADR-013, grants in Network): create the `mod` principal (mod:mod_<ULID>) for an install and approve or revoke the subset of its manifest's requested capabilities, so a mod's grants are checked like any other principal's. Until Network implements it, each runtime keeps the approved subset itself (OpenVibe.Games: mod_grants). | network-admin |
| network.coins.credit | network | internal | active | Credit OpenCoins (loyalty, never money) to a Network user. Idempotent by idempotency_key. A token may only act for its own app_id. | ledger-write |
| network.coins.debit | network | internal | active | Debit OpenCoins; 409 insufficient_funds. A token may only act for its own app_id. | ledger-write |
| network.coins.transfer | network | internal | active | Atomically move OpenCoins between two Network users. A token may only act for its own app_id. | ledger-write |
| network.modules.read | network | first-party | active | Read a subject's user-module record in a granted namespace. | modules-read |
| network.modules.write | network | first-party | active | Write a subject's record in a namespace the service owns (If-Match revision). | modules-write |
| network.notifications.push | network | internal | active | Create a notification for Network users (ids already translated). | notify |
| network.project.manage | network | public | planned | Manage developer projects on behalf of a signed-in member: projects, members, apps, credential rotation and revocation, grant requests and approvals within the project allowance. Today the API is used with the member's own Network access token and authorized by project role; this capability is what a delegated client (Codes CLI, SDK) will hold. Allowance, environment policy and quotas stay staff-only. | projects-write |
| network.project.read | network | first-party | planned | Read a developer project as an owning service: its apps and their revocation state, approved grants, environment policy and quotas. Services use it to key tenancy by project_id and to enforce the quotas Network records (ADR-014). Never grantable to apps. | projects-read |
| news.cluster.manage | news | first-party | active | Merge clusters, split items into a new cluster, and reverse a merge or split. Every change is audited with exactly which items moved. | news-write |
| news.cluster.read | news | first-party | active | Read clusters (members, the stored explanation of every membership, merge/split history), source items with their dedupe outcome, and ingestion runs and source health. | news-read |
| news.perspective.update | news | first-party | active | Create or remove editor-labelled perspective groupings on a story and assign its sources to them. Labels are written by editors, never generated. | news-write |
| news.source.attach | news | first-party | active | Attach a source item to a story's source table (numbered, never renumbered) or detach it. | news-write |
| news.story.create | news | first-party | active | Open a story from a cluster (the cluster's live, non-duplicate source items become its first sources). Editors only: the service acts for an editor named in X-OV-Subject. | news-write |
| news.story.publish | news | first-party | active | Publish a revision (refused while it cites no source, rests on a source removed upstream or detached, or is AI-generated/AI-assisted without a person's approval), or unpublish a story. Publishing resolves the upstream flags the revision answers and publishes pending correction/update notes. | news-write |
| news.story.read | news | first-party | active | Read any story, including drafts, revisions, diffs, publishability problems and editorial flags. Published stories need no capability. | news-read |
| news.story.retract | news | first-party | active | Retract a published story with a public note. The story stays at its URL with the retraction notice, becomes noindex and leaves sitemaps and Search. Final. | news-write |
| news.story.revise | news | first-party | active | Save a new immutable revision (headline and paragraphs that each cite attached sources, with the source table, timeline and perspectives snapshotted), add correction/update notes, or request an OpenVibe.AI draft. With X-OV-Origin: ai the revision is AI-generated and cannot be published until a person approves it. | news-write |
| news.timeline.update | news | first-party | active | Add or remove a story's timeline entries; each entry has a date the source states and rests on one attached source. | news-write |
| news.topic.manage | news | first-party | active | Add a canonical topic (slug and name). | news-write |
| openre.key.rotate | openre | first-party | active | Rotate a stream's ingest key: a new key is issued and returned once; the old one is revoked immediately or after a grace period, and running sessions can optionally be ended. | openre-write |
| openre.output.read | openre | first-party | active | Read restream destinations (keys masked to their last four characters), outputs with health and progress, and bounded logs. | openre-read |
| openre.output.write | openre | first-party | active | Create, update, delete and test restream destinations (stream keys are write-only and sealed at rest; URLs must be rtmp/rtmps/srt with public hosts), and start or stop an output for the live session. | openre-write |
| openre.session.end | openre | first-party | active | Ask the worker that owns a session to disconnect its encoder (the session then ends normally). | openre-write |
| openre.session.read | openre | first-party | active | Read ingest sessions: lifecycle and transitions, worker and generation, media info, recording state and the playback descriptor; list worker generations. | openre-read |
| openre.stream.read | openre | first-party | active | Read stream definitions: ingest URLs, key metadata (hint, status; never a key), settings and external references. Owners read their own; a service reads every stream, or the streams of the X-OV-Subject it acts for. | openre-read |
| openre.stream.write | openre | first-party | active | Create, update and archive stream definitions (creation issues the first ingest key, returned once). Archiving is refused while a session is open. | openre-write |
| reviews.correction.submit | reviews | first-party | active | Send a correction (about an entity, alias, signal, summary or aggregate, with an optional evidence URL) to the editors' queue on behalf of the person named in X-OV-Subject. Corrections are read by editors and not published. | reviews-corrections |
| reviews.entity.manage | reviews | first-party | active | Editorial management of entities for the editor named in X-OV-Subject: create, edit, rename (old slugs redirect) and delete entities, add and remove aliases, typed links between entities or to another service's EntityRef, trust metadata (exclude a source or signal from aggregates with a visible reason, limitation and verification notes), and the correction queue. | reviews-write |
| reviews.entity.merge | reviews | first-party | active | Merge one entity into another, decided by the editor named in X-OV-Subject (never a service on its own). Nothing is rewritten: the merged entity keeps its aliases and its signals keep their attribution; an audited merged_into link records who, when and why, and the target's aggregate is recomputed over both. Reversible with reviews.entity.split. | reviews-write |
| reviews.entity.resolve | reviews | first-party | active | Resolve a name, URL, GTIN/SKU/MPN, source binding or external id to an entity (deterministic rules; a name alone yields candidates, never a match), read entity pages as JSON (aggregate with inputs, signals with provenance, summary), their history and summary revisions, and — for an editor named in X-OV-Subject — read the resolution queue and confirm or ignore an ambiguous source item. | reviews-read |
| reviews.entity.split | reviews | first-party | active | Undo a merge, decided by the editor named in X-OV-Subject: ends the merged_into link (audited) and restores the pre-merge attribution exactly; both aggregates are recomputed and a summary that cited the split-off signals is flagged with a pending revision. | reviews-write |
| reviews.signal.import | reviews | first-party | active | Import review signals from OpenVibe.Sources: one item by id, or the next pages of category-reviews items in change order. Reviews fetches the item itself (sources.item.read), keeps its provenance (source, item revision, retrieval time, licence note) and only the signal fields, never review text. Removed or revised items withdraw or replace their signal; the next aggregate revision reflects it. | reviews-write |
| reviews.summary.propose | reviews | first-party | active | The OpenVibe.AI seam (workflow reviews.summarize_entity): propose a summary revision whose every pro and con cites signals of the entity. It is stored with ai authorship (workflow and run id, stub-provider flag), is never published by this call, stays out of pages, feeds and Search until a person approves it, and can never carry a rating (rating fields and rating text are refused). | reviews-write |
| reviews.summary.publish | reviews | first-party | active | Write, review (approve or reject), publish and unpublish summary revisions as the editor named in X-OV-Subject. Publishing refuses AI or system-prepared revisions without a person's approval and any revision with a point that cites no live signal of the entity. | reviews-write |
| search.document.write | search | first-party | active | Index, replace or tombstone the calling service's own documents (search.index-document@1) and read its own inventory for reconciliation. The owner in the path must be the principal's service slug (svc:wiki writes owner wiki only). Revision-ordered: an older revision never overwrites a newer one, and at equal revision a deletion wins. | search-write |
| search.query.delegate | search | first-party | active | Query the index on behalf of a person: X-OV-Subject (usr_/gst_) plus the X-OV-Groups and X-OV-Entitlements the calling first-party service has just resolved for that person. Without X-OV-Subject the service sees public documents only. Drafts, unpublished and deleted documents are never returned to anyone. | search-query |
| sources.item.read | sources | first-party | active | Read source items with provenance (source, canonical URL, retrieval time, content and raw-body hashes, parser version, terms) in change order, and one item with its revisions. Each page states the staleness of the sources it contains. | sources-read |
| sources.source.manage | sources | first-party | active | Create, change, enable or disable and delete (only while it has no items) sources; trigger a fetch; add items to manual sources with an evidence URL; remove an item with a reason (sticky). Enabling needs a terms note, and a robots note for fetched sources. | sources-admin |
| sources.source.read | sources | first-party | active | List registered sources with health and staleness, their fetch runs (every attempt with an explicit state) and the health summary. Credential values are never part of any response; only the variable name is. | sources-read |
| tips.checkout.create | tips | first-party | active | Start a tip for a supporter (on_behalf SubjectRef): paid from the supporter's Billing credit (billing.transfer.create) or through a Billing checkout intent (billing.intent.create). Tips never prices money; Billing does. Idempotent by Idempotency-Key. | payments |
| tips.goal.close | tips | first-party | active | Close a goal; its history stays. | standard |
| tips.goal.create | tips | first-party | active | Create a goal for a creator. Goal totals are derived from settled interactions only. | standard |
| tips.goal.update | tips | first-party | active | Edit a goal (title, target, description, image, order) with optimistic revision checks; read private goals with contributions. | standard |
| tips.interaction.get | tips | first-party | active | Read one interaction with its separate payment state (from Billing) and delivery state (effects). | standard |
| tips.interaction.list | tips | first-party | active | List a creator's or a supporter's interactions and a creator's derived totals. | standard |
| tips.interaction.moderate | tips | internal | active | Moderate a creator's paid messages for them: read the review queue, hide a paid message from overlays, chat still to come and public pages, or show again one that was hidden or that the creator's word filter held. Never touches the money (no refund, no uncounting). People moderate as the creator or one of the creator's moderators; a service (e.g. Chat or Live relaying a channel moderator's action) needs this capability. Not in the charter list: proposed for the roadmap's "privacy/moderation controls" (Wave 9). | standard |
| tips.interaction.record | tips | internal | active | Record a tip that never touched OpenVibe money (ADR-012 EXTERNAL: a tip on a creator's own PowerChat) once per (provider, provider_ref); no Billing liability, excluded from Billing reconciliation. Not in the charter list: proposed because EXTERNAL tips need a recording path while Billing emits nothing for them. | standard |
| tips.media_request.create | tips | first-party | active | Start a paid media request for a supporter (allowed hosts, the creator's minimum and length); queued with the media-queue owner only after settlement. | payments |
| tips.overlay.config.get | tips | first-party | active | Read a creator's overlay configs (alert and goal display settings). | standard |
| tips.overlay.config.update | tips | first-party | active | Create or change a creator's overlay configs; open overlays receive the change at once. | standard |
| tips.overlay.token.create | tips | first-party | active | Mint a scoped overlay token (alerts, goals) for a creator — shown once, stored hashed, never a creator cookie — and list a creator's tokens without secrets. | standard |
| tips.overlay.token.revoke | tips | first-party | active | Revoke an overlay token; open overlay streams using it are closed immediately. | standard |
| tips.profile.get | tips | first-party | active | Read a creator's tip profile including a page that is switched off (public pages are readable without a token). | standard |
| tips.profile.update | tips | first-party | active | Create or update a creator's tip profile on their behalf: page switch (indexing), accepting, minimums, TTS and media-request settings. Creators do this themselves with their user token. | standard |
| tips.simulation.run | tips | first-party | active | Run the full effect path (overlay alert, goal widget, delivery) flagged test, with no Billing call, never counted in any total and never emitted as a durable event. The charter's 'tips.simulate' as a 3-segment id. | standard |
| tips.superchat.create | tips | first-party | active | Start a paid (highlighted) chat message for a supporter; the paid_messages row exists only after Billing settles it. | payments |
| tips.tts.request | tips | first-party | active | Start a paid text-to-speech request for a supporter, within the creator's TTS settings; delivered to chat only after settlement. | payments |
| tools.job.cancel grantable | tools | public | active | Cancel a queued or running job the calling principal created. | tools-job |
| tools.job.create grantable | tools | public | active | Submit an asynchronous tool job (img.process, audio.process, docs.process) with its input files (tools.job-request@1, JSON or multipart); the job is owned by the calling principal. Idempotency-Key supported. Also the owner's other writes on a job: retry a failed job as a new one (idempotent: asking again returns that retry), and keep a succeeded job's result while a reference such as community:paste:p_123 points at it (PUT), or let it expire again (DELETE, after the last reference). | tools-job |
| tools.job.read grantable | tools | public | active | Read a job the calling principal created: state, progress, result (Media object references or local files), SSE progress with Last-Event-ID resume, result files. | tools-read |
| tools.net.probe | tools | partner | planned | Run the network probe tools through the run API (ADR-027): the tools whose descriptor names auth.capability tools.net.probe (port checks, ping, traceroute, mtr, latency, bulk header and TLS checks), which send traffic to a host the caller chose. Only app and service principals holding this capability run them through the API or the SDK: partner visibility, so Network grants it to a developer project only when staff add it to that project's allowance by hand, and first-party services hold it through their own grants. People keep using the probe pages, which have a per-target throttle. Every run is throttled per target across all callers (limits.perTargetPerMinute) and written to the pseudonymous abuse log. Planned until the gateway serves the route. | tools-probe |
| tools.tool.read | tools | public | planned | Read the tool registry (ADR-027): every tool's descriptor (tools.tool@1: execution, whether the run API exposes it, how to call it, input and output schemas, files, limits, auth, quota class, cost, egress, hosts, docs), filtered by family, execution, api, status or text. GET /api/v1/tools answers tools.tool-list@1 with schemas as { $ref }; GET /api/v1/tools/:id has them embedded; GET /api/v1/tools/:id/schema answers { $schema, $id, $defs: { input, output } }. Open to everyone, anonymous callers included; cacheable. Planned until the gateway serves these routes. | tools-read |
| tools.tool.run | tools | public | planned | Run a tool through the uniform run API (ADR-027): POST /api/v1/tools/:id/run with tools.run-request@1 (JSON, or multipart with uploaded files), answered inline (tools.run@1 succeeded or failed) or, for a job tool that has not finished within wait_ms, with its job (202 + Location). Every tool whose descriptor has api true and auth.capability tools.tool.run. Callers are tiered, anonymous < session < user < app/service: tools with auth.anonymous true take anonymous callers (keyed by IP, IPv6 by /64); the others need a browser session, a signed-in person or a token. An app or service token needs this capability; people and browser sessions do not. Quotas count each tool's cost within its quota class, per caller. A job tool's run creates a job owned by the caller, like tools.job.create. Planned until the gateway serves the route. | tools-run |
| trade.alert.create | trade | first-party | active | Create an alert rule for the person in X-OV-Subject: threshold (a crossing of a metric in a unit), filing_type or new_document. Deliveries are unique per (rule, triggering observation or document) and are sent as trade.alert.triggered (visibility subject); no email. | trade-write |
| trade.alert.delete | trade | first-party | active | Delete an alert rule of the person in X-OV-Subject. | trade-write |
| trade.alert.read | trade | first-party | active | Read the alert rules and recent deliveries of the person in X-OV-Subject. | trade-read |
| trade.context.propose | trade | first-party | active | Deliver a context revision. With X-OV-Origin: ai it is OpenVibe.AI output (workflow trade.summarize_market_context and its run id required): authorship ai, never attributed to a person, stored as a draft that cannot be published before a person on the editor list approves it. Text that reads as a recommendation to trade is refused. | trade-write |
| trade.context.read | trade | first-party | active | Read an instrument's published context with its citations and disclosure; with ?all=1 the drafts awaiting review; and the numbered-source input for OpenVibe.AI's trade.summarize_market_context workflow. | trade-read |
| trade.instrument.manage | trade | first-party | active | Create and edit instruments (symbol, name, kind, exchange, CIK, currency, status) and add ticker, CIK or name aliases. People must also be on the Trade editor list. | trade-write |
| trade.instrument.resolve | trade | first-party | active | Resolve a ticker, SEC CIK or exact company name to an instrument, deterministically (CIK, then ticker, then exact normalised name; several name matches are "ambiguous" and none is chosen). Browsers and anonymous readers need no capability. | trade-read |
| trade.observation.write | trade | first-party | active | Record a market observation a source stated: value exactly as stated, unit, currency, observed_at (required, never inferred), source key and reference, retrieved_at (required). Idempotent per (source_key, source_ref); a different value under the same reference is 409. Services only. | trade-write |
| trade.watchlist.create | trade | first-party | active | Create a private watchlist for the person in X-OV-Subject. | trade-write |
| trade.watchlist.delete | trade | first-party | active | Delete a watchlist of the person in X-OV-Subject. | trade-write |
| trade.watchlist.read | trade | first-party | active | Read the watchlists of the person in X-OV-Subject (never anyone else's: another person's watchlist is 404). | trade-read |
| trade.watchlist.update | trade | first-party | active | Rename a watchlist of the person in X-OV-Subject, or add and remove instruments on it. | trade-write |
| vip.creator.members.list | vip | first-party | active | A creator's active members with the plan version each joined under: from Billing's subscriptions, or VIP's fresh projection (labelled) when Billing does not answer. | vip-read |
| vip.entitlement.check | vip | first-party | active | Is a subject a member of a creator right now? Answered from VIP's short-lived projection of Billing entitlements, with a direct Billing check when the projection is stale (mode auto) or always (mode authoritative). Past valid_until plus grace the answer is "unknown", which never authorizes. | vip-read |
| vip.membership.checkout | vip | first-party | active | Start joining a plan on behalf of a member: VIP records the plan version chosen and hands off to OpenVibe.Billing (payment intent, or a period paid from the member's credit). Billing charges; VIP never does. | vip-write |
| vip.membership.status | vip | first-party | active | A member's memberships: the plan version each was bought under, preferences, and the entitlement status (projection, confirmed with Billing when stale). | vip-read |
| vip.perk.create | vip | first-party | active | Define a perk (badge, emote, gated content, room, role) for a creator or the network, with its product bindings. | vip-write |
| vip.perk.list grantable | vip | public | active | List a creator's perks (and the network perks) with product bindings. Active perks are public; the grant adds retired ones. | vip-read |
| vip.perk.update | vip | first-party | active | Rename, describe, retire a perk or replace its product bindings. Published plan versions keep the perk snapshot they were published with. | vip-write |
| vip.plan.archive | vip | first-party | active | Archive a plan: no new members; existing members keep their terms until Billing ends their membership. | vip-write |
| vip.plan.create | vip | first-party | active | Create a membership plan (version 1) for a creator, or for the network (staff). A published plan is sold through OpenVibe.Billing as the creator's channel subscription; Billing sets the price. | vip-write |
| vip.plan.list grantable | vip | public | active | List a creator's plans with their current and draft versions and the full version history. Published plans are public without a grant; the grant adds drafts and archived plans. | vip-read |
| vip.plan.update | vip | first-party | active | Edit a plan by creating a new immutable version (published at once when the plan is published), or publish a draft. Earlier versions and the terms members joined under are never rewritten. | vip-write |
| vip.resource.policy.evaluate | vip | first-party | active | May subject S see resource R (under rule X)? Fails closed: no rule, a disabled rule, an entitlement VIP cannot confirm, a missing perk or any error is allow: false with the reason. | vip-read |
| vip.resource.policy.get | vip | first-party | active | Read the gated-resource rule VIP holds for a resource (EntityRef), or a creator's rules. | vip-read |
| vip.resource.policy.set | vip | first-party | active | Create, replace or remove the rule gating a resource (EntityRef) for a creator: any member, members of one plan, or members whose plan version includes a perk; optionally always checked with Billing (sensitive). | vip-write |
| wiki.citation.attach | wiki | first-party | active | Attach citations (an OpenVibe.Sources item id, whose URL, title, retrieval time and license come from the item's provenance, or an http(s) URL with its retrieval time) to the newest, unpublished revision of a page. Citations are append-only and stay with the revision that used them. | wiki-write |
| wiki.page.create | wiki | first-party | active | Create pages and write human-authored revisions (text, typed infobox values, citations), move or rename pages (old addresses answer 301), attach OpenVibe.Media objects the person can read in Media and check them, on behalf of the person named in X-OV-Subject, who must be an editor of the space. Deleting pages, changing page visibility and importing a bundle of pages into the space need the owner role. | wiki-write |
| wiki.page.read | wiki | first-party | active | Read pages, revisions, diffs, citations and AI proposals as the person named in X-OV-Subject sees them (without a subject: public, published content only). Members-only and private pages follow the space's roles; drafts and history of unpublished pages need the editor role. | wiki-read |
| wiki.revision.propose | wiki | first-party | active | Propose a revision (or a new page) as the output of an OpenVibe.AI workflow run. The proposal becomes an immutable revision with ai authorship (workflow id and run id, stub-provider flag) and a pending proposal; it is never published until a person with the editor role approves it. | wiki-write |
| wiki.revision.publish | wiki | first-party | active | Publish a revision now or at a scheduled time (idempotent), unpublish a page, and record a person's review (approved or rejected) of an AI proposal or of an existing AI-assisted revision, on behalf of the editor named in X-OV-Subject. AI-generated revisions cannot be published without an approving review by a person. | wiki-write |
| wiki.revision.revert | wiki | first-party | active | Revert a page to an earlier revision by adding a new revision that copies its text, infobox and citations (history is never rewritten), on behalf of the editor named in X-OV-Subject. A revert of a published page is published. | wiki-write |
| wiki.search.query | wiki | first-party | active | Search published pages by title and text, returning only pages the person named in X-OV-Subject may read (without a subject: public pages only). Network-wide discovery goes through OpenVibe.Search, which Wiki feeds with wiki.index_document.* events. | wiki-read |
| wiki.space.create | wiki | first-party | active | Create a wiki space and change a space's settings and roles. People create user spaces they own; official (editorial) spaces are created by staff or by a service acting as itself. Settings and role changes need the owner role of the space (for a service: the X-OV-Subject person). | wiki-write |