AT Protocol server API
Server management, session creation, account administration
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/atproto-server-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: AT Protocol Core API (com.atproto) Server API
description: The core AT Protocol XRPC API covering server identity, repository management, account administration, moderation/labeling, and data synchronization. Endpoints are accessed via HTTP GET (queries) and POST (procedures) at /xrpc/{NSID} on any PDS host or the Bluesky-hosted services at bsky.social and bsky.network. Schemas are defined using Lexicon, AT Protocol's schema definition language.
version: 1.0.0
contact:
name: AT Protocol
url: https://atproto.com/
license:
name: MIT / Apache-2.0
url: https://github.com/bluesky-social/atproto/blob/main/LICENSE.txt
servers:
- url: https://bsky.social/xrpc
description: Bluesky PDS (Personal Data Server)
- url: https://bsky.network/xrpc
description: Bluesky Relay / BGS
- url: https://{pds_host}/xrpc
description: Self-hosted PDS
variables:
pds_host:
default: bsky.social
description: Hostname of the Personal Data Server
security:
- bearerAuth: []
- {}
tags:
- name: server
description: Server management, session creation, account administration
paths:
/com.atproto.server.describeServer:
get:
operationId: com_atproto_server_describeServer
summary: Describe Server
description: Describes the server's account creation requirements and capabilities. Implemented by PDS. No authentication required.
tags:
- server
security:
- {}
responses:
'200':
description: Server description
content:
application/json:
schema:
$ref: '#/components/schemas/ServerDescription'
'400':
$ref: '#/components/responses/BadRequest'
/com.atproto.server.createSession:
post:
operationId: com_atproto_server_createSession
summary: Create Session
description: Create an authentication session (login).
tags:
- server
security:
- {}
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateSessionInput'
responses:
'200':
description: Session created successfully
content:
application/json:
schema:
$ref: '#/components/schemas/Session'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/com.atproto.server.deleteSession:
post:
operationId: com_atproto_server_deleteSession
summary: Delete Session
description: Delete the current session (logout).
tags:
- server
responses:
'200':
description: Session deleted
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/com.atproto.server.getSession:
get:
operationId: com_atproto_server_getSession
summary: Get Session
description: Get information about the current auth session.
tags:
- server
responses:
'200':
description: Current session info
content:
application/json:
schema:
$ref: '#/components/schemas/SessionInfo'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/com.atproto.server.refreshSession:
post:
operationId: com_atproto_server_refreshSession
summary: Refresh Session
description: Refresh an authentication session using a refresh JWT.
tags:
- server
security:
- refreshAuth: []
responses:
'200':
description: Session refreshed
content:
application/json:
schema:
$ref: '#/components/schemas/Session'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/com.atproto.server.createAccount:
post:
operationId: com_atproto_server_createAccount
summary: Create Account
description: Create an account. Implemented by PDS.
tags:
- server
security:
- {}
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAccountInput'
responses:
'200':
description: Account created successfully
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAccountOutput'
'400':
$ref: '#/components/responses/BadRequest'
/com.atproto.server.deleteAccount:
post:
operationId: com_atproto_server_deleteAccount
summary: Delete Account
description: Delete an actor's account with a token and password.
tags:
- server
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- did
- password
- token
properties:
did:
type: string
description: DID of account to delete
password:
type: string
token:
type: string
description: Confirmation token received via email
responses:
'200':
description: Account deleted
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/com.atproto.server.checkAccountStatus:
get:
operationId: com_atproto_server_checkAccountStatus
summary: Check Account Status
description: Returns the status of an account, especially as pertaining to import or recovery.
tags:
- server
responses:
'200':
description: Account status
content:
application/json:
schema:
$ref: '#/components/schemas/AccountStatus'
'401':
$ref: '#/components/responses/Unauthorized'
components:
schemas:
SessionInfo:
type: object
required:
- handle
- did
properties:
handle:
type: string
did:
type: string
didDoc:
type: object
additionalProperties: true
email:
type: string
emailConfirmed:
type: boolean
emailAuthFactor:
type: boolean
active:
type: boolean
status:
type: string
CreateAccountInput:
type: object
required:
- handle
properties:
email:
type: string
handle:
type: string
description: Requested handle for the account
did:
type: string
description: Pre-existing atproto DID, being imported to a new account
inviteCode:
type: string
verificationCode:
type: string
verificationPhone:
type: string
password:
type: string
description: Initial account password
recoveryKey:
type: string
description: DID PLC rotation key (recovery key)
Session:
type: object
required:
- accessJwt
- refreshJwt
- handle
- did
properties:
accessJwt:
type: string
description: Short-lived access token
refreshJwt:
type: string
description: Long-lived refresh token
handle:
type: string
description: The user's handle
did:
type: string
description: The user's DID (Decentralized Identifier)
didDoc:
type: object
description: Full DID document
additionalProperties: true
email:
type: string
description: Email address (if available)
emailConfirmed:
type: boolean
emailAuthFactor:
type: boolean
active:
type: boolean
status:
type: string
description: Account status if not active
enum:
- takendown
- suspended
- deactivated
ServerDescription:
type: object
required:
- did
- availableUserDomains
properties:
inviteCodeRequired:
type: boolean
description: If true, an invite code must be supplied to create an account
phoneVerificationRequired:
type: boolean
description: If true, a phone verification token must be supplied
availableUserDomains:
type: array
description: List of domain suffixes that can be used in account handles
items:
type: string
links:
type: object
properties:
privacyPolicy:
type: string
format: uri
termsOfService:
type: string
format: uri
contact:
type: object
properties:
email:
type: string
did:
type: string
description: DID of the server
AccountStatus:
type: object
required:
- activated
- validDid
- repoCommit
- repoRev
- repoBlocks
- indexedRecords
- privateStateValues
- expectedBlobs
- importedBlobs
properties:
activated:
type: boolean
validDid:
type: boolean
repoCommit:
type: string
repoRev:
type: string
repoBlocks:
type: integer
indexedRecords:
type: integer
privateStateValues:
type: integer
expectedBlobs:
type: integer
importedBlobs:
type: integer
CreateAccountOutput:
type: object
required:
- accessJwt
- refreshJwt
- handle
- did
properties:
accessJwt:
type: string
refreshJwt:
type: string
handle:
type: string
did:
type: string
didDoc:
type: object
additionalProperties: true
Error:
type: object
required:
- error
- message
properties:
error:
type: string
description: Error name/code
message:
type: string
description: Human-readable error message
CreateSessionInput:
type: object
required:
- identifier
- password
properties:
identifier:
type: string
description: Handle or other identifier supported by the server
password:
type: string
authFactorToken:
type: string
description: Two-factor authentication token
allowTakendown:
type: boolean
description: When true, return a narrow-scoped token for takendown accounts
responses:
Unauthorized:
description: Authentication required
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
BadRequest:
description: Bad request or validation error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Access JWT obtained from createSession or refreshSession
refreshAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Refresh JWT obtained from createSession
externalDocs:
description: AT Protocol XRPC Specification
url: https://atproto.com/specs/xrpc