Service workspaces and access
M7 services distinguish the authenticated caller from the principal whose workspace and resource access an operation uses. A person can work personally or through an authorized organization. The receiving service applies its own admission, resource membership and action capabilities.
Establish the caller
Obtain credentials through the documented M7 SSO flow. Use the receiving service's exact audience, credential profile and proof rules. The API base URL and token audience can differ: Mailbox, for example, documents its exact audience separately from its versioned API base.
A valid identity token or an organization's ownership descriptor does not grant access to that organization's service resources. Organization discovery is owner-controlled; active membership, permitted organization actions and the selected resource's access policy still apply. See organization projection for the identity contract and each service's authorization guide for admission and enforcement.
Select the resource context
Read the selected service's workspace guide and use its documented request fields. Project-based services, bucket-based services and publications retain their own identifiers and lifecycle rules. A resource UUID or capability value returned by one service is not an authorization grant for another service.
| Service | Workspace and resource entry | Authorization |
|---|---|---|
| BigFS | Workspaces, then buckets. | BigFS access |
| Document | Workspaces, then bucket selection. | Document access |
| Blog | Workspaces, then publication context. | Blog access |
| Dead Drop | Workspaces, then projects. | Drop access |
| Post | Workspaces, then projects. | Post access |
| Mailbox | Workspaces, then projects. | Mailbox access |
| Relationship | Project and scope context. | Relationship access |
| Capability | Owner-enabled project discovery. | Capability discovery access |
Use the returned capabilities
Where a resource-context endpoint returns capabilities, use them to present available actions and send only the requested operation's documented fields. The service evaluates authority again when processing the request. Membership, organization grants, resource state or catalogue revisions can change between reading context and performing an action.
Follow the service's handling for denied actions, conflicts and stale versions. Refreshing a credential does not restore removed membership or resource grants. Use its pagination continuation fields and preserve the same workspace/resource selection across pages. The linked references provide exact fields, status codes and retry rules; these vary by service.