# Service workspaces and access

M7 services distinguish the authenticated caller from the principal whose
workspace and resource access an operation uses. A person can work personally
or through an authorized organization. The receiving service applies its own
admission, resource membership and action capabilities.

## Establish the caller

Obtain credentials through the documented [M7 SSO flow](https://m7.org/docs/api/sso.user.m7.org/quickstart.md).
Use the receiving service's exact audience, credential profile and proof rules.
The API base URL and token audience can differ: Mailbox, for example, documents
its exact audience separately from its versioned API base.

A valid identity token or an organization's ownership descriptor does not grant
access to that organization's service resources. Organization discovery is
owner-controlled; active membership, permitted organization actions and the
selected resource's access policy still apply. See
[organization projection](https://m7.org/docs/api/sso.user.m7.org/userinfo-orgs.md) for the identity
contract and each service's authorization guide for admission and enforcement.

## Select the resource context

Read the selected service's workspace guide and use its documented request
fields. Project-based services, bucket-based services and publications retain
their own identifiers and lifecycle rules. A resource UUID or capability value
returned by one service is not an authorization grant for another service.

| Service | Workspace and resource entry | Authorization |
| --- | --- | --- |
| BigFS | [Workspaces](https://m7.org/docs/api/api.bigfs.m7.org/workspaces.md), then [buckets](https://m7.org/docs/api/api.bigfs.m7.org/buckets.md). | [BigFS access](https://m7.org/docs/api/api.bigfs.m7.org/authorization.md) |
| Document | [Workspaces](https://m7.org/docs/api/api.document.m7.org/workspaces.md), then [bucket selection](https://m7.org/docs/api/api.document.m7.org/buckets.md). | [Document access](https://m7.org/docs/api/api.document.m7.org/authorization.md) |
| Blog | [Workspaces](https://m7.org/docs/api/api.blog.service.m7.org/workspaces.md), then [publication context](https://m7.org/docs/api/api.blog.service.m7.org/context-route.md). | [Blog access](https://m7.org/docs/api/api.blog.service.m7.org/authorization.md) |
| Dead Drop | [Workspaces](https://m7.org/docs/api/api.drop.m7.org/workspaces.md), then [projects](https://m7.org/docs/api/api.drop.m7.org/projects.md). | [Drop access](https://m7.org/docs/api/api.drop.m7.org/authorization.md) |
| Post | [Workspaces](https://m7.org/docs/api/api.post.m7.org/workspaces.md), then [projects](https://m7.org/docs/api/api.post.m7.org/projects.md). | [Post access](https://m7.org/docs/api/api.post.m7.org/authorization.md) |
| Mailbox | [Workspaces](https://m7.org/docs/api/api.mail.m7.org/workspaces.md), then [projects](https://m7.org/docs/api/api.mail.m7.org/projects.md). | [Mailbox access](https://m7.org/docs/api/api.mail.m7.org/authorization.md) |
| Relationship | [Project and scope context](https://m7.org/docs/api/api.relationship.service.m7.org/scopes.md). | [Relationship access](https://m7.org/docs/api/api.relationship.service.m7.org/authorization.md) |
| Capability | [Owner-enabled project discovery](https://m7.org/docs/api/api.capability.service.m7.org/discovery.md). | [Capability discovery access](https://m7.org/docs/api/api.capability.service.m7.org/authorization.md) |

## Use the returned capabilities

Where a resource-context endpoint returns capabilities, use them to present
available actions and send only the requested operation's documented fields.
The service evaluates authority again when processing the request. Membership,
organization grants, resource state or catalogue revisions can change between
reading context and performing an action.

Follow the service's handling for denied actions, conflicts and stale versions.
Refreshing a credential does not restore removed membership or resource grants.
Use its pagination continuation fields and preserve the same workspace/resource
selection across pages. The linked references provide exact fields, status
codes and retry rules; these vary by service.

[Services](https://m7.org/docs/api/services/) · [Choosing a service](https://m7.org/docs/api/services/choosing-a-service.md)