stable · guide · 0.1.0
Project Backend Capability Matrix
openid, profile, and email are interactive OIDC authorization scopes registered on the Project Client. They are never Project Credential scopes. API scopes such as clients:read and identity-migrations:write are issued only to a Project Credential and stay in the Project Backend.
Select only the rows the Project Backend needs. “Operator” means an authorized Platform Operator; “Backend” means the Project Backend maintainer. Idempotency and reconciliation remain Backend responsibilities even when an SDK performs transport retries.
| Capability | Required scope | MiniCenter configuration | Project Backend responsibility | Idempotency and reconciliation | Sandbox provider and acceptance evidence | Production activation gate |
|---|---|---|---|---|---|---|
| Identity & Trust | clients:read, openid, profile, email; migration also identity-migrations:write |
Operator registers exact redirects and scopes | BFF validates OIDC tokens and owns Membership; authenticate legacy users before migration | Persist state/nonce/verifier; retry migration create with one key and inspect status | Hosted sign-in, durable Account ID, migration recovery | Security review, production redirects and explicit Identity Migration enablement |
| Files & Media | files:write; add files:read only for private downloads |
Quota and storage/scanner adapters | Declare hash/type/size and keep quarantined objects unavailable | Reuse create/complete/download/publication keys; inspect object state after loss | Clean upload, private download, public preset and EICAR rejection IDs | Storage, malware scanner, retention and quota approval |
| Payments | payments:write, payments:read |
Sandbox ECPay adapter and callback | Own Project Order, price and Entitlement; reconcile settlement | Stable order key; event/read reconciliation | Sandbox checkout, callback, read and duplicate evidence | Merchant, callback, refund and accounting approval |
| Notifications | notifications:write |
Operator-approved sender, templates and endpoints | Own purpose, consent, locale and business trigger | Stable intent key; inspect delivery and deduplicate signals | Sandbox provider outcome and delivery ID | Sender/domain/provider approval and suppression review |
| Events & Webhooks | events:write |
Approved subscription and signing secret | Verify signature, deduplicate event ID and order per stream | Stable publish key; replay/read after uncertain delivery | Signature, duplicate and retry/dead-letter evidence | HTTPS endpoint, secret delivery and replay runbook |
| Jobs & Scheduling | schedules:write |
Registered operation and signed callback | Verify signature and deduplicate invocation ID | Stable schedule keys; inspect schedule/invocation | success, retry, cancellation and lost-lease evidence | Worker capacity, endpoint and rollback approval |
| Realtime | realtime:connect |
Exact environment-scoped browser origin and connection quota | BFF verifies session/membership and returns short-lived grants | Reconnect from authoritative state; bound retries | Chrome, Firefox and Safari SSE/publish evidence | Production origins, gateway capacity and browser acceptance |
| Feature Flags & Configuration | configuration:read |
Operator publishes immutable configuration | Cache by version and evaluate safe defaults locally | Reconcile by version/event; never persist secret values | empty-bootstrap and version-change evidence | Production values, secret references and owner approval |
| Security, Audit & Privacy | Platform Session; Project Audit submission uses audit:write |
Retention and privacy responsibilities | Keep business records; submit only opaque references and constrained facts | Reuse one key for an identical fact; retain the returned Audit ID | submission isolation, replay, export, correction, stop-processing and redaction evidence | Legal/retention review and accountable privacy operator |
| Usage, Quotas & Administration | Operator Platform Session | Exact client/environment quota | Handle 429, backoff and capacity fallback |
Honor Retry-After; reconcile current usage |
soft/hard limit response evidence | Capacity owner approves production quota |
| Advertising & Sponsorship | advertising:placements, advertising:serve, advertising:reports; deletion uses accounts:deletion |
Placements, campaigns and reporting rules | Own page context and exclude direct identifiers | Stable definitions/conversions; reconcile aggregate reports | house-ad, decision, click and aggregate evidence | Inventory, billing, privacy and revenue-share approval |
| Developer Tooling | Capability-specific scopes | Operator registers client and delivers one-time secret | Use stable raw OpenAPI or pin a published SDK; preserve correlation | Follow the selected capability row | executable raw HTTP and beta source-SDK acceptance | Accepted evidence; ecosystem artifact review when using an SDK; separate production request |
Public OpenAPI and event schemas are authoritative. SDK versions are listed in Sandbox Quick Start; capability guides define the detailed payload and failure states.