OwnedResourceControlRequest common.owned-resource-control-request@1
Generated at from
openvibe-contracts v0.177.0 and
openvibe-sdk v0.44.0.
- Version
- 1.0.0
- Owner
- contracts
- Visibility
- first-party
- Status
- active
- Compatibility
- backward
- Decision
- ADR-048
- Schema
https://openvibe.network/contracts/common/owned-resource-control-request.v1.json
common.owned-resource-control-request@1 (ADR-048 amendment 2026-10-15, step 8 phase 2): one control operation on a person-owned resource. Robots, chat rooms, restream definitions and pastes belong to a person, not to a project, so they carry no OVRN and the project-scoped common.resource-control-request@1 cannot name them. OpenVibe.Services sends this to the owning authority's POST /api/v1/resources/control (the same route, told apart by `owned`), acting for the person in on_behalf_of. owned names the resource by its index summary's kind and id. owner is the person it belongs to: the authority refuses unless its own record says the same (Services also offers actions only on the viewer's own resources). A sensitive action (deleting, physical control) asked by an agent is refused with confirmation_required until the owner approves, as for project resources. idempotency_key makes a retry safe: the authority answers a repeated key from the same caller with the first result, and refuses the key reused with another request. Answered with common.resource-control-result@1 (without resource: there is no OVRN). The actions each authority takes are in its <service>.resource.control capability; any other action is refused unsupported.
Fields
| Field | Type | Required | Description | Constraints |
|---|---|---|---|---|
action | enum | yes |
| |
owned | object | yes | The resource, as its owning authority's resource index lists it (common.resource-summary@1 kind and id). |
|
owned.kind | string | yes |
| |
owned.id | string | yes | The summary's id: a prefixed ULID (rob_…) or the service's own slug (a paste, a room). |
|
owner | object | yes | The person the resource belongs to. Person-owned resources belong to people, never to agents or apps. |
|
owner.type | const | yes |
| |
owner.id | string | yes |
| |
params | object | Action-specific input, shaped by the authority's own contract (never redefined here). | ||
idempotency_key | string | yes |
| |
on_behalf_of | identity.subject-ref | Who asks: the owner, or their agent (whose sensitive actions wait for the owner's approval). | ||
confirmation_id | string | null | The approved confirmation from an earlier confirmation_required answer. |
| |
dry_run | boolean | Decide and explain without applying. |
| |
trace_id | string |
|
Examples
From the contract's own test fixtures: valid ones validate, rejected ones must fail.
Valid: bot-robot-stop
{
"action": "stop",
"owned": {
"kind": "bot.robot",
"id": "rob_01JAB2C3D4E5F6G7H8J9K0MNPR"
},
"owner": {
"type": "user",
"id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"on_behalf_of": {
"type": "user",
"id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"idempotency_key": "idem_stop_robot_1"
}Valid: community-paste-delete-dry-run
{
"action": "delete",
"owned": {
"kind": "community.paste",
"id": "my-notes-2026"
},
"owner": {
"type": "user",
"id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"idempotency_key": "idem_delete_paste_1",
"dry_run": true,
"trace_id": "0af7651916cd43dd8448eb211c80319c"
}Rejected: agent-owner
{
"action": "stop",
"owned": {
"kind": "bot.robot",
"id": "rob_01JAB2C3D4E5F6G7H8J9K0MNPR"
},
"owner": {
"type": "agent",
"id": "agt_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"idempotency_key": "idem_stop_robot_2"
}Rejected: create
{
"action": "create",
"owned": {
"kind": "chat.room",
"id": "new"
},
"owner": {
"type": "user",
"id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"idempotency_key": "idem_create_room"
}Rejected: with-project
{
"action": "archive",
"owned": {
"kind": "chat.room",
"id": "lobby"
},
"owner": {
"type": "user",
"id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
},
"project_id": "prj_01JAB2C3D4E5F6G7H8J9K0MNPQ",
"idempotency_key": "idem_archive_1"
}Validate
const contracts = require('openvibe-contracts');
contracts.validate('common.owned-resource-control-request@1', value); // { valid, errors: [{ path, message }] }