Merge e92c5ca539 into 966109da49

Remove more references to preferred method
Remove preferred method mention.
2026-08-03 22:47:49 +02:00 · 2026-07-16 12:32:35 +00:00 · 2026-07-16 08:32:32 -04:00 · 2026-07-16 08:30:11 -04:00 · 2026-07-15 17:43:19 +00:00 · 2026-07-15 10:41:01 +01:00
84 changed files with 27 additions and 354 deletions
--- a/changelogs/appendices/newsfragments/2396.clarification
+++ b/changelogs/appendices/newsfragments/2396.clarification
@ -0,0 +1 @@
+Clarify that clients must avoid producing ambiguous matrix.to URIs. Contributed by @HarHarLinks.
--- a/changelogs/client_server/newsfragments/2408.breaking
+++ b/changelogs/client_server/newsfragments/2408.breaking
@ -0,0 +1 @@
+Providing access tokens via query string parameters is no longer supported.
--- a/changelogs/client_server/newsfragments/2412.clarification
+++ b/changelogs/client_server/newsfragments/2412.clarification
@ -0,0 +1 @@
+Use the User ID type in OlmPayload and DeviceKeys.
--- a/changelogs/client_server/newsfragments/2418.clarification
+++ b/changelogs/client_server/newsfragments/2418.clarification
@ -0,0 +1 @@
+Rename OlmPayload to OlmPlaintext to avoid confusion with Olm message Payload Bytes.
--- a/changelogs/identity_service/newsfragments/2408.breaking
+++ b/changelogs/identity_service/newsfragments/2408.breaking
@ -0,0 +1 @@
+Providing access tokens via query string parameters is no longer supported.
--- a/content/appendices.md
+++ b/content/appendices.md
@ -887,20 +887,22 @@ https://matrix.to/#/<identifier>/<extra parameter>?<additional arguments>

 The identifier may be a room ID, room alias, or user ID. The
 extra parameter is only used in the case of permalinks where an event ID
-is referenced. The matrix.to URI, when referenced, must always start
+is referenced. The matrix.to URI, when referenced, MUST always start
 with `https://matrix.to/#/` followed by the identifier.

 The `<additional arguments>` and the preceding question mark are
-optional and only apply in certain circumstances, documented below.
+OPTIONAL and only apply in certain circumstances, documented below.

-Clients should not rely on matrix.to URIs falling back to a web server
-if accessed and instead should perform some sort of action within the
+Clients SHOULD NOT rely on matrix.to URIs falling back to a web server
+if accessed and instead SHOULD perform some sort of action within the
 client. For example, if the user were to click on a matrix.to URI for a
-room alias, the client may open a view for the user to participate in
+room alias, the client MAY open a view for the user to participate in
 the room.

 The components of the matrix.to URI (`<identifier>` and
 `<extra parameter>`) MUST be percent-encoded as per RFC 3986.
+Failure to do so will result in downstream software misinterpreting
+the links as invalid/not turning them into clickable links in UI.

 Examples of matrix.to URIs are:

--- a/content/client-server-api/_index.md
+++ b/content/client-server-api/_index.md
@ -570,15 +570,9 @@ invalidate the access token the client must use [token revocation](#token-revoca
 Access tokens may be provided via a request header, using the Authentication
 Bearer scheme: `Authorization: Bearer TheTokenHere`.

-Clients may alternatively provide the access token via a query string parameter:
-`access_token=TheTokenHere`. This method is deprecated to prevent the access
-token being leaked in access/HTTP logs and SHOULD NOT be used by clients.
-
-Homeservers MUST support both methods.
-
 {{% boxes/note %}}
-{{% changed-in v="1.11" %}}
-Sending the access token as a query string parameter is now deprecated.
+{{% changed-in v="1.20" %}}
+Sending the access token as a query string parameter is no longer supported.
 {{% /boxes/note %}}

 When credentials are required but missing or invalid, the HTTP call will
--- a/content/client-server-api/modules/end_to_end_encryption.md
+++ b/content/client-server-api/modules/end_to_end_encryption.md
@ -1762,12 +1762,9 @@ Messages with type 1 can only be decrypted with an existing session. If
 there is no matching session, the client must treat this as an invalid
 message.

-The plaintext payload is of the form:
+The plaintext corresponding to the "Cipher-Text" in an an [Olm message](/olm-megolm/olm/#normal-messages) is of the form:

-{{% definition path="api/client-server/definitions/olm_payload" %}}
-
-The type and content of the plaintext message event are given in the
-payload.
+{{% definition path="api/client-server/definitions/olm_plaintext" %}}

 If a client has multiple sessions established with another device, it
 should use the session from which it last received and successfully
--- a/content/identity-service-api.md
+++ b/content/identity-service-api.md
@ -167,16 +167,9 @@ requests.
 Access tokens may be provided via a request header, using the
 Authentication Bearer scheme: `Authorization: Bearer TheTokenHere`.

-Clients may alternatively provide the access token via a query string
-parameter: `access_token=TheTokenHere`. This method is deprecated to
-prevent the access token being leaked in access/HTTP logs and SHOULD NOT
-be used by clients.
-
-Identity Servers MUST support both methods.
-
 {{% boxes/note %}}
-{{% changed-in v="1.11" %}}
-Sending the access token as a query string parameter is now deprecated.
+{{% changed-in v="1.20" %}}
+Sending the access token as a query string parameter is no longer supported.
 {{% /boxes/note %}}

 When credentials are required but missing or invalid, the HTTP call will
--- a/data/api/client-server/account-data.yaml
+++ b/data/api/client-server/account-data.yaml
@ -26,7 +26,6 @@ paths:
        [/sync](/client-server-api/#get_matrixclientv3sync).
      operationId: setAccountData
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -118,7 +117,6 @@ paths:
        that set the account data.
      operationId: getAccountData
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -188,7 +186,6 @@ paths:
        clients in the per-room entries via [/sync](/client-server-api/#get_matrixclientv3sync).
      operationId: setAccountDataPerRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -288,7 +285,6 @@ paths:
        visible to the user that set the account data.
      operationId: getAccountDataPerRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -383,7 +379,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/account_deactivation.yaml
+++ b/data/api/client-server/account_deactivation.yaml
@ -45,7 +45,6 @@ paths:
        {{% /boxes/warning %}}
      security:
        - {}
-        - accessTokenQuery: []
        - accessTokenBearer: []
      operationId: deactivateAccount
      requestBody:
@ -143,7 +142,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/admin.yaml
+++ b/data/api/client-server/admin.yaml
@ -27,7 +27,6 @@ paths:
        specified in this document.
      operationId: getWhoIs
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -120,7 +119,6 @@ paths:
        prior to trying to do account lookups.
      operationId: getAdminSuspendUser
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -208,7 +206,6 @@ paths:
        prior to trying to do account lookups.
      operationId: setAdminSuspendUser
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -313,7 +310,6 @@ paths:
        prior to trying to do account lookups.
      operationId: getAdminLockUser
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -400,7 +396,6 @@ paths:
        prior to trying to do account lookups.
      operationId: setAdminLockUser
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -506,7 +501,5 @@ servers:
        default: /_matrix/client
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/administrative_contact.yaml
+++ b/data/api/client-server/administrative_contact.yaml
@ -31,7 +31,6 @@ paths:
        identifiers that it will accept to reset the user's account password.
      operationId: getAccount3PIDs
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -106,7 +105,6 @@ paths:
      operationId: post3PIDs
      deprecated: true
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -216,7 +214,6 @@ paths:
        {{% /boxes/warning %}}
      operationId: add3PID
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -279,7 +276,6 @@ paths:
        Homeservers should track successful binds so they can be unbound later.
      operationId: bind3PID
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -345,7 +341,6 @@ paths:
        to determine if this endpoint is available.
      operationId: delete3pidFromAccount
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -415,7 +410,6 @@ paths:
        identity server instead.
      operationId: unbind3pidFromAccount
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -614,7 +608,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/appservice_ping.yaml
+++ b/data/api/client-server/appservice_ping.yaml
@ -57,7 +57,6 @@ paths:
                  example: mautrix-go_1683636478256400935_123
        required: true
      security:
-        - appserviceAccessTokenQuery: []
        - appserviceAccessTokenBearer: []
      responses:
        "200":
@ -177,7 +176,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    appserviceAccessTokenQuery:
-      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
    appserviceAccessTokenBearer:
      $ref: definitions/security.yaml#/appserviceAccessTokenBearer
--- a/data/api/client-server/appservice_room_directory.yaml
+++ b/data/api/client-server/appservice_room_directory.yaml
@ -70,7 +70,6 @@ paths:
                - visibility
        required: true
      security:
-        - appserviceAccessTokenQuery: []
        - appserviceAccessTokenBearer: []
      responses:
        "200":
@ -98,7 +97,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    appserviceAccessTokenQuery:
-      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
    appserviceAccessTokenBearer:
      $ref: definitions/security.yaml#/appserviceAccessTokenBearer
--- a/data/api/client-server/authed-content-repo.yaml
+++ b/data/api/client-server/authed-content-repo.yaml
@ -33,7 +33,6 @@ paths:
        Delivery Network (CDN).
      operationId: getContentAuthed
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -106,7 +105,6 @@ paths:
        Delivery Network (CDN).
      operationId: getContentOverrideNameAuthed
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -177,7 +175,6 @@ paths:
        Delivery Network (CDN).
      operationId: getContentThumbnailAuthed
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -353,7 +350,6 @@ paths:
        {{% /boxes/note %}}
      operationId: getUrlPreviewAuthed
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -432,7 +428,6 @@ paths:
        {{% /boxes/note %}}
      operationId: getConfigAuthed
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -472,8 +467,6 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/banning.yaml
+++ b/data/api/client-server/banning.yaml
@ -27,7 +27,6 @@ paths:
        The caller must have the required power level in order to perform this operation.
      operationId: ban
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -101,7 +100,6 @@ paths:
        The caller must have the required power level in order to perform this operation.
      operationId: unban
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -179,7 +177,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/capabilities.yaml
+++ b/data/api/client-server/capabilities.yaml
@ -24,7 +24,6 @@ paths:
        and other relevant capabilities.
      operationId: getCapabilities
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -218,8 +217,6 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  schemas:
--- a/data/api/client-server/content-repo.yaml
+++ b/data/api/client-server/content-repo.yaml
@ -22,7 +22,6 @@ paths:
      summary: Upload some content to the content repository.
      operationId: uploadContent
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/contentType'
@ -82,7 +81,6 @@ paths:
      operationId: uploadContentToMXC
      x-addedInMatrixVersion: "1.7"
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -192,7 +190,6 @@ paths:
      operationId: createContent
      x-addedInMatrixVersion: "1.7"
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      # empty json object
      responses:
@ -579,7 +576,6 @@ paths:
        being shared should also not be shared with the homeserver.
      operationId: getUrlPreview
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -660,7 +656,6 @@ paths:
        than is advertised by the server on this endpoint.
      operationId: getConfig
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -700,8 +695,6 @@ servers:
        default: /_matrix
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/create_room.yaml
+++ b/data/api/client-server/create_room.yaml
@ -80,7 +80,6 @@ paths:
      x-changedInMatrixVersion:
        "1.16": Added server behaviour for how the initial power levels change depending on room version.
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -304,7 +303,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/cross_signing.yaml
+++ b/data/api/client-server/cross_signing.yaml
@ -52,7 +52,6 @@ paths:
        {{% /boxes/note %}}
      operationId: uploadCrossSigningKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -182,7 +181,6 @@ paths:
        property, which contains the new signature(s) to add.
      operationId: uploadCrossSigningSignatures
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -294,7 +292,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/definitions/device_keys.yaml
+++ b/data/api/client-server/definitions/device_keys.yaml
@ -20,6 +20,8 @@ properties:
    description: |-
      The ID of the user the device belongs to. Must match the user ID used
      when logging in.
+    format: mx-user-id
+    pattern: "^@"
    example: "@alice:example.com"
  device_id:
    type: string
--- a/data/api/client-server/definitions/olm_plaintext.yaml
+++ b/data/api/client-server/definitions/olm_plaintext.yaml
@ -14,9 +14,9 @@


 type: object
-title: OlmPayload
+title: OlmPlaintext
 description: |-
-  The plaintext payload of an event encrypted using Olm.
+  The plaintext of an event encrypted using Olm.
 properties:
  type:
    type: string
@ -27,9 +27,13 @@ properties:
  sender:
    type: string
    description: The user ID of the event sender.
+    format: mx-user-id
+    pattern: "^@"
  recipient:
    type: string
    description: The user ID of the intended event recipient.
+    format: mx-user-id
+    pattern: "^@"
  recipient_keys:
    description: The recipient's signing keys of the encrypted event.
    $ref: "#/components/schemas/SigningKeys"
--- a/data/api/client-server/definitions/security.yaml
+++ b/data/api/client-server/definitions/security.yaml
@ -11,15 +11,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-accessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `access_token` obtained during [account registration](/client-server-api/#account-registration)
-    or [login](/client-server-api/#login), as a query parameter.
-
-    It can also be the `as_token` of an application service.
-  name: access_token
-  in: query
 accessTokenBearer:
  type: http
  description: |-
@ -27,21 +18,10 @@ accessTokenBearer:
    or [login](/client-server-api/#login), using the `Authorization: Bearer` header.

    It can also be the `as_token` of an application service.
-
-    This is the preferred method.
  scheme: bearer
-appserviceAccessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `as_token` of an application service, as a query
-    parameter.
-  name: access_token
-  in: query
 appserviceAccessTokenBearer:
  type: http
  description: |-
    The `as_token` of an application service, using the `Authorization: Bearer`
    header.
-
-    This is the preferred method.
  scheme: bearer
--- a/data/api/client-server/device_management.yaml
+++ b/data/api/client-server/device_management.yaml
@ -22,7 +22,6 @@ paths:
      description: Gets information about all devices for the current user.
      operationId: getDevices
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -57,7 +56,6 @@ paths:
      description: Gets information on a single device, by device id.
      operationId: getDevice
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -104,7 +102,6 @@ paths:
        rate limits.
      operationId: updateDevice
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -179,7 +176,6 @@ paths:
        {{% /boxes/warning %}}
      operationId: deleteDevice
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -248,7 +244,6 @@ paths:
        {{% /boxes/warning %}}
      operationId: deleteDevices
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -308,7 +303,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/directory.yaml
+++ b/data/api/client-server/directory.yaml
@ -21,7 +21,6 @@ paths:
      summary: Create a new mapping from room alias to room ID.
      operationId: setRoomAlias
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -182,7 +181,6 @@ paths:
        have permission to update the `m.room.canonical_alias` event.
      operationId: deleteRoomAlias
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -242,7 +240,6 @@ paths:
        state event.
      operationId: getLocalAliases
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -327,7 +324,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/event_context.yaml
+++ b/data/api/client-server/event_context.yaml
@ -28,7 +28,6 @@ paths:
        [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
      operationId: getEventContext
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -155,7 +154,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/filter.yaml
+++ b/data/api/client-server/filter.yaml
@ -25,7 +25,6 @@ paths:
        restrict which events are returned to the client.
      operationId: defineFilter
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -122,7 +121,6 @@ paths:
      summary: Download a filter
      operationId: getFilter
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -218,7 +216,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/inviting.yaml
+++ b/data/api/client-server/inviting.yaml
@ -38,7 +38,6 @@ paths:
        `m.room.member` event to the room.
      operationId: inviteUser
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -147,7 +146,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/joining.yaml
+++ b/data/api/client-server/joining.yaml
@ -33,7 +33,6 @@ paths:
        and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
      operationId: joinRoomById
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -131,7 +130,6 @@ paths:
        and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
      operationId: joinRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -245,7 +243,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/key_backup.yaml
+++ b/data/api/client-server/key_backup.yaml
@ -23,7 +23,6 @@ paths:
      description: Creates a new backup.
      operationId: postRoomKeysVersion
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -81,7 +80,6 @@ paths:
      description: Get information about the latest backup version.
      operationId: getRoomKeysVersionCurrent
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -157,7 +155,6 @@ paths:
      description: Get information about an existing backup.
      operationId: getRoomKeysVersion
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -245,7 +242,6 @@ paths:
        be modified.
      operationId: putRoomKeysVersion
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -348,7 +344,6 @@ paths:
        as well as all key data related to the backup will be deleted.
      operationId: deleteRoomKeysVersion
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -401,7 +396,6 @@ paths:
      description: Store a key in the backup.
      operationId: putRoomKeyBySessionId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -469,7 +463,6 @@ paths:
      description: Retrieve a key from the backup.
      operationId: getRoomKeyBySessionId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -526,7 +519,6 @@ paths:
      description: Delete a key from the backup.
      operationId: deleteRoomKeyBySessionId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -584,7 +576,6 @@ paths:
      description: Store several keys in the backup for a given room.
      operationId: putRoomKeysByRoomId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -657,7 +648,6 @@ paths:
      description: Retrieve the keys from the backup for a given room.
      operationId: getRoomKeysByRoomId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -710,7 +700,6 @@ paths:
      description: Delete the keys from the backup for a given room.
      operationId: deleteRoomKeysByRoomId
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -761,7 +750,6 @@ paths:
      description: Store several keys in the backup.
      operationId: putRoomKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -849,7 +837,6 @@ paths:
      description: Retrieve the keys from the backup.
      operationId: getRoomKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -916,7 +903,6 @@ paths:
      description: Delete the keys from the backup.
      operationId: deleteRoomKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -987,7 +973,5 @@ components:
        - etag
        - count
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/keys.yaml
+++ b/data/api/client-server/keys.yaml
@ -24,7 +24,6 @@ paths:
      description: Publishes end-to-end encryption keys for the device.
      operationId: uploadKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -117,7 +116,6 @@ paths:
      description: Returns the current devices and identity keys for the given users.
      operationId: queryKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -306,7 +304,6 @@ paths:
        the same key.
      operationId: claimKeys
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -405,7 +402,6 @@ paths:
          identity keys, between `from` and `to`.
      operationId: getKeysChanges
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -476,7 +472,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/kicking.yaml
+++ b/data/api/client-server/kicking.yaml
@ -29,7 +29,6 @@ paths:
        the target member's state by making a request to `/rooms/<room id>/state/m.room.member/<user id>`.
      operationId: kick
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -108,7 +107,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/knocking.yaml
+++ b/data/api/client-server/knocking.yaml
@ -38,7 +38,6 @@ paths:
        [`/sync`](/client-server-api/#get_matrixclientv3sync) API.
      operationId: knockRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -155,7 +154,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/leaving.yaml
+++ b/data/api/client-server/leaving.yaml
@ -44,7 +44,6 @@ paths:
        to see.
      operationId: leaveRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -105,7 +104,6 @@ paths:
        before calling this API.
      operationId: forgetRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -161,7 +159,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/list_joined_rooms.yaml
+++ b/data/api/client-server/list_joined_rooms.yaml
@ -22,7 +22,6 @@ paths:
      description: This API returns a list of the user's current rooms.
      operationId: getJoinedRooms
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -64,7 +63,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/list_public_rooms.yaml
+++ b/data/api/client-server/list_public_rooms.yaml
@ -76,7 +76,6 @@ paths:
        or a server administrator.
      operationId: setRoomVisibilityOnDirectory
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -189,7 +188,6 @@ paths:
        stable order is recommended.
      operationId: queryPublicRooms
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -288,7 +286,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/login_token.yaml
+++ b/data/api/client-server/login_token.yaml
@ -53,7 +53,6 @@ paths:
      operationId: generateLoginToken
      x-addedInMatrixVersion: "1.7"
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -132,7 +131,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/logout.yaml
+++ b/data/api/client-server/logout.yaml
@ -25,7 +25,6 @@ paths:
        [Device keys](/client-server-api/#device-keys) for the device are deleted alongside the device.
      operationId: logout
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -54,7 +53,6 @@ paths:
        this way.
      operationId: logout_all
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -80,7 +78,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/message_pagination.yaml
+++ b/data/api/client-server/message_pagination.yaml
@ -27,7 +27,6 @@ paths:
        [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
      operationId: getRoomEvents
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -188,7 +187,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/mutual_rooms.yaml
+++ b/data/api/client-server/mutual_rooms.yaml
@ -25,7 +25,6 @@ paths:
        specified `user_id`.
      operationId: getMutualRooms
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -121,7 +120,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/notifications.yaml
+++ b/data/api/client-server/notifications.yaml
@ -24,7 +24,6 @@ paths:
        user has been, or would have been notified about.
      operationId: getNotifications
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -146,7 +145,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/old_sync.yaml
+++ b/data/api/client-server/old_sync.yaml
@ -29,7 +29,6 @@ paths:
        the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: getEvents
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -100,7 +99,6 @@ paths:
        the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: initialSync
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -329,7 +327,6 @@ paths:
        or the [/rooms/{roomId}/context/{eventId}](/client-server-api/#get_matrixclientv3roomsroomidcontexteventid) API.
      operationId: getOneEvent
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -373,7 +370,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/openid.yaml
+++ b/data/api/client-server/openid.yaml
@ -30,7 +30,6 @@ paths:
        example.
      operationId: requestOpenIdToken
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -92,7 +91,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/password_management.yaml
+++ b/data/api/client-server/password_management.yaml
@ -40,7 +40,6 @@ paths:
        to determine if this endpoint is available.
      security:
        - {}
-        - accessTokenQuery: []
        - accessTokenBearer: []
      operationId: changePassword
      requestBody:
@ -240,7 +239,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/peeking_events.yaml
+++ b/data/api/client-server/peeking_events.yaml
@ -34,7 +34,6 @@ paths:
        yet known.
      operationId: peekEvents
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -116,7 +115,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/presence.yaml
+++ b/data/api/client-server/presence.yaml
@ -26,7 +26,6 @@ paths:
        presence state of another user.
      operationId: setPresence
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -83,7 +82,6 @@ paths:
      description: Get the given user's presence state.
      operationId: getPresence
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -163,7 +161,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/profile.yaml
+++ b/data/api/client-server/profile.yaml
@ -36,7 +36,6 @@ paths:
        which `keyName`s they are allowed to modify.
      operationId: setProfileField
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -210,7 +209,6 @@ paths:
      description: Remove a specific field from a user's profile.
      operationId: deleteProfileField
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -368,7 +366,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/pusher.yaml
+++ b/data/api/client-server/pusher.yaml
@ -23,7 +23,6 @@ paths:
      description: Gets all currently active pushers for the authenticated user.
      operationId: getPushers
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -137,7 +136,6 @@ paths:
        user is deleted.
      operationId: postPusher
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -297,7 +295,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/pushrules.yaml
+++ b/data/api/client-server/pushrules.yaml
@ -24,7 +24,6 @@ paths:
        defined is `global`.
      operationId: getPushRules
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -51,7 +50,6 @@ paths:
        Retrieve all push rules for this user.
      operationId: getPushRulesGlobal
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -68,7 +66,6 @@ paths:
      description: Retrieve a single specified push rule.
      operationId: getPushRule
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -133,7 +130,6 @@ paths:
      description: This endpoint removes the push rule defined in the path.
      operationId: deletePushRule
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -203,7 +199,6 @@ paths:
        When creating push rules, they MUST be enabled by default.
      operationId: setPushRule
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -333,7 +328,6 @@ paths:
      description: This endpoint gets whether the specified push rule is enabled.
      operationId: isPushRuleEnabled
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -396,7 +390,6 @@ paths:
        push rule.
      operationId: setPushRuleEnabled
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -468,7 +461,6 @@ paths:
      description: This endpoint get the actions for the specified push rule.
      operationId: getPushRuleActions
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -540,7 +532,6 @@ paths:
        This can be used to change the actions of builtin rules.
      operationId: setPushRuleActions
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -627,7 +618,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/read_markers.yaml
+++ b/data/api/client-server/read_markers.yaml
@ -25,7 +25,6 @@ paths:
        the read receipt's location.
      operationId: setReadMarker
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -97,7 +96,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/receipts.yaml
+++ b/data/api/client-server/receipts.yaml
@ -25,7 +25,6 @@ paths:
        specified.
      operationId: postReceipt
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -138,7 +137,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/redaction.yaml
+++ b/data/api/client-server/redaction.yaml
@ -33,7 +33,6 @@ paths:
        Server administrators may redact events sent by users on their server.
      operationId: redactEvent
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -110,7 +109,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/relations.yaml
+++ b/data/api/client-server/relations.yaml
@ -31,7 +31,6 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEvents
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -89,7 +88,6 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEventsWithRelType
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -151,7 +149,6 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEventsWithRelTypeAndEventType
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -220,8 +217,6 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/report_content.yaml
+++ b/data/api/client-server/report_content.yaml
@ -59,7 +59,6 @@ paths:
                - reason
        required: true
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        1.18: |
@ -143,7 +142,6 @@ paths:
                  description: The reason the content is being reported.
        required: true
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        1.8: |
@ -228,7 +226,6 @@ paths:
                - reason
        required: true
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -277,7 +274,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_event_by_timestamp.yaml
+++ b/data/api/client-server/room_event_by_timestamp.yaml
@ -46,7 +46,6 @@ paths:
        found in that direction is outside of the expected range.
      operationId: getEventByTimestamp
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -141,7 +140,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_initial_sync.yaml
+++ b/data/api/client-server/room_initial_sync.yaml
@ -17,7 +17,6 @@ paths:
        [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: roomInitialSync
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -182,7 +181,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_send.yaml
+++ b/data/api/client-server/room_send.yaml
@ -39,7 +39,6 @@ paths:
        the event.
      operationId: sendMessage
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -124,7 +123,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_state.yaml
+++ b/data/api/client-server/room_state.yaml
@ -39,7 +39,6 @@ paths:
        being removed or are already present in the state event.
      operationId: setRoomStateWithKey
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -153,7 +152,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_upgrades.yaml
+++ b/data/api/client-server/room_upgrades.yaml
@ -22,7 +22,6 @@ paths:
      description: Upgrades the given room to a particular room version.
      operationId: upgradeRoom
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -124,7 +123,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/rooms.yaml
+++ b/data/api/client-server/rooms.yaml
@ -24,7 +24,6 @@ paths:
        retrieve this event e.g. by being a member in the room for this event.
      operationId: getOneRoomEvent
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -83,7 +82,6 @@ paths:
        taken from the state of the room when they left.
      operationId: getRoomStateWithKey
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -154,7 +152,6 @@ paths:
      description: Get the state events for the current state of a room.
      operationId: getRoomState
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -265,7 +262,6 @@ paths:
              - leave
              - ban
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -318,7 +314,6 @@ paths:
            format: mx-room-id
            pattern: "^!"
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -374,7 +369,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/search.yaml
+++ b/data/api/client-server/search.yaml
@ -22,7 +22,6 @@ paths:
      description: Performs a full text search across different categories.
      operationId: search
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -379,7 +378,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/space_hierarchy.yaml
+++ b/data/api/client-server/space_hierarchy.yaml
@ -30,7 +30,6 @@ paths:
        Invalid child rooms and parent events are not covered by this endpoint.
      operationId: getSpaceHierarchy
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -231,7 +230,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/sync.yaml
+++ b/data/api/client-server/sync.yaml
@ -44,7 +44,6 @@ paths:
        events, alongside other state, when lazy-loading is not enabled.
      operationId: sync
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -686,7 +685,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/tags.yaml
+++ b/data/api/client-server/tags.yaml
@ -23,7 +23,6 @@ paths:
      description: List the tags set by a user on a room.
      operationId: getRoomTags
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -75,7 +74,6 @@ paths:
      description: Add a tag to the room.
      operationId: setRoomTag
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -125,7 +123,6 @@ paths:
      description: Remove a tag from the room.
      operationId: deleteRoomTag
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -177,7 +174,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/third_party_lookup.yaml
+++ b/data/api/client-server/third_party_lookup.yaml
@ -25,7 +25,6 @@ paths:
        required for queries against each protocol.
      operationId: getProtocols
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -101,7 +100,6 @@ paths:
        third-party protocol.
      operationId: getProtocolMetadata
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -145,7 +143,6 @@ paths:
        as reasonably possible given the network type.
      operationId: queryLocationByProtocol
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -192,7 +189,6 @@ paths:
        a set of user parameters.
      operationId: queryUserByProtocol
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -238,7 +234,6 @@ paths:
        alias.
      operationId: queryLocationByAlias
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -274,7 +269,6 @@ paths:
      description: Retrieve an array of third-party users from a Matrix User ID.
      operationId: queryUserByID
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -318,7 +312,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/third_party_membership.yaml
+++ b/data/api/client-server/third_party_membership.yaml
@ -59,7 +59,6 @@ paths:
        - The matrix user ID who invited them to the room
      operationId: inviteBy3PID
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -133,7 +132,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/threads_list.yaml
+++ b/data/api/client-server/threads_list.yaml
@ -27,7 +27,6 @@ paths:
        user has participated in the thread.
      operationId: getThreadRoots
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -161,7 +160,5 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/to_device.yaml
+++ b/data/api/client-server/to_device.yaml
@ -24,7 +24,6 @@ paths:
        client devices.
      operationId: sendToDevice
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -98,7 +97,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/typing.yaml
+++ b/data/api/client-server/typing.yaml
@ -26,7 +26,6 @@ paths:
        user has stopped typing.
      operationId: setTyping
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -101,7 +100,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/users.yaml
+++ b/data/api/client-server/users.yaml
@ -39,7 +39,6 @@ paths:
        `Accept-Language` header provided in the request, if present.
      operationId: searchUserDirectory
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -132,7 +131,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/versions.yaml
+++ b/data/api/client-server/versions.yaml
@ -45,7 +45,6 @@ paths:
      operationId: getVersions
      security:
        - {}
-        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        "1.10": |
@ -102,7 +101,5 @@ servers:
        default: /_matrix/client
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/voip.yaml
+++ b/data/api/client-server/voip.yaml
@ -24,7 +24,6 @@ paths:
        calls.
      operationId: getTurnServer
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -89,7 +88,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/whoami.yaml
+++ b/data/api/client-server/whoami.yaml
@ -30,7 +30,6 @@ paths:
        body.
      operationId: getTokenOwner
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -115,7 +114,5 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/definitions/security.yaml
+++ b/data/api/identity/definitions/security.yaml
@ -11,18 +11,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-accessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `access_token` returned by a call to `/register`, as a
-    query parameter.
-  name: access_token
-  in: query
 accessTokenBearer:
  type: http
  description: |-
    The `access_token` returned by a call to `/register`, using the
    `Authorization: Bearer` header.
-    
-    This is the preferred method.
  scheme: bearer
--- a/data/api/identity/v2_associations.yaml
+++ b/data/api/identity/v2_associations.yaml
@ -23,7 +23,6 @@ paths:
      description: Determines if a given 3pid has been validated by a user.
      operationId: getValidated3pidV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -129,7 +128,6 @@ paths:
        deprecated.
      operationId: bindV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -281,7 +279,6 @@ paths:
        homeserver is acting on behalf of a client.
      operationId: unbindV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -386,7 +383,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_auth.yaml
+++ b/data/api/identity/v2_auth.yaml
@ -58,7 +58,6 @@ paths:
        request.
      operationId: getAccount
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -100,7 +99,6 @@ paths:
        future requests to the server.
      operationId: logout
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -152,7 +150,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_email_associations.yaml
+++ b/data/api/identity/v2_email_associations.yaml
@ -40,7 +40,6 @@ paths:
        deprecated.
      operationId: emailRequestTokenV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -108,7 +107,6 @@ paths:
        deprecated.
      operationId: emailSubmitTokenPostV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -200,7 +198,6 @@ paths:
        used by end-users, and so the response should be human-readable.
      operationId: emailSubmitTokenGetV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -263,7 +260,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_invitation_signing.yaml
+++ b/data/api/identity/v2_invitation_signing.yaml
@ -27,7 +27,6 @@ paths:
        to `store-invite`, and fetch the sender of the invite.
      operationId: blindlySignStuffV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -133,7 +132,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_lookup.yaml
+++ b/data/api/identity/v2_lookup.yaml
@ -28,7 +28,6 @@ paths:
        any of the algorithms defined in this specification.
      operationId: getHashDetails
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -71,7 +70,6 @@ paths:
        later in this specification.
      operationId: lookupUsersV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -164,7 +162,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_phone_associations.yaml
+++ b/data/api/identity/v2_phone_associations.yaml
@ -40,7 +40,6 @@ paths:
        deprecated.
      operationId: msisdnRequestTokenV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -110,7 +109,6 @@ paths:
        deprecated.
      operationId: msisdnSubmitTokenPostV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -202,7 +200,6 @@ paths:
        used by end-users, and so the response should be human-readable.
      operationId: msisdnSubmitTokenGetV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -264,7 +261,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_store_invite.yaml
+++ b/data/api/identity/v2_store_invite.yaml
@ -51,7 +51,6 @@ paths:
        the `address` of the pending invite for display purposes.
      operationId: storeInviteV2
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -235,7 +234,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_terms.yaml
+++ b/data/api/identity/v2_terms.yaml
@ -118,7 +118,6 @@ paths:
        may not be accepting all terms at once.
      operationId: agreeToTerms
      security:
-        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -159,7 +158,5 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/event-schemas/schema/m.room_key_bundle.yaml
+++ b/data/event-schemas/schema/m.room_key_bundle.yaml
@ -13,7 +13,7 @@ description: |-
  [Olm](/client-server-api/#molmv1curve25519-aes-sha2).

  The `sender_device_keys` property in the [Olm
-  plaintext](/client-server-api/#definition-olmpayload) MUST be
+  plaintext](/client-server-api/#definition-olmplaintext) MUST be
  populated. Recipients SHOULD ignore `m.room_key_bundle` messages which omit
  them.
 properties:
Author	SHA1	Message	Date
Patrick Cloke	1420a341f7	Merge `e92c5ca539` into `966109da49`	2026-07-16 12:32:35 +00:00
Patrick Cloke	e92c5ca539	Remove more references to preferred method	2026-07-16 08:32:32 -04:00
Patrick Cloke	5e9e48f616	Remove preferred method mention.	2026-07-16 08:30:11 -04:00
Kim Brose	966109da49	Clarify that clients must avoid producing ambiguous matrix.to URIs (#2396 ) Some checks are pending Spec / 🔎 Validate OpenAPI specifications (push) Waiting to run Details Spec / 🔎 Check Event schema examples (push) Waiting to run Details Spec / 🔎 Check OpenAPI definitions examples (push) Waiting to run Details Spec / 🔎 Check JSON Schemas inline examples (push) Waiting to run Details Spec / ⚙️ Calculate baseURL for later jobs (push) Waiting to run Details Spec / 🐍 Build OpenAPI definitions (push) Blocked by required conditions Details Spec / 📢 Run towncrier for changelog (push) Waiting to run Details Spec / 📖 Build the spec (push) Blocked by required conditions Details Spec / 🔎 Validate generated HTML (push) Blocked by required conditions Details Spec / 📖 Build the historical backup spec (push) Blocked by required conditions Details Spec / Create release (push) Blocked by required conditions Details Spell Check / Spell Check with Typos (push) Waiting to run Details	2026-07-15 17:43:19 +00:00
gewitternacht	e2b879d13d	Rename OlmPayload -> OlmPlaintext to avoid confusion with Olm message Payload Bytes (#2418 ) Some checks are pending Spec / 🔎 Validate OpenAPI specifications (push) Waiting to run Details Spec / 🔎 Check Event schema examples (push) Waiting to run Details Spec / 🔎 Check OpenAPI definitions examples (push) Waiting to run Details Spec / 🔎 Check JSON Schemas inline examples (push) Waiting to run Details Spec / ⚙️ Calculate baseURL for later jobs (push) Waiting to run Details Spec / 🐍 Build OpenAPI definitions (push) Blocked by required conditions Details Spec / 📢 Run towncrier for changelog (push) Waiting to run Details Spec / 📖 Build the spec (push) Blocked by required conditions Details Spec / 🔎 Validate generated HTML (push) Blocked by required conditions Details Spec / 📖 Build the historical backup spec (push) Blocked by required conditions Details Spec / Create release (push) Blocked by required conditions Details Spell Check / Spell Check with Typos (push) Waiting to run Details Signed-off-by: Johanna Stuber <johannas@element.io>	2026-07-15 10:41:01 +01:00
gewitternacht	bf5fbc9945	use User ID type in OlmPayload and DeviceKeys (#2412 ) Some checks are pending Spec / 🔎 Validate OpenAPI specifications (push) Waiting to run Details Spec / 🔎 Check Event schema examples (push) Waiting to run Details Spec / 🔎 Check OpenAPI definitions examples (push) Waiting to run Details Spec / 🔎 Check JSON Schemas inline examples (push) Waiting to run Details Spec / ⚙️ Calculate baseURL for later jobs (push) Waiting to run Details Spec / 🐍 Build OpenAPI definitions (push) Blocked by required conditions Details Spec / 📢 Run towncrier for changelog (push) Waiting to run Details Spec / 📖 Build the spec (push) Blocked by required conditions Details Spec / 🔎 Validate generated HTML (push) Blocked by required conditions Details Spec / 📖 Build the historical backup spec (push) Blocked by required conditions Details Spec / Create release (push) Blocked by required conditions Details Spell Check / Spell Check with Typos (push) Waiting to run Details * use User ID type in OlmPayload and DeviceKeys Signed-off-by: Johanna Stuber <johannas@element.io> * add newsfragment Signed-off-by: Johanna Stuber <johannas@element.io> --------- Signed-off-by: Johanna Stuber <johannas@element.io>	2026-07-14 18:42:07 -04:00
Patrick Cloke	d96a10b92a	Update prose about providing access tokens	2026-07-10 09:12:30 -04:00
Patrick Cloke	846e5334c7	Newsfragment	2026-07-10 09:01:03 -04:00
Patrick Cloke	424399f3d0	Newsfragment	2026-07-10 08:59:34 -04:00
Patrick Cloke	f09aaa1fc3	Spec for MSC4127: Removal of query string auth Signed-off-by: Patrick Cloke <clokep@patrick.cloke.us>	2026-07-10 08:56:45 -04:00
				`@ -0,0 +1 @@`
				`Clarify that clients must avoid producing ambiguous matrix.to URIs. Contributed by @HarHarLinks.`
				`@ -0,0 +1 @@`
				`Providing access tokens via query string parameters is no longer supported.`
				`@ -0,0 +1 @@`
				`Use the User ID type in OlmPayload and DeviceKeys.`
				`@ -0,0 +1 @@`
				`Rename OlmPayload to OlmPlaintext to avoid confusion with Olm message Payload Bytes.`