Merge e92c5ca539 into 966109da49

Signed-off-by: Johanna Stuber <johannas@element.io>

changelogs/appendices/newsfragments/2396.clarification

@@ -0,0 +1 @@
+Clarify that clients must avoid producing ambiguous matrix.to URIs. Contributed by @HarHarLinks.

changelogs/client_server/newsfragments/2408.breaking

@@ -0,0 +1 @@
+Providing access tokens via query string parameters is no longer supported.

changelogs/client_server/newsfragments/2412.clarification

@@ -0,0 +1 @@
+Use the User ID type in OlmPayload and DeviceKeys.

changelogs/client_server/newsfragments/2418.clarification

@@ -0,0 +1 @@
+Rename OlmPayload to OlmPlaintext to avoid confusion with Olm message Payload Bytes.

changelogs/identity_service/newsfragments/2408.breaking

@@ -0,0 +1 @@
+Providing access tokens via query string parameters is no longer supported.

content/appendices.md

@@ -887,20 +887,22 @@ https://matrix.to/#/<identifier>/<extra parameter>?<additional arguments>
 
 The identifier may be a room ID, room alias, or user ID. The
 extra parameter is only used in the case of permalinks where an event ID
-is referenced. The matrix.to URI, when referenced, must always start
+is referenced. The matrix.to URI, when referenced, MUST always start
 with `https://matrix.to/#/` followed by the identifier.
 
 The `<additional arguments>` and the preceding question mark are
-optional and only apply in certain circumstances, documented below.
+OPTIONAL and only apply in certain circumstances, documented below.
 
-Clients should not rely on matrix.to URIs falling back to a web server
+Clients SHOULD NOT rely on matrix.to URIs falling back to a web server
-if accessed and instead should perform some sort of action within the
+if accessed and instead SHOULD perform some sort of action within the
 client. For example, if the user were to click on a matrix.to URI for a
-room alias, the client may open a view for the user to participate in
+room alias, the client MAY open a view for the user to participate in
 the room.
 
 The components of the matrix.to URI (`<identifier>` and
 `<extra parameter>`) MUST be percent-encoded as per RFC 3986.
+Failure to do so will result in downstream software misinterpreting
+the links as invalid/not turning them into clickable links in UI.
 
 Examples of matrix.to URIs are:
 

content/client-server-api/_index.md

@@ -570,15 +570,9 @@ invalidate the access token the client must use [token revocation](#token-revoca
 Access tokens may be provided via a request header, using the Authentication
 Bearer scheme: `Authorization: Bearer TheTokenHere`.
 
-Clients may alternatively provide the access token via a query string parameter:
-`access_token=TheTokenHere`. This method is deprecated to prevent the access
-token being leaked in access/HTTP logs and SHOULD NOT be used by clients.
-
-Homeservers MUST support both methods.
-
 {{% boxes/note %}}
-{{% changed-in v="1.11" %}}
+{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is now deprecated.
+Sending the access token as a query string parameter is no longer supported.
 {{% /boxes/note %}}
 
 When credentials are required but missing or invalid, the HTTP call will

content/client-server-api/modules/end_to_end_encryption.md

@@ -1762,12 +1762,9 @@ Messages with type 1 can only be decrypted with an existing session. If
 there is no matching session, the client must treat this as an invalid
 message.
 
-The plaintext payload is of the form:
+The plaintext corresponding to the "Cipher-Text" in an an [Olm message](/olm-megolm/olm/#normal-messages) is of the form:
 
-{{% definition path="api/client-server/definitions/olm_payload" %}}
+{{% definition path="api/client-server/definitions/olm_plaintext" %}}
-
-The type and content of the plaintext message event are given in the
-payload.
 
 If a client has multiple sessions established with another device, it
 should use the session from which it last received and successfully

content/identity-service-api.md

@@ -167,16 +167,9 @@ requests.
 Access tokens may be provided via a request header, using the
 Authentication Bearer scheme: `Authorization: Bearer TheTokenHere`.
 
-Clients may alternatively provide the access token via a query string
-parameter: `access_token=TheTokenHere`. This method is deprecated to
-prevent the access token being leaked in access/HTTP logs and SHOULD NOT
-be used by clients.
-
-Identity Servers MUST support both methods.
-
 {{% boxes/note %}}
-{{% changed-in v="1.11" %}}
+{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is now deprecated.
+Sending the access token as a query string parameter is no longer supported.
 {{% /boxes/note %}}
 
 When credentials are required but missing or invalid, the HTTP call will

data/api/client-server/account-data.yaml

@@ -26,7 +26,6 @@ paths:
         [/sync](/client-server-api/#get_matrixclientv3sync).
       operationId: setAccountData
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -118,7 +117,6 @@ paths:
         that set the account data.
       operationId: getAccountData
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -188,7 +186,6 @@ paths:
         clients in the per-room entries via [/sync](/client-server-api/#get_matrixclientv3sync).
       operationId: setAccountDataPerRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -288,7 +285,6 @@ paths:
         visible to the user that set the account data.
       operationId: getAccountDataPerRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -383,7 +379,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/account_deactivation.yaml

@@ -45,7 +45,6 @@ paths:
         {{% /boxes/warning %}}
       security:
         - {}
-        - accessTokenQuery: []
         - accessTokenBearer: []
       operationId: deactivateAccount
       requestBody:
@@ -143,7 +142,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/admin.yaml

@@ -27,7 +27,6 @@ paths:
         specified in this document.
       operationId: getWhoIs
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -120,7 +119,6 @@ paths:
         prior to trying to do account lookups.
       operationId: getAdminSuspendUser
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -208,7 +206,6 @@ paths:
         prior to trying to do account lookups.
       operationId: setAdminSuspendUser
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -313,7 +310,6 @@ paths:
         prior to trying to do account lookups.
       operationId: getAdminLockUser
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -400,7 +396,6 @@ paths:
         prior to trying to do account lookups.
       operationId: setAdminLockUser
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -506,7 +501,5 @@ servers:
         default: /_matrix/client
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/administrative_contact.yaml

@@ -31,7 +31,6 @@ paths:
         identifiers that it will accept to reset the user's account password.
       operationId: getAccount3PIDs
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -106,7 +105,6 @@ paths:
       operationId: post3PIDs
       deprecated: true
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -216,7 +214,6 @@ paths:
         {{% /boxes/warning %}}
       operationId: add3PID
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -279,7 +276,6 @@ paths:
         Homeservers should track successful binds so they can be unbound later.
       operationId: bind3PID
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -345,7 +341,6 @@ paths:
         to determine if this endpoint is available.
       operationId: delete3pidFromAccount
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -415,7 +410,6 @@ paths:
         identity server instead.
       operationId: unbind3pidFromAccount
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -614,7 +608,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/appservice_ping.yaml

@@ -57,7 +57,6 @@ paths:
                   example: mautrix-go_1683636478256400935_123
         required: true
       security:
-        - appserviceAccessTokenQuery: []
         - appserviceAccessTokenBearer: []
       responses:
         "200":
@@ -177,7 +176,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    appserviceAccessTokenQuery:
-      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
     appserviceAccessTokenBearer:
       $ref: definitions/security.yaml#/appserviceAccessTokenBearer

data/api/client-server/appservice_room_directory.yaml

@@ -70,7 +70,6 @@ paths:
                 - visibility
         required: true
       security:
-        - appserviceAccessTokenQuery: []
         - appserviceAccessTokenBearer: []
       responses:
         "200":
@@ -98,7 +97,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    appserviceAccessTokenQuery:
-      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
     appserviceAccessTokenBearer:
       $ref: definitions/security.yaml#/appserviceAccessTokenBearer

data/api/client-server/authed-content-repo.yaml

@@ -33,7 +33,6 @@ paths:
         Delivery Network (CDN).
       operationId: getContentAuthed
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -106,7 +105,6 @@ paths:
         Delivery Network (CDN).
       operationId: getContentOverrideNameAuthed
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -177,7 +175,6 @@ paths:
         Delivery Network (CDN).
       operationId: getContentThumbnailAuthed
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -353,7 +350,6 @@ paths:
         {{% /boxes/note %}}
       operationId: getUrlPreviewAuthed
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -432,7 +428,6 @@ paths:
         {{% /boxes/note %}}
       operationId: getConfigAuthed
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -472,8 +467,6 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/banning.yaml

@@ -27,7 +27,6 @@ paths:
         The caller must have the required power level in order to perform this operation.
       operationId: ban
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -101,7 +100,6 @@ paths:
         The caller must have the required power level in order to perform this operation.
       operationId: unban
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -179,7 +177,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/capabilities.yaml

@@ -24,7 +24,6 @@ paths:
         and other relevant capabilities.
       operationId: getCapabilities
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -218,8 +217,6 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   schemas:

data/api/client-server/content-repo.yaml

@@ -22,7 +22,6 @@ paths:
       summary: Upload some content to the content repository.
       operationId: uploadContent
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/contentType'
@@ -82,7 +81,6 @@ paths:
       operationId: uploadContentToMXC
       x-addedInMatrixVersion: "1.7"
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -192,7 +190,6 @@ paths:
       operationId: createContent
       x-addedInMatrixVersion: "1.7"
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       # empty json object
       responses:
@@ -579,7 +576,6 @@ paths:
         being shared should also not be shared with the homeserver.
       operationId: getUrlPreview
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -660,7 +656,6 @@ paths:
         than is advertised by the server on this endpoint.
       operationId: getConfig
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -700,8 +695,6 @@ servers:
         default: /_matrix
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/create_room.yaml

@@ -80,7 +80,6 @@ paths:
       x-changedInMatrixVersion:
         "1.16": Added server behaviour for how the initial power levels change depending on room version.
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -304,7 +303,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/cross_signing.yaml

@@ -52,7 +52,6 @@ paths:
         {{% /boxes/note %}}
       operationId: uploadCrossSigningKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -182,7 +181,6 @@ paths:
         property, which contains the new signature(s) to add.
       operationId: uploadCrossSigningSignatures
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -294,7 +292,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/definitions/device_keys.yaml

@@ -20,6 +20,8 @@ properties:
     description: |-
       The ID of the user the device belongs to. Must match the user ID used
       when logging in.
+    format: mx-user-id
+    pattern: "^@"
     example: "@alice:example.com"
   device_id:
     type: string

data/api/client-server/definitions/olm_plaintext.yaml

@@ -14,9 +14,9 @@
 
 
 type: object
-title: OlmPayload
+title: OlmPlaintext
 description: |-
-  The plaintext payload of an event encrypted using Olm.
+  The plaintext of an event encrypted using Olm.
 properties:
   type:
     type: string
@@ -27,9 +27,13 @@ properties:
   sender:
     type: string
     description: The user ID of the event sender.
+    format: mx-user-id
+    pattern: "^@"
   recipient:
     type: string
     description: The user ID of the intended event recipient.
+    format: mx-user-id
+    pattern: "^@"
   recipient_keys:
     description: The recipient's signing keys of the encrypted event.
     $ref: "#/components/schemas/SigningKeys"

data/api/client-server/definitions/security.yaml

@@ -11,15 +11,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-accessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `access_token` obtained during [account registration](/client-server-api/#account-registration)
-    or [login](/client-server-api/#login), as a query parameter.
-
-    It can also be the `as_token` of an application service.
-  name: access_token
-  in: query
 accessTokenBearer:
   type: http
   description: |-
@@ -27,21 +18,10 @@ accessTokenBearer:
     or [login](/client-server-api/#login), using the `Authorization: Bearer` header.
 
     It can also be the `as_token` of an application service.
-
-    This is the preferred method.
   scheme: bearer
-appserviceAccessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `as_token` of an application service, as a query
-    parameter.
-  name: access_token
-  in: query
 appserviceAccessTokenBearer:
   type: http
   description: |-
     The `as_token` of an application service, using the `Authorization: Bearer`
     header.
-
-    This is the preferred method.
   scheme: bearer

data/api/client-server/device_management.yaml

@@ -22,7 +22,6 @@ paths:
       description: Gets information about all devices for the current user.
       operationId: getDevices
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -57,7 +56,6 @@ paths:
       description: Gets information on a single device, by device id.
       operationId: getDevice
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -104,7 +102,6 @@ paths:
         rate limits.
       operationId: updateDevice
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -179,7 +176,6 @@ paths:
         {{% /boxes/warning %}}
       operationId: deleteDevice
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -248,7 +244,6 @@ paths:
         {{% /boxes/warning %}}
       operationId: deleteDevices
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -308,7 +303,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/directory.yaml

@@ -21,7 +21,6 @@ paths:
       summary: Create a new mapping from room alias to room ID.
       operationId: setRoomAlias
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -182,7 +181,6 @@ paths:
         have permission to update the `m.room.canonical_alias` event.
       operationId: deleteRoomAlias
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -242,7 +240,6 @@ paths:
         state event.
       operationId: getLocalAliases
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -327,7 +324,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/event_context.yaml

@@ -28,7 +28,6 @@ paths:
         [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
       operationId: getEventContext
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -155,7 +154,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/filter.yaml

@@ -25,7 +25,6 @@ paths:
         restrict which events are returned to the client.
       operationId: defineFilter
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -122,7 +121,6 @@ paths:
       summary: Download a filter
       operationId: getFilter
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -218,7 +216,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/inviting.yaml

@@ -38,7 +38,6 @@ paths:
         `m.room.member` event to the room.
       operationId: inviteUser
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -147,7 +146,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/joining.yaml

@@ -33,7 +33,6 @@ paths:
         and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
       operationId: joinRoomById
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -131,7 +130,6 @@ paths:
         and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
       operationId: joinRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -245,7 +243,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/key_backup.yaml

@@ -23,7 +23,6 @@ paths:
       description: Creates a new backup.
       operationId: postRoomKeysVersion
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -81,7 +80,6 @@ paths:
       description: Get information about the latest backup version.
       operationId: getRoomKeysVersionCurrent
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -157,7 +155,6 @@ paths:
       description: Get information about an existing backup.
       operationId: getRoomKeysVersion
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -245,7 +242,6 @@ paths:
         be modified.
       operationId: putRoomKeysVersion
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -348,7 +344,6 @@ paths:
         as well as all key data related to the backup will be deleted.
       operationId: deleteRoomKeysVersion
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -401,7 +396,6 @@ paths:
       description: Store a key in the backup.
       operationId: putRoomKeyBySessionId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -469,7 +463,6 @@ paths:
       description: Retrieve a key from the backup.
       operationId: getRoomKeyBySessionId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -526,7 +519,6 @@ paths:
       description: Delete a key from the backup.
       operationId: deleteRoomKeyBySessionId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -584,7 +576,6 @@ paths:
       description: Store several keys in the backup for a given room.
       operationId: putRoomKeysByRoomId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -657,7 +648,6 @@ paths:
       description: Retrieve the keys from the backup for a given room.
       operationId: getRoomKeysByRoomId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -710,7 +700,6 @@ paths:
       description: Delete the keys from the backup for a given room.
       operationId: deleteRoomKeysByRoomId
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -761,7 +750,6 @@ paths:
       description: Store several keys in the backup.
       operationId: putRoomKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -849,7 +837,6 @@ paths:
       description: Retrieve the keys from the backup.
       operationId: getRoomKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -916,7 +903,6 @@ paths:
       description: Delete the keys from the backup.
       operationId: deleteRoomKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -987,7 +973,5 @@ components:
         - etag
         - count
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/keys.yaml

@@ -24,7 +24,6 @@ paths:
       description: Publishes end-to-end encryption keys for the device.
       operationId: uploadKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -117,7 +116,6 @@ paths:
       description: Returns the current devices and identity keys for the given users.
       operationId: queryKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -306,7 +304,6 @@ paths:
         the same key.
       operationId: claimKeys
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -405,7 +402,6 @@ paths:
           identity keys, between `from` and `to`.
       operationId: getKeysChanges
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -476,7 +472,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/kicking.yaml

@@ -29,7 +29,6 @@ paths:
         the target member's state by making a request to `/rooms/<room id>/state/m.room.member/<user id>`.
       operationId: kick
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -108,7 +107,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/knocking.yaml

@@ -38,7 +38,6 @@ paths:
         [`/sync`](/client-server-api/#get_matrixclientv3sync) API.
       operationId: knockRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -155,7 +154,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/leaving.yaml

@@ -44,7 +44,6 @@ paths:
         to see.
       operationId: leaveRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -105,7 +104,6 @@ paths:
         before calling this API.
       operationId: forgetRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -161,7 +159,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/list_joined_rooms.yaml

@@ -22,7 +22,6 @@ paths:
       description: This API returns a list of the user's current rooms.
       operationId: getJoinedRooms
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -64,7 +63,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/list_public_rooms.yaml

@@ -76,7 +76,6 @@ paths:
         or a server administrator.
       operationId: setRoomVisibilityOnDirectory
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -189,7 +188,6 @@ paths:
         stable order is recommended.
       operationId: queryPublicRooms
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -288,7 +286,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/login_token.yaml

@@ -53,7 +53,6 @@ paths:
       operationId: generateLoginToken
       x-addedInMatrixVersion: "1.7"
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -132,7 +131,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/logout.yaml

@@ -25,7 +25,6 @@ paths:
         [Device keys](/client-server-api/#device-keys) for the device are deleted alongside the device.
       operationId: logout
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -54,7 +53,6 @@ paths:
         this way.
       operationId: logout_all
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -80,7 +78,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/message_pagination.yaml

@@ -27,7 +27,6 @@ paths:
         [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
       operationId: getRoomEvents
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -188,7 +187,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/mutual_rooms.yaml

@@ -25,7 +25,6 @@ paths:
         specified `user_id`.
       operationId: getMutualRooms
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -121,7 +120,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/notifications.yaml

@@ -24,7 +24,6 @@ paths:
         user has been, or would have been notified about.
       operationId: getNotifications
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -146,7 +145,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/old_sync.yaml

@@ -29,7 +29,6 @@ paths:
         the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: getEvents
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -100,7 +99,6 @@ paths:
         the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: initialSync
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -329,7 +327,6 @@ paths:
         or the [/rooms/{roomId}/context/{eventId}](/client-server-api/#get_matrixclientv3roomsroomidcontexteventid) API.
       operationId: getOneEvent
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -373,7 +370,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/openid.yaml

@@ -30,7 +30,6 @@ paths:
         example.
       operationId: requestOpenIdToken
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -92,7 +91,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/password_management.yaml

@@ -40,7 +40,6 @@ paths:
         to determine if this endpoint is available.
       security:
         - {}
-        - accessTokenQuery: []
         - accessTokenBearer: []
       operationId: changePassword
       requestBody:
@@ -240,7 +239,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/peeking_events.yaml

@@ -34,7 +34,6 @@ paths:
         yet known.
       operationId: peekEvents
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -116,7 +115,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/presence.yaml

@@ -26,7 +26,6 @@ paths:
         presence state of another user.
       operationId: setPresence
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -83,7 +82,6 @@ paths:
       description: Get the given user's presence state.
       operationId: getPresence
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -163,7 +161,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/profile.yaml

@@ -36,7 +36,6 @@ paths:
         which `keyName`s they are allowed to modify.
       operationId: setProfileField
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -210,7 +209,6 @@ paths:
       description: Remove a specific field from a user's profile.
       operationId: deleteProfileField
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -368,7 +366,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/pusher.yaml

@@ -23,7 +23,6 @@ paths:
       description: Gets all currently active pushers for the authenticated user.
       operationId: getPushers
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -137,7 +136,6 @@ paths:
         user is deleted.
       operationId: postPusher
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -297,7 +295,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/pushrules.yaml

@@ -24,7 +24,6 @@ paths:
         defined is `global`.
       operationId: getPushRules
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -51,7 +50,6 @@ paths:
         Retrieve all push rules for this user.
       operationId: getPushRulesGlobal
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -68,7 +66,6 @@ paths:
       description: Retrieve a single specified push rule.
       operationId: getPushRule
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -133,7 +130,6 @@ paths:
       description: This endpoint removes the push rule defined in the path.
       operationId: deletePushRule
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -203,7 +199,6 @@ paths:
         When creating push rules, they MUST be enabled by default.
       operationId: setPushRule
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -333,7 +328,6 @@ paths:
       description: This endpoint gets whether the specified push rule is enabled.
       operationId: isPushRuleEnabled
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -396,7 +390,6 @@ paths:
         push rule.
       operationId: setPushRuleEnabled
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -468,7 +461,6 @@ paths:
       description: This endpoint get the actions for the specified push rule.
       operationId: getPushRuleActions
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -540,7 +532,6 @@ paths:
         This can be used to change the actions of builtin rules.
       operationId: setPushRuleActions
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -627,7 +618,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/read_markers.yaml

@@ -25,7 +25,6 @@ paths:
         the read receipt's location.
       operationId: setReadMarker
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -97,7 +96,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/receipts.yaml

@@ -25,7 +25,6 @@ paths:
         specified.
       operationId: postReceipt
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -138,7 +137,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/redaction.yaml

@@ -33,7 +33,6 @@ paths:
         Server administrators may redact events sent by users on their server.
       operationId: redactEvent
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -110,7 +109,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/relations.yaml

@@ -31,7 +31,6 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEvents
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -89,7 +88,6 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEventsWithRelType
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -151,7 +149,6 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEventsWithRelTypeAndEventType
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -220,8 +217,6 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/report_content.yaml

@@ -59,7 +59,6 @@ paths:
                 - reason
         required: true
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         1.18: |
@@ -143,7 +142,6 @@ paths:
                   description: The reason the content is being reported.
         required: true
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         1.8: |
@@ -228,7 +226,6 @@ paths:
                 - reason
         required: true
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -277,7 +274,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_event_by_timestamp.yaml

@@ -46,7 +46,6 @@ paths:
         found in that direction is outside of the expected range.
       operationId: getEventByTimestamp
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -141,7 +140,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_initial_sync.yaml

@@ -17,7 +17,6 @@ paths:
         [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: roomInitialSync
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -182,7 +181,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_send.yaml

@@ -39,7 +39,6 @@ paths:
         the event.
       operationId: sendMessage
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -124,7 +123,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_state.yaml

@@ -39,7 +39,6 @@ paths:
         being removed or are already present in the state event.
       operationId: setRoomStateWithKey
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -153,7 +152,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_upgrades.yaml

@@ -22,7 +22,6 @@ paths:
       description: Upgrades the given room to a particular room version.
       operationId: upgradeRoom
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -124,7 +123,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/rooms.yaml

@@ -24,7 +24,6 @@ paths:
         retrieve this event e.g. by being a member in the room for this event.
       operationId: getOneRoomEvent
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -83,7 +82,6 @@ paths:
         taken from the state of the room when they left.
       operationId: getRoomStateWithKey
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -154,7 +152,6 @@ paths:
       description: Get the state events for the current state of a room.
       operationId: getRoomState
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -265,7 +262,6 @@ paths:
               - leave
               - ban
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -318,7 +314,6 @@ paths:
             format: mx-room-id
             pattern: "^!"
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -374,7 +369,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/search.yaml

@@ -22,7 +22,6 @@ paths:
       description: Performs a full text search across different categories.
       operationId: search
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -379,7 +378,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/space_hierarchy.yaml

@@ -30,7 +30,6 @@ paths:
         Invalid child rooms and parent events are not covered by this endpoint.
       operationId: getSpaceHierarchy
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -231,7 +230,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/sync.yaml

@@ -44,7 +44,6 @@ paths:
         events, alongside other state, when lazy-loading is not enabled.
       operationId: sync
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -686,7 +685,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/tags.yaml

@@ -23,7 +23,6 @@ paths:
       description: List the tags set by a user on a room.
       operationId: getRoomTags
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -75,7 +74,6 @@ paths:
       description: Add a tag to the room.
       operationId: setRoomTag
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -125,7 +123,6 @@ paths:
       description: Remove a tag from the room.
       operationId: deleteRoomTag
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -177,7 +174,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/third_party_lookup.yaml

@@ -25,7 +25,6 @@ paths:
         required for queries against each protocol.
       operationId: getProtocols
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -101,7 +100,6 @@ paths:
         third-party protocol.
       operationId: getProtocolMetadata
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -145,7 +143,6 @@ paths:
         as reasonably possible given the network type.
       operationId: queryLocationByProtocol
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -192,7 +189,6 @@ paths:
         a set of user parameters.
       operationId: queryUserByProtocol
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -238,7 +234,6 @@ paths:
         alias.
       operationId: queryLocationByAlias
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -274,7 +269,6 @@ paths:
       description: Retrieve an array of third-party users from a Matrix User ID.
       operationId: queryUserByID
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -318,7 +312,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/third_party_membership.yaml

@@ -59,7 +59,6 @@ paths:
         - The matrix user ID who invited them to the room
       operationId: inviteBy3PID
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -133,7 +132,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/threads_list.yaml

@@ -27,7 +27,6 @@ paths:
         user has participated in the thread.
       operationId: getThreadRoots
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -161,7 +160,5 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/to_device.yaml

@@ -24,7 +24,6 @@ paths:
         client devices.
       operationId: sendToDevice
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -98,7 +97,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/typing.yaml

@@ -26,7 +26,6 @@ paths:
         user has stopped typing.
       operationId: setTyping
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -101,7 +100,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/users.yaml

@@ -39,7 +39,6 @@ paths:
         `Accept-Language` header provided in the request, if present.
       operationId: searchUserDirectory
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -132,7 +131,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/versions.yaml

@@ -45,7 +45,6 @@ paths:
       operationId: getVersions
       security:
         - {}
-        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         "1.10": |
@@ -102,7 +101,5 @@ servers:
         default: /_matrix/client
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/voip.yaml

@@ -24,7 +24,6 @@ paths:
         calls.
       operationId: getTurnServer
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -89,7 +88,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/whoami.yaml

@@ -30,7 +30,6 @@ paths:
         body.
       operationId: getTokenOwner
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -115,7 +114,5 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/definitions/security.yaml

@@ -11,18 +11,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-accessTokenQuery:
-  type: apiKey
-  description: |-
-    **Deprecated.** The `access_token` returned by a call to `/register`, as a
-    query parameter.
-  name: access_token
-  in: query
 accessTokenBearer:
   type: http
   description: |-
     The `access_token` returned by a call to `/register`, using the
     `Authorization: Bearer` header.
-    
-    This is the preferred method.
   scheme: bearer

data/api/identity/v2_associations.yaml

@@ -23,7 +23,6 @@ paths:
       description: Determines if a given 3pid has been validated by a user.
       operationId: getValidated3pidV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -129,7 +128,6 @@ paths:
         deprecated.
       operationId: bindV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -281,7 +279,6 @@ paths:
         homeserver is acting on behalf of a client.
       operationId: unbindV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -386,7 +383,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_auth.yaml

@@ -58,7 +58,6 @@ paths:
         request.
       operationId: getAccount
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -100,7 +99,6 @@ paths:
         future requests to the server.
       operationId: logout
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -152,7 +150,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_email_associations.yaml

@@ -40,7 +40,6 @@ paths:
         deprecated.
       operationId: emailRequestTokenV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -108,7 +107,6 @@ paths:
         deprecated.
       operationId: emailSubmitTokenPostV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -200,7 +198,6 @@ paths:
         used by end-users, and so the response should be human-readable.
       operationId: emailSubmitTokenGetV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -263,7 +260,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_invitation_signing.yaml

@@ -27,7 +27,6 @@ paths:
         to `store-invite`, and fetch the sender of the invite.
       operationId: blindlySignStuffV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -133,7 +132,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_lookup.yaml

@@ -28,7 +28,6 @@ paths:
         any of the algorithms defined in this specification.
       operationId: getHashDetails
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -71,7 +70,6 @@ paths:
         later in this specification.
       operationId: lookupUsersV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -164,7 +162,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_phone_associations.yaml

@@ -40,7 +40,6 @@ paths:
         deprecated.
       operationId: msisdnRequestTokenV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -110,7 +109,6 @@ paths:
         deprecated.
       operationId: msisdnSubmitTokenPostV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -202,7 +200,6 @@ paths:
         used by end-users, and so the response should be human-readable.
       operationId: msisdnSubmitTokenGetV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -264,7 +261,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_store_invite.yaml

@@ -51,7 +51,6 @@ paths:
         the `address` of the pending invite for display purposes.
       operationId: storeInviteV2
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -235,7 +234,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_terms.yaml

@@ -118,7 +118,6 @@ paths:
         may not be accepting all terms at once.
       operationId: agreeToTerms
       security:
-        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -159,7 +158,5 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
-    accessTokenQuery:
-      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/event-schemas/schema/m.room_key_bundle.yaml

@@ -13,7 +13,7 @@ description: |-
   [Olm](/client-server-api/#molmv1curve25519-aes-sha2).
 
   The `sender_device_keys` property in the [Olm
-  plaintext](/client-server-api/#definition-olmpayload) MUST be
+  plaintext](/client-server-api/#definition-olmplaintext) MUST be
   populated. Recipients SHOULD ignore `m.room_key_bundle` messages which omit
   them.
 properties: