changelogs/client_server/newsfragments/2394.clarification

@@ -1 +0,0 @@
-Correct some errors in the description of the validation process for incoming Olm-encrypted messages.

changelogs/client_server/newsfragments/2408.breaking

@@ -1 +0,0 @@
-Providing access tokens via query string parameters is no longer supported.

changelogs/client_server/newsfragments/2413.clarification

@@ -1 +0,0 @@
-Improve the format description of `m.room.encrypted` (Olm/Megolm) events.

changelogs/identity_service/newsfragments/2408.breaking

@@ -1 +0,0 @@
-Providing access tokens via query string parameters is no longer supported.

content/client-server-api/_index.md

@@ -570,9 +570,15 @@ invalidate the access token the client must use [token revocation](#token-revoca
 Access tokens may be provided via a request header, using the Authentication
 Bearer scheme: `Authorization: Bearer TheTokenHere`.
 
+Clients may alternatively provide the access token via a query string parameter:
+`access_token=TheTokenHere`. This method is deprecated to prevent the access
+token being leaked in access/HTTP logs and SHOULD NOT be used by clients.
+
+Homeservers MUST support both methods.
+
 {{% boxes/note %}}
-{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is no longer supported.
+{{% changed-in v="1.11" %}}
+Sending the access token as a query string parameter is now deprecated.
 {{% /boxes/note %}}
 
 When credentials are required but missing or invalid, the HTTP call will

content/client-server-api/modules/end_to_end_encryption.md

@@ -1723,30 +1723,28 @@ Devices that support Olm must include "m.olm.v1.curve25519-aes-sha2" in
 their list of supported messaging algorithms, must list a Curve25519
 device key, and must publish Curve25519 one-time keys.
 
-The content of an [`m.room.encrypted`](#mroomencrypted) event using Olm has the following format:
+An event encrypted using Olm has the following format:
 
 ```json
 {
+  "type": "m.room.encrypted",
   "content": {
     "algorithm": "m.olm.v1.curve25519-aes-sha2",
     "sender_key": "<sender_curve25519_key>",
     "ciphertext": {
       "<device_curve25519_key>": {
         "type": 0,
-        "body": "<base64_encoded_olm_message>"
+        "body": "<encrypted_payload_base_64>"
       }
     }
   }
 }
 ```
-Note that when the event is received from the server, it will have a `type`
-(with a value of `m.room.encrypted`) and `sender` property alongside the
-`content` property. In `content`, `ciphertext` is a mapping from a device
-Curve25519 key to an object with a `type` and a `body`. Here, `body` is a
-Base64-encoded [Olm message](/olm-megolm/olm/#the-olm-message-format), and
-`type` is an integer indicating the type of the message:
-0 for the initial [pre-key messages](/olm-megolm/olm/#pre-key-messages),
-1 for [normal messages](/olm-megolm/olm/#normal-messages).
+
+`ciphertext` is a mapping from device Curve25519 key to an encrypted
+payload for that device. `body` is a Base64-encoded [Olm message body](/olm-megolm/olm/#the-olm-message-format).
+`type` is an integer indicating the type of the message body: 0 for the
+initial [pre-key message](/olm-megolm/olm/#pre-key-messages), 1 for [normal messages](/olm-megolm/olm/#normal-messages).
 
 Olm sessions will generate messages with a type of 0 until they receive
 a message. Once a session has decrypted a message it will produce
@@ -1780,7 +1778,6 @@ of olm sessions maintained per device should be at least 4.
 ###### Validation of incoming decrypted events
 
 {{% changed-in v="1.15" %}} Existing checks made more explicit, and checks for `sender_device_keys` added.
-{{% changed-in v="1.19" %}} Corrections to some errors in the description of the verification checks.
 
 After decrypting an incoming encrypted event, clients MUST apply the
 following checks:
@@ -1788,9 +1785,8 @@ following checks:
 1.  The `sender` property in the decrypted content must match the
     `sender` of the event.
 2.  The `keys.ed25519` property in the decrypted content must match
-    the Ed25519 identity key of the sending device. This key can be
-    obtained from either [`/keys/query`](#post_matrixclientv3keysquery)
-    or the `sender_device_keys` object (see below).
+    the `sender_key` property in the cleartext `m.room.encrypted`
+    event body.
 3.  The `recipient` property in the decrypted content must match
     the user ID of the local user.
 4.  The `recipient_keys.ed25519` property in the decrypted content
@@ -1798,11 +1794,11 @@ following checks:
 5.  Where `sender_device_keys` is present in the decrypted content:
     1.  `sender_device_keys.user_id` must also match the `sender`
         of the event.
-    2.  `sender_device_keys.keys.curve25519:<device_id>` must match
+    2.  `sender_device_keys.keys.ed25519:<device_id>` must also match
         the `sender_key` property in the cleartext `m.room.encrypted`
         event body.
-    3.  `sender_device_keys.keys.ed25519:<device_id>` must be the same
-        as the `keys.ed25519` property in the decrypted content.
+    3.  `sender_device_keys.keys.curve25519:<device_id>` must match
+        the Curve25519 key used to establish the Olm session.
     4.  The `sender_device_keys` structure must have a valid signature
         from the key with ID `ed25519:<device_id>` (i.e., the sending
         device's Ed25519 key).
@@ -1895,26 +1891,23 @@ This uses:
 Devices that support Megolm must support Olm, and include
 "m.megolm.v1.aes-sha2" in their list of supported messaging algorithms.
 
-The content of an [`m.room.encrypted`](#mroomencrypted) event using Megolm has the following format:
+An event encrypted using Megolm has the following format:
 
 ```json
 {
+  "type": "m.room.encrypted",
   "content": {
     "algorithm": "m.megolm.v1.aes-sha2",
     "sender_key": "<sender_curve25519_key>",
     "device_id": "<sender_device_id>",
     "session_id": "<outbound_group_session_id>",
-    "ciphertext": "<base64_encoded_megolm_message>"
+    "ciphertext": "<encrypted_payload_base_64>"
   }
 }
 ```
-Note that when the event is received from the server, it will have additional
-properties alongside the `content` property, including a `type` (with a value
-of `m.room.encrypted`) and a `sender` property. (See [Room event format](#room-event-format).)
 
-Within `content`, `ciphertext`
-is a Base64-encoded [Megolm message](/olm-megolm/megolm/#message-format),
-whose plaintext body is of the form:
+The encrypted payload can contain any message event. The plaintext is of
+the form:
 
 ```json
 {
@@ -1924,7 +1917,7 @@ whose plaintext body is of the form:
 }
 ```
 
-We include the room ID in the encrypted message, because otherwise the homeserver
+We include the room ID in the payload, because otherwise the homeserver
 would be able to change the room a message was sent in.
 
 Clients must guard against replay attacks by keeping track of the

content/client-server-api/modules/event_replacements.md

@@ -91,13 +91,13 @@ For example, a replacement for an encrypted event might look like this:
         "sender_key": "<sender_curve25519_key>",
         "device_id": "<sender_device_id>",
         "session_id": "<outbound_group_session_id>",
-        "ciphertext": "<base64_encoded_megolm_message>"
+        "ciphertext": "<encrypted_payload_base_64>"
     }
     // irrelevant fields not shown
 }
 ```
 
-... and the plaintext body of the Megolm message might look like this:
+... and, once decrypted, the payload might look like this:
 
 ```json
 {

content/identity-service-api.md

@@ -167,9 +167,16 @@ requests.
 Access tokens may be provided via a request header, using the
 Authentication Bearer scheme: `Authorization: Bearer TheTokenHere`.
 
+Clients may alternatively provide the access token via a query string
+parameter: `access_token=TheTokenHere`. This method is deprecated to
+prevent the access token being leaked in access/HTTP logs and SHOULD NOT
+be used by clients.
+
+Identity Servers MUST support both methods.
+
 {{% boxes/note %}}
-{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is no longer supported.
+{{% changed-in v="1.11" %}}
+Sending the access token as a query string parameter is now deprecated.
 {{% /boxes/note %}}
 
 When credentials are required but missing or invalid, the HTTP call will

data/api/client-server/account-data.yaml

@@ -26,6 +26,7 @@ paths:
         [/sync](/client-server-api/#get_matrixclientv3sync).
       operationId: setAccountData
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -117,6 +118,7 @@ paths:
         that set the account data.
       operationId: getAccountData
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -186,6 +188,7 @@ paths:
         clients in the per-room entries via [/sync](/client-server-api/#get_matrixclientv3sync).
       operationId: setAccountDataPerRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -285,6 +288,7 @@ paths:
         visible to the user that set the account data.
       operationId: getAccountDataPerRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -379,5 +383,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/account_deactivation.yaml

@@ -45,6 +45,7 @@ paths:
         {{% /boxes/warning %}}
       security:
         - {}
+        - accessTokenQuery: []
         - accessTokenBearer: []
       operationId: deactivateAccount
       requestBody:
@@ -142,5 +143,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/admin.yaml

@@ -27,6 +27,7 @@ paths:
         specified in this document.
       operationId: getWhoIs
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -119,6 +120,7 @@ paths:
         prior to trying to do account lookups.
       operationId: getAdminSuspendUser
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -206,6 +208,7 @@ paths:
         prior to trying to do account lookups.
       operationId: setAdminSuspendUser
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -310,6 +313,7 @@ paths:
         prior to trying to do account lookups.
       operationId: getAdminLockUser
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -396,6 +400,7 @@ paths:
         prior to trying to do account lookups.
       operationId: setAdminLockUser
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -501,5 +506,7 @@ servers:
         default: /_matrix/client
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/administrative_contact.yaml

@@ -31,6 +31,7 @@ paths:
         identifiers that it will accept to reset the user's account password.
       operationId: getAccount3PIDs
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -105,6 +106,7 @@ paths:
       operationId: post3PIDs
       deprecated: true
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -214,6 +216,7 @@ paths:
         {{% /boxes/warning %}}
       operationId: add3PID
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -276,6 +279,7 @@ paths:
         Homeservers should track successful binds so they can be unbound later.
       operationId: bind3PID
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -341,6 +345,7 @@ paths:
         to determine if this endpoint is available.
       operationId: delete3pidFromAccount
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -410,6 +415,7 @@ paths:
         identity server instead.
       operationId: unbind3pidFromAccount
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -608,5 +614,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/appservice_ping.yaml

@@ -57,6 +57,7 @@ paths:
                   example: mautrix-go_1683636478256400935_123
         required: true
       security:
+        - appserviceAccessTokenQuery: []
         - appserviceAccessTokenBearer: []
       responses:
         "200":
@@ -176,5 +177,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    appserviceAccessTokenQuery:
+      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
     appserviceAccessTokenBearer:
       $ref: definitions/security.yaml#/appserviceAccessTokenBearer

data/api/client-server/appservice_room_directory.yaml

@@ -70,6 +70,7 @@ paths:
                 - visibility
         required: true
       security:
+        - appserviceAccessTokenQuery: []
         - appserviceAccessTokenBearer: []
       responses:
         "200":
@@ -97,5 +98,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    appserviceAccessTokenQuery:
+      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
     appserviceAccessTokenBearer:
       $ref: definitions/security.yaml#/appserviceAccessTokenBearer

data/api/client-server/authed-content-repo.yaml

@@ -33,6 +33,7 @@ paths:
         Delivery Network (CDN).
       operationId: getContentAuthed
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -105,6 +106,7 @@ paths:
         Delivery Network (CDN).
       operationId: getContentOverrideNameAuthed
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -175,6 +177,7 @@ paths:
         Delivery Network (CDN).
       operationId: getContentThumbnailAuthed
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -350,6 +353,7 @@ paths:
         {{% /boxes/note %}}
       operationId: getUrlPreviewAuthed
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -428,6 +432,7 @@ paths:
         {{% /boxes/note %}}
       operationId: getConfigAuthed
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -467,6 +472,8 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/banning.yaml

@@ -27,6 +27,7 @@ paths:
         The caller must have the required power level in order to perform this operation.
       operationId: ban
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -100,6 +101,7 @@ paths:
         The caller must have the required power level in order to perform this operation.
       operationId: unban
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -177,5 +179,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/capabilities.yaml

@@ -24,6 +24,7 @@ paths:
         and other relevant capabilities.
       operationId: getCapabilities
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -217,6 +218,8 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   schemas:

data/api/client-server/content-repo.yaml

@@ -22,6 +22,7 @@ paths:
       summary: Upload some content to the content repository.
       operationId: uploadContent
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/contentType'
@@ -81,6 +82,7 @@ paths:
       operationId: uploadContentToMXC
       x-addedInMatrixVersion: "1.7"
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
@@ -190,6 +192,7 @@ paths:
       operationId: createContent
       x-addedInMatrixVersion: "1.7"
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       # empty json object
       responses:
@@ -576,6 +579,7 @@ paths:
         being shared should also not be shared with the homeserver.
       operationId: getUrlPreview
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -656,6 +660,7 @@ paths:
         than is advertised by the server on this endpoint.
       operationId: getConfig
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -695,6 +700,8 @@ servers:
         default: /_matrix
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/create_room.yaml

@@ -80,6 +80,7 @@ paths:
       x-changedInMatrixVersion:
         "1.16": Added server behaviour for how the initial power levels change depending on room version.
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -303,5 +304,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/cross_signing.yaml

@@ -52,6 +52,7 @@ paths:
         {{% /boxes/note %}}
       operationId: uploadCrossSigningKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -181,6 +182,7 @@ paths:
         property, which contains the new signature(s) to add.
       operationId: uploadCrossSigningSignatures
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -292,5 +294,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/definitions/security.yaml

@@ -11,6 +11,15 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+accessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `access_token` obtained during [account registration](/client-server-api/#account-registration)
+    or [login](/client-server-api/#login), as a query parameter.
+
+    It can also be the `as_token` of an application service.
+  name: access_token
+  in: query
 accessTokenBearer:
   type: http
   description: |-
@@ -18,10 +27,21 @@ accessTokenBearer:
     or [login](/client-server-api/#login), using the `Authorization: Bearer` header.
 
     It can also be the `as_token` of an application service.
+
+    This is the preferred method.
   scheme: bearer
+appserviceAccessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `as_token` of an application service, as a query
+    parameter.
+  name: access_token
+  in: query
 appserviceAccessTokenBearer:
   type: http
   description: |-
     The `as_token` of an application service, using the `Authorization: Bearer`
     header.
+
+    This is the preferred method.
   scheme: bearer

data/api/client-server/device_management.yaml

@@ -22,6 +22,7 @@ paths:
       description: Gets information about all devices for the current user.
       operationId: getDevices
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -56,6 +57,7 @@ paths:
       description: Gets information on a single device, by device id.
       operationId: getDevice
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -102,6 +104,7 @@ paths:
         rate limits.
       operationId: updateDevice
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -176,6 +179,7 @@ paths:
         {{% /boxes/warning %}}
       operationId: deleteDevice
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -244,6 +248,7 @@ paths:
         {{% /boxes/warning %}}
       operationId: deleteDevices
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -303,5 +308,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/directory.yaml

@@ -21,6 +21,7 @@ paths:
       summary: Create a new mapping from room alias to room ID.
       operationId: setRoomAlias
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -181,6 +182,7 @@ paths:
         have permission to update the `m.room.canonical_alias` event.
       operationId: deleteRoomAlias
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -240,6 +242,7 @@ paths:
         state event.
       operationId: getLocalAliases
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -324,5 +327,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/event_context.yaml

@@ -28,6 +28,7 @@ paths:
         [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
       operationId: getEventContext
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -154,5 +155,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/filter.yaml

@@ -25,6 +25,7 @@ paths:
         restrict which events are returned to the client.
       operationId: defineFilter
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -121,6 +122,7 @@ paths:
       summary: Download a filter
       operationId: getFilter
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -216,5 +218,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/inviting.yaml

@@ -38,6 +38,7 @@ paths:
         `m.room.member` event to the room.
       operationId: inviteUser
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -146,5 +147,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/joining.yaml

@@ -33,6 +33,7 @@ paths:
         and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
       operationId: joinRoomById
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -130,6 +131,7 @@ paths:
         and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
       operationId: joinRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -243,5 +245,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/key_backup.yaml

@@ -23,6 +23,7 @@ paths:
       description: Creates a new backup.
       operationId: postRoomKeysVersion
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -80,6 +81,7 @@ paths:
       description: Get information about the latest backup version.
       operationId: getRoomKeysVersionCurrent
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -155,6 +157,7 @@ paths:
       description: Get information about an existing backup.
       operationId: getRoomKeysVersion
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -242,6 +245,7 @@ paths:
         be modified.
       operationId: putRoomKeysVersion
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -344,6 +348,7 @@ paths:
         as well as all key data related to the backup will be deleted.
       operationId: deleteRoomKeysVersion
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -396,6 +401,7 @@ paths:
       description: Store a key in the backup.
       operationId: putRoomKeyBySessionId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -463,6 +469,7 @@ paths:
       description: Retrieve a key from the backup.
       operationId: getRoomKeyBySessionId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -519,6 +526,7 @@ paths:
       description: Delete a key from the backup.
       operationId: deleteRoomKeyBySessionId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -576,6 +584,7 @@ paths:
       description: Store several keys in the backup for a given room.
       operationId: putRoomKeysByRoomId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -648,6 +657,7 @@ paths:
       description: Retrieve the keys from the backup for a given room.
       operationId: getRoomKeysByRoomId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -700,6 +710,7 @@ paths:
       description: Delete the keys from the backup for a given room.
       operationId: deleteRoomKeysByRoomId
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -750,6 +761,7 @@ paths:
       description: Store several keys in the backup.
       operationId: putRoomKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -837,6 +849,7 @@ paths:
       description: Retrieve the keys from the backup.
       operationId: getRoomKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -903,6 +916,7 @@ paths:
       description: Delete the keys from the backup.
       operationId: deleteRoomKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -973,5 +987,7 @@ components:
         - etag
         - count
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/keys.yaml

@@ -24,6 +24,7 @@ paths:
       description: Publishes end-to-end encryption keys for the device.
       operationId: uploadKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -116,6 +117,7 @@ paths:
       description: Returns the current devices and identity keys for the given users.
       operationId: queryKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -304,6 +306,7 @@ paths:
         the same key.
       operationId: claimKeys
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -402,6 +405,7 @@ paths:
           identity keys, between `from` and `to`.
       operationId: getKeysChanges
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -472,5 +476,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/kicking.yaml

@@ -29,6 +29,7 @@ paths:
         the target member's state by making a request to `/rooms/<room id>/state/m.room.member/<user id>`.
       operationId: kick
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -107,5 +108,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/knocking.yaml

@@ -38,6 +38,7 @@ paths:
         [`/sync`](/client-server-api/#get_matrixclientv3sync) API.
       operationId: knockRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -154,5 +155,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/leaving.yaml

@@ -44,6 +44,7 @@ paths:
         to see.
       operationId: leaveRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -104,6 +105,7 @@ paths:
         before calling this API.
       operationId: forgetRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -159,5 +161,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/list_joined_rooms.yaml

@@ -22,6 +22,7 @@ paths:
       description: This API returns a list of the user's current rooms.
       operationId: getJoinedRooms
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -63,5 +64,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/list_public_rooms.yaml

@@ -76,6 +76,7 @@ paths:
         or a server administrator.
       operationId: setRoomVisibilityOnDirectory
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -188,6 +189,7 @@ paths:
         stable order is recommended.
       operationId: queryPublicRooms
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -286,5 +288,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/login_token.yaml

@@ -53,6 +53,7 @@ paths:
       operationId: generateLoginToken
       x-addedInMatrixVersion: "1.7"
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -131,5 +132,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/logout.yaml

@@ -25,6 +25,7 @@ paths:
         [Device keys](/client-server-api/#device-keys) for the device are deleted alongside the device.
       operationId: logout
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -53,6 +54,7 @@ paths:
         this way.
       operationId: logout_all
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -78,5 +80,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/message_pagination.yaml

@@ -27,6 +27,7 @@ paths:
         [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
       operationId: getRoomEvents
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -187,5 +188,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/mutual_rooms.yaml

@@ -25,6 +25,7 @@ paths:
         specified `user_id`.
       operationId: getMutualRooms
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -120,5 +121,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/notifications.yaml

@@ -24,6 +24,7 @@ paths:
         user has been, or would have been notified about.
       operationId: getNotifications
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -145,5 +146,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/old_sync.yaml

@@ -29,6 +29,7 @@ paths:
         the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: getEvents
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -99,6 +100,7 @@ paths:
         the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: initialSync
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -327,6 +329,7 @@ paths:
         or the [/rooms/{roomId}/context/{eventId}](/client-server-api/#get_matrixclientv3roomsroomidcontexteventid) API.
       operationId: getOneEvent
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -370,5 +373,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/openid.yaml

@@ -30,6 +30,7 @@ paths:
         example.
       operationId: requestOpenIdToken
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -91,5 +92,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/password_management.yaml

@@ -40,6 +40,7 @@ paths:
         to determine if this endpoint is available.
       security:
         - {}
+        - accessTokenQuery: []
         - accessTokenBearer: []
       operationId: changePassword
       requestBody:
@@ -239,5 +240,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/peeking_events.yaml

@@ -34,6 +34,7 @@ paths:
         yet known.
       operationId: peekEvents
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -115,5 +116,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/presence.yaml

@@ -26,6 +26,7 @@ paths:
         presence state of another user.
       operationId: setPresence
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -82,6 +83,7 @@ paths:
       description: Get the given user's presence state.
       operationId: getPresence
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -161,5 +163,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/profile.yaml

@@ -36,6 +36,7 @@ paths:
         which `keyName`s they are allowed to modify.
       operationId: setProfileField
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -209,6 +210,7 @@ paths:
       description: Remove a specific field from a user's profile.
       operationId: deleteProfileField
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -366,5 +368,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/pusher.yaml

@@ -23,6 +23,7 @@ paths:
       description: Gets all currently active pushers for the authenticated user.
       operationId: getPushers
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -136,6 +137,7 @@ paths:
         user is deleted.
       operationId: postPusher
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -295,5 +297,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/pushrules.yaml

@@ -24,6 +24,7 @@ paths:
         defined is `global`.
       operationId: getPushRules
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -50,6 +51,7 @@ paths:
         Retrieve all push rules for this user.
       operationId: getPushRulesGlobal
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -66,6 +68,7 @@ paths:
       description: Retrieve a single specified push rule.
       operationId: getPushRule
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -130,6 +133,7 @@ paths:
       description: This endpoint removes the push rule defined in the path.
       operationId: deletePushRule
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -199,6 +203,7 @@ paths:
         When creating push rules, they MUST be enabled by default.
       operationId: setPushRule
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -328,6 +333,7 @@ paths:
       description: This endpoint gets whether the specified push rule is enabled.
       operationId: isPushRuleEnabled
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -390,6 +396,7 @@ paths:
         push rule.
       operationId: setPushRuleEnabled
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -461,6 +468,7 @@ paths:
       description: This endpoint get the actions for the specified push rule.
       operationId: getPushRuleActions
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -532,6 +540,7 @@ paths:
         This can be used to change the actions of builtin rules.
       operationId: setPushRuleActions
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -618,5 +627,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/read_markers.yaml

@@ -25,6 +25,7 @@ paths:
         the read receipt's location.
       operationId: setReadMarker
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -96,5 +97,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/receipts.yaml

@@ -25,6 +25,7 @@ paths:
         specified.
       operationId: postReceipt
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -137,5 +138,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/redaction.yaml

@@ -33,6 +33,7 @@ paths:
         Server administrators may redact events sent by users on their server.
       operationId: redactEvent
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -109,5 +110,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/relations.yaml

@@ -31,6 +31,7 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEvents
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -88,6 +89,7 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEventsWithRelType
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -149,6 +151,7 @@ paths:
         page 1 and a `to` token from page 2 to paginate over the same range, however.
       operationId: getRelatingEventsWithRelTypeAndEventType
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/roomId'
@@ -217,6 +220,8 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer
   parameters:

data/api/client-server/report_content.yaml

@@ -59,6 +59,7 @@ paths:
                 - reason
         required: true
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         1.18: |
@@ -142,6 +143,7 @@ paths:
                   description: The reason the content is being reported.
         required: true
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         1.8: |
@@ -226,6 +228,7 @@ paths:
                 - reason
         required: true
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -274,5 +277,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_event_by_timestamp.yaml

@@ -46,6 +46,7 @@ paths:
         found in that direction is outside of the expected range.
       operationId: getEventByTimestamp
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -140,5 +141,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_initial_sync.yaml

@@ -17,6 +17,7 @@ paths:
         [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
       operationId: roomInitialSync
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -181,5 +182,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_send.yaml

@@ -39,6 +39,7 @@ paths:
         the event.
       operationId: sendMessage
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -123,5 +124,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_state.yaml

@@ -39,6 +39,7 @@ paths:
         being removed or are already present in the state event.
       operationId: setRoomStateWithKey
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -152,5 +153,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/room_upgrades.yaml

@@ -22,6 +22,7 @@ paths:
       description: Upgrades the given room to a particular room version.
       operationId: upgradeRoom
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -123,5 +124,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/rooms.yaml

@@ -24,6 +24,7 @@ paths:
         retrieve this event e.g. by being a member in the room for this event.
       operationId: getOneRoomEvent
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -82,6 +83,7 @@ paths:
         taken from the state of the room when they left.
       operationId: getRoomStateWithKey
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -152,6 +154,7 @@ paths:
       description: Get the state events for the current state of a room.
       operationId: getRoomState
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -262,6 +265,7 @@ paths:
               - leave
               - ban
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -314,6 +318,7 @@ paths:
             format: mx-room-id
             pattern: "^!"
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -370,5 +375,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/search.yaml

@@ -22,6 +22,7 @@ paths:
       description: Performs a full text search across different categories.
       operationId: search
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -379,5 +380,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/space_hierarchy.yaml

@@ -30,6 +30,7 @@ paths:
         Invalid child rooms and parent events are not covered by this endpoint.
       operationId: getSpaceHierarchy
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -230,5 +231,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/sync.yaml

@@ -44,6 +44,7 @@ paths:
         events, alongside other state, when lazy-loading is not enabled.
       operationId: sync
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -685,5 +686,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/tags.yaml

@@ -23,6 +23,7 @@ paths:
       description: List the tags set by a user on a room.
       operationId: getRoomTags
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -74,6 +75,7 @@ paths:
       description: Add a tag to the room.
       operationId: setRoomTag
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -123,6 +125,7 @@ paths:
       description: Remove a tag from the room.
       operationId: deleteRoomTag
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -174,5 +177,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/third_party_lookup.yaml

@@ -25,6 +25,7 @@ paths:
         required for queries against each protocol.
       operationId: getProtocols
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -100,6 +101,7 @@ paths:
         third-party protocol.
       operationId: getProtocolMetadata
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -143,6 +145,7 @@ paths:
         as reasonably possible given the network type.
       operationId: queryLocationByProtocol
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -189,6 +192,7 @@ paths:
         a set of user parameters.
       operationId: queryUserByProtocol
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -234,6 +238,7 @@ paths:
         alias.
       operationId: queryLocationByAlias
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -269,6 +274,7 @@ paths:
       description: Retrieve an array of third-party users from a Matrix User ID.
       operationId: queryUserByID
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -312,5 +318,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/third_party_membership.yaml

@@ -59,6 +59,7 @@ paths:
         - The matrix user ID who invited them to the room
       operationId: inviteBy3PID
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -132,5 +133,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/threads_list.yaml

@@ -27,6 +27,7 @@ paths:
         user has participated in the thread.
       operationId: getThreadRoots
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -160,5 +161,7 @@ servers:
         default: /_matrix/client/v1
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/to_device.yaml

@@ -24,6 +24,7 @@ paths:
         client devices.
       operationId: sendToDevice
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -97,5 +98,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/typing.yaml

@@ -26,6 +26,7 @@ paths:
         user has stopped typing.
       operationId: setTyping
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: path
@@ -100,5 +101,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/users.yaml

@@ -39,6 +39,7 @@ paths:
         `Accept-Language` header provided in the request, if present.
       operationId: searchUserDirectory
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -132,5 +133,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/versions.yaml

@@ -45,6 +45,7 @@ paths:
       operationId: getVersions
       security:
         - {}
+        - accessTokenQuery: []
         - accessTokenBearer: []
       x-changedInMatrixVersion:
         "1.10": |
@@ -101,5 +102,7 @@ servers:
         default: /_matrix/client
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/voip.yaml

@@ -24,6 +24,7 @@ paths:
         calls.
       operationId: getTurnServer
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -88,5 +89,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/client-server/whoami.yaml

@@ -30,6 +30,7 @@ paths:
         body.
       operationId: getTokenOwner
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -114,5 +115,7 @@ servers:
         default: /_matrix/client/v3
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/definitions/security.yaml

@@ -11,9 +11,18 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+accessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `access_token` returned by a call to `/register`, as a
+    query parameter.
+  name: access_token
+  in: query
 accessTokenBearer:
   type: http
   description: |-
     The `access_token` returned by a call to `/register`, using the
     `Authorization: Bearer` header.
+    
+    This is the preferred method.
   scheme: bearer

data/api/identity/v2_associations.yaml

@@ -23,6 +23,7 @@ paths:
       description: Determines if a given 3pid has been validated by a user.
       operationId: getValidated3pidV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -128,6 +129,7 @@ paths:
         deprecated.
       operationId: bindV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -279,6 +281,7 @@ paths:
         homeserver is acting on behalf of a client.
       operationId: unbindV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -383,5 +386,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_auth.yaml

@@ -58,6 +58,7 @@ paths:
         request.
       operationId: getAccount
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -99,6 +100,7 @@ paths:
         future requests to the server.
       operationId: logout
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -150,5 +152,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_email_associations.yaml

@@ -40,6 +40,7 @@ paths:
         deprecated.
       operationId: emailRequestTokenV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -107,6 +108,7 @@ paths:
         deprecated.
       operationId: emailSubmitTokenPostV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -198,6 +200,7 @@ paths:
         used by end-users, and so the response should be human-readable.
       operationId: emailSubmitTokenGetV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -260,5 +263,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_invitation_signing.yaml

@@ -27,6 +27,7 @@ paths:
         to `store-invite`, and fetch the sender of the invite.
       operationId: blindlySignStuffV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -132,5 +133,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_lookup.yaml

@@ -28,6 +28,7 @@ paths:
         any of the algorithms defined in this specification.
       operationId: getHashDetails
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       responses:
         "200":
@@ -70,6 +71,7 @@ paths:
         later in this specification.
       operationId: lookupUsersV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -162,5 +164,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_phone_associations.yaml

@@ -40,6 +40,7 @@ paths:
         deprecated.
       operationId: msisdnRequestTokenV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -109,6 +110,7 @@ paths:
         deprecated.
       operationId: msisdnSubmitTokenPostV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -200,6 +202,7 @@ paths:
         used by end-users, and so the response should be human-readable.
       operationId: msisdnSubmitTokenGetV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       parameters:
         - in: query
@@ -261,5 +264,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_store_invite.yaml

@@ -51,6 +51,7 @@ paths:
         the `address` of the pending invite for display purposes.
       operationId: storeInviteV2
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -234,5 +235,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer

data/api/identity/v2_terms.yaml

@@ -118,6 +118,7 @@ paths:
         may not be accepting all terms at once.
       operationId: agreeToTerms
       security:
+        - accessTokenQuery: []
         - accessTokenBearer: []
       requestBody:
         content:
@@ -158,5 +159,7 @@ servers:
         default: /_matrix/identity/v2
 components:
   securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
     accessTokenBearer:
       $ref: definitions/security.yaml#/accessTokenBearer