2026-07-31 10:07:48 +02:00
102 changed files with 405 additions and 108 deletions
--- a/changelogs/appendices/newsfragments/2396.clarification
+++ b/changelogs/appendices/newsfragments/2396.clarification
@ -1 +0,0 @@
-Clarify that clients must avoid producing ambiguous matrix.to URIs. Contributed by @HarHarLinks.
--- a/changelogs/client_server/newsfragments/2394.clarification
+++ b/changelogs/client_server/newsfragments/2394.clarification
@ -1 +0,0 @@
-Correct some errors in the description of the validation process for incoming Olm-encrypted messages.
--- a/changelogs/client_server/newsfragments/2404.breaking
+++ b/changelogs/client_server/newsfragments/2404.breaking
@ -1 +0,0 @@
-Clients are now supposed to follow 30x redirects from `/.well-known/matrix/client` as per [MSC4402](https://github.com/matrix-org/matrix-spec-proposals/pull/4402).
--- a/changelogs/client_server/newsfragments/2407.clarification
+++ b/changelogs/client_server/newsfragments/2407.clarification
@ -1 +0,0 @@
-Add further normative language in mutual rooms server behaviour.
--- a/changelogs/client_server/newsfragments/2408.breaking
+++ b/changelogs/client_server/newsfragments/2408.breaking
@ -1 +0,0 @@
-Providing access tokens via query string parameters is no longer supported.
--- a/changelogs/client_server/newsfragments/2412.clarification
+++ b/changelogs/client_server/newsfragments/2412.clarification
@ -1 +0,0 @@
-Use the User ID type in OlmPayload and DeviceKeys.
--- a/changelogs/client_server/newsfragments/2413.clarification
+++ b/changelogs/client_server/newsfragments/2413.clarification
@ -1 +0,0 @@
-Improve the format description of `m.room.encrypted` (Olm/Megolm) events.
--- a/changelogs/client_server/newsfragments/2417.clarification
+++ b/changelogs/client_server/newsfragments/2417.clarification
@ -1 +0,0 @@
-Wording improvements and spelling fixes. Contributed by @HarHarLinks.
--- a/changelogs/client_server/newsfragments/2418.clarification
+++ b/changelogs/client_server/newsfragments/2418.clarification
@ -1 +0,0 @@
-Rename OlmPayload to OlmPlaintext to avoid confusion with Olm message Payload Bytes.
--- a/changelogs/client_server/newsfragments/2422.clarification
+++ b/changelogs/client_server/newsfragments/2422.clarification
@ -1 +0,0 @@
-Use MXC URI type for all user `avatar_url` fields. Contributed by @networkException.
--- a/changelogs/identity_service/newsfragments/2408.breaking
+++ b/changelogs/identity_service/newsfragments/2408.breaking
@ -1 +0,0 @@
-Providing access tokens via query string parameters is no longer supported.
--- a/changelogs/olm_megolm/newsfragments/2421.clarification
+++ b/changelogs/olm_megolm/newsfragments/2421.clarification
@ -1 +0,0 @@
-Fix typesetting of some symbols in the Olm/Megolm spec.
--- a/config/_default/hugo.toml
+++ b/config/_default/hugo.toml
@ -71,13 +71,13 @@ offlineSearch = true
 [params.version]
 # must be one of "unstable", "current", "historical"
 # this is used to decide whether to show a banner pointing to the current release
-status = "unstable"
+status = "stable"
 # A URL pointing to the latest, stable release of the spec. To be shown in the unstable version warning banner.
 current_version_url = "https://spec.matrix.org/latest"
 # The following is used when status = "stable", and is displayed in various UI elements on a released version
 # of the spec.
-# major = "1"
-# minor = "19"
+major = "1"
+minor = "19"

 [[params.versions]]
 # We must include this parameter to enable docsy's version picker in the navbar. The picker
--- a/content/appendices.md
+++ b/content/appendices.md
@ -887,22 +887,20 @@ https://matrix.to/#/<identifier>/<extra parameter>?<additional arguments>

 The identifier may be a room ID, room alias, or user ID. The
 extra parameter is only used in the case of permalinks where an event ID
-is referenced. The matrix.to URI, when referenced, MUST always start
+is referenced. The matrix.to URI, when referenced, must always start
 with `https://matrix.to/#/` followed by the identifier.

 The `<additional arguments>` and the preceding question mark are
-OPTIONAL and only apply in certain circumstances, documented below.
+optional and only apply in certain circumstances, documented below.

-Clients SHOULD NOT rely on matrix.to URIs falling back to a web server
-if accessed and instead SHOULD perform some sort of action within the
+Clients should not rely on matrix.to URIs falling back to a web server
+if accessed and instead should perform some sort of action within the
 client. For example, if the user were to click on a matrix.to URI for a
-room alias, the client MAY open a view for the user to participate in
+room alias, the client may open a view for the user to participate in
 the room.

 The components of the matrix.to URI (`<identifier>` and
 `<extra parameter>`) MUST be percent-encoded as per RFC 3986.
-Failure to do so will result in downstream software misinterpreting
-the links as invalid/not turning them into clickable links in UI.

 Examples of matrix.to URIs are:

--- a/content/client-server-api/_index.md
+++ b/content/client-server-api/_index.md
@ -429,7 +429,6 @@ Instead, they can be reached via HTTPS on the [server name](/appendices/#server-

 Servers hosting the `.well-known` JSON file SHOULD offer CORS headers,
 as per the [CORS](#web-browser-clients) section in this specification.
-{{% added-in v="1.20" %}} Servers SHOULD also ensure that each 30x redirect, if any, offers such CORS headers.
 {{% /boxes/note %}}

 The flow for auto-discovery is as follows:
@ -438,7 +437,6 @@ The flow for auto-discovery is as follows:
    Matrix ID at the first colon.
 2.  Extract the hostname from the server name as described by the [grammar](/appendices/#server-name).
 3.  Make a GET request to `https://hostname/.well-known/matrix/client`.
-    {{% added-in v="1.20" %}} 30x redirects SHOULD be followed, however redirection loops should be avoided.
    1.  If the returned status code is 404, then `IGNORE`.
    2.  If the returned status code is not 200, or the response body is
        empty, then `FAIL_PROMPT`.
@ -570,9 +568,15 @@ invalidate the access token the client must use [token revocation](#token-revoca
 Access tokens may be provided via a request header, using the Authentication
 Bearer scheme: `Authorization: Bearer TheTokenHere`.

+Clients may alternatively provide the access token via a query string parameter:
+`access_token=TheTokenHere`. This method is deprecated to prevent the access
+token being leaked in access/HTTP logs and SHOULD NOT be used by clients.
+
+Homeservers MUST support both methods.
+
 {{% boxes/note %}}
-{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is no longer supported.
+{{% changed-in v="1.11" %}}
+Sending the access token as a query string parameter is now deprecated.
 {{% /boxes/note %}}

 When credentials are required but missing or invalid, the HTTP call will
@ -3656,7 +3660,7 @@ The actual aggregation format depends on the `rel_type`.

 When an event is served to the client through the APIs listed below, a
 `m.relations` property is included under `unsigned` if the event has child
-events which can be aggregated. The `m.relations` property is
+events which can be aggregated and point at it. The `m.relations` property is
 an object keyed by `rel_type` and value being the type-specific aggregated
 format for that `rel_type`. This `m.relations` property is known as a "bundled
 aggregation".
--- a/content/client-server-api/modules/end_to_end_encryption.md
+++ b/content/client-server-api/modules/end_to_end_encryption.md
@ -1723,30 +1723,28 @@ Devices that support Olm must include "m.olm.v1.curve25519-aes-sha2" in
 their list of supported messaging algorithms, must list a Curve25519
 device key, and must publish Curve25519 one-time keys.

-The content of an [`m.room.encrypted`](#mroomencrypted) event using Olm has the following format:
+An event encrypted using Olm has the following format:

 ```json
 {
+  "type": "m.room.encrypted",
  "content": {
    "algorithm": "m.olm.v1.curve25519-aes-sha2",
    "sender_key": "<sender_curve25519_key>",
    "ciphertext": {
      "<device_curve25519_key>": {
        "type": 0,
-        "body": "<base64_encoded_olm_message>"
+        "body": "<encrypted_payload_base_64>"
      }
    }
  }
 }
 ```
-Note that when the event is received from the server, it will have a `type`
-(with a value of `m.room.encrypted`) and `sender` property alongside the
-`content` property. In `content`, `ciphertext` is a mapping from a device
-Curve25519 key to an object with a `type` and a `body`. Here, `body` is a
-Base64-encoded [Olm message](/olm-megolm/olm/#the-olm-message-format), and
-`type` is an integer indicating the type of the message:
-0 for the initial [pre-key messages](/olm-megolm/olm/#pre-key-messages),
-1 for [normal messages](/olm-megolm/olm/#normal-messages).
+
+`ciphertext` is a mapping from device Curve25519 key to an encrypted
+payload for that device. `body` is a Base64-encoded [Olm message body](/olm-megolm/olm/#the-olm-message-format).
+`type` is an integer indicating the type of the message body: 0 for the
+initial [pre-key message](/olm-megolm/olm/#pre-key-messages), 1 for [normal messages](/olm-megolm/olm/#normal-messages).

 Olm sessions will generate messages with a type of 0 until they receive
 a message. Once a session has decrypted a message it will produce
@ -1764,9 +1762,12 @@ Messages with type 1 can only be decrypted with an existing session. If
 there is no matching session, the client must treat this as an invalid
 message.

-The plaintext corresponding to the "Cipher-Text" in an an [Olm message](/olm-megolm/olm/#normal-messages) is of the form:
+The plaintext payload is of the form:

-{{% definition path="api/client-server/definitions/olm_plaintext" %}}
+{{% definition path="api/client-server/definitions/olm_payload" %}}
+
+The type and content of the plaintext message event are given in the
+payload.

 If a client has multiple sessions established with another device, it
 should use the session from which it last received and successfully
@ -1780,7 +1781,6 @@ of olm sessions maintained per device should be at least 4.
 ###### Validation of incoming decrypted events

 {{% changed-in v="1.15" %}} Existing checks made more explicit, and checks for `sender_device_keys` added.
-{{% changed-in v="1.19" %}} Corrections to some errors in the description of the verification checks.

 After decrypting an incoming encrypted event, clients MUST apply the
 following checks:
@ -1788,9 +1788,8 @@ following checks:
 1.  The `sender` property in the decrypted content must match the
    `sender` of the event.
 2.  The `keys.ed25519` property in the decrypted content must match
-    the Ed25519 identity key of the sending device. This key can be
-    obtained from either [`/keys/query`](#post_matrixclientv3keysquery)
-    or the `sender_device_keys` object (see below).
+    the `sender_key` property in the cleartext `m.room.encrypted`
+    event body.
 3.  The `recipient` property in the decrypted content must match
    the user ID of the local user.
 4.  The `recipient_keys.ed25519` property in the decrypted content
@ -1798,11 +1797,11 @@ following checks:
 5.  Where `sender_device_keys` is present in the decrypted content:
    1.  `sender_device_keys.user_id` must also match the `sender`
        of the event.
-    2.  `sender_device_keys.keys.curve25519:<device_id>` must match
+    2.  `sender_device_keys.keys.ed25519:<device_id>` must also match
        the `sender_key` property in the cleartext `m.room.encrypted`
        event body.
-    3.  `sender_device_keys.keys.ed25519:<device_id>` must be the same
-        as the `keys.ed25519` property in the decrypted content.
+    3.  `sender_device_keys.keys.curve25519:<device_id>` must match
+        the Curve25519 key used to establish the Olm session.
    4.  The `sender_device_keys` structure must have a valid signature
        from the key with ID `ed25519:<device_id>` (i.e., the sending
        device's Ed25519 key).
@ -1895,26 +1894,23 @@ This uses:
 Devices that support Megolm must support Olm, and include
 "m.megolm.v1.aes-sha2" in their list of supported messaging algorithms.

-The content of an [`m.room.encrypted`](#mroomencrypted) event using Megolm has the following format:
+An event encrypted using Megolm has the following format:

 ```json
 {
+  "type": "m.room.encrypted",
  "content": {
    "algorithm": "m.megolm.v1.aes-sha2",
    "sender_key": "<sender_curve25519_key>",
    "device_id": "<sender_device_id>",
    "session_id": "<outbound_group_session_id>",
-    "ciphertext": "<base64_encoded_megolm_message>"
+    "ciphertext": "<encrypted_payload_base_64>"
  }
 }
 ```
-Note that when the event is received from the server, it will have additional
-properties alongside the `content` property, including a `type` (with a value
-of `m.room.encrypted`) and a `sender` property. (See [Room event format](#room-event-format).)

-Within `content`, `ciphertext`
-is a Base64-encoded [Megolm message](/olm-megolm/megolm/#message-format),
-whose plaintext body is of the form:
+The encrypted payload can contain any message event. The plaintext is of
+the form:

 ```json
 {
@ -1924,7 +1920,7 @@ whose plaintext body is of the form:
 }
 ```

-We include the room ID in the encrypted message, because otherwise the homeserver
+We include the room ID in the payload, because otherwise the homeserver
 would be able to change the room a message was sent in.

 Clients must guard against replay attacks by keeping track of the
@ -1944,7 +1940,7 @@ As of `v1.3`, the `sender_key` and `device_id` keys are **deprecated**. They
 SHOULD continue to be sent, however they MUST NOT be used to verify the
 message's source.

-Clients MUST NOT store or look up sessions using the `sender_key` or `device_id`.
+Clients MUST NOT store or lookup sessions using the `sender_key` or `device_id`.

 In a future version of the specification the keys can be removed completely,
 including for sending new messages.
--- a/content/client-server-api/modules/event_replacements.md
+++ b/content/client-server-api/modules/event_replacements.md
@ -91,13 +91,13 @@ For example, a replacement for an encrypted event might look like this:
        "sender_key": "<sender_curve25519_key>",
        "device_id": "<sender_device_id>",
        "session_id": "<outbound_group_session_id>",
-        "ciphertext": "<base64_encoded_megolm_message>"
+        "ciphertext": "<encrypted_payload_base_64>"
    }
    // irrelevant fields not shown
 }
 ```

-... and the plaintext body of the Megolm message might look like this:
+... and, once decrypted, the payload might look like this:

 ```json
 {
--- a/content/client-server-api/modules/mutual_rooms.md
+++ b/content/client-server-api/modules/mutual_rooms.md
@ -6,9 +6,9 @@

 #### Server behaviour

-The server MAY decide that the response to this endpoint is too large, and only return a
-subset of the results. In this case, the server populates the optional field `next_batch`
-with an [opaque identifier](/appendices/#opaque-identifiers). The client can then supply
+The server may decide that the response to this endpoint is too large, and only return a
+subset of the results. In this case, the server should populate the optional field `next_batch`
+with an [opaque identifier](/appendices/#opaque-identifiers). The client may then supply
 the identifier as the `from` query parameter in a subsequent request, along with the original
 `user_id`, to fetch the next batch of responses. This will continue until the server no longer
 inserts `next_batch`, meaning there are no further results.
--- a/content/client-server-api/modules/threading.md
+++ b/content/client-server-api/modules/threading.md
@ -191,7 +191,7 @@ Note that, as in the example above, child events of the `latest_event` should
 themselves be aggregated and included under `m.relations` for that event. The
 server should be careful to avoid loops, though loops are not currently
 possible due to `m.thread` not being permitted to target an event with an
-`m.relates_to` property with a `rel_type`.
+`m.relates_to` property.

 `count` is simply the number of events using `m.thread` as a `rel_type` pointing to the target event.
 It does not include events sent by [ignored users](#ignoring-users).
--- a/content/identity-service-api.md
+++ b/content/identity-service-api.md
@ -167,9 +167,16 @@ requests.
 Access tokens may be provided via a request header, using the
 Authentication Bearer scheme: `Authorization: Bearer TheTokenHere`.

+Clients may alternatively provide the access token via a query string
+parameter: `access_token=TheTokenHere`. This method is deprecated to
+prevent the access token being leaked in access/HTTP logs and SHOULD NOT
+be used by clients.
+
+Identity Servers MUST support both methods.
+
 {{% boxes/note %}}
-{{% changed-in v="1.20" %}}
-Sending the access token as a query string parameter is no longer supported.
+{{% changed-in v="1.11" %}}
+Sending the access token as a query string parameter is now deprecated.
 {{% /boxes/note %}}

 When credentials are required but missing or invalid, the HTTP call will
--- a/content/olm-megolm/megolm.md
+++ b/content/olm-megolm/megolm.md
@ -257,8 +257,8 @@ consists of the following key-value pairs:

 **Name**|**Tag**|**Type**|**Meaning**
 :-----:|:-----:|:-----:|:-----:
-Message-Index|0x08|Integer|The index of the ratchet, \(i\).
-Cipher-Text|0x12|String|The cipher-text of the message, \(X_i\).
+Message-Index|0x08|Integer|The index of the ratchet, i
+Cipher-Text|0x12|String|The cipher-text, Xi, of the message

 Within the payload, integers are encoded using a variable length encoding. Each
 integer is encoded as a sequence of bytes with the high bit set followed by a
--- a/content/olm-megolm/olm.md
+++ b/content/olm-megolm/olm.md
@ -17,12 +17,12 @@ side of an \(=\) it means that the output is split.
 When this document uses \(\operatorname{ECDH}\left(K_A,K_B\right)\) it means
 that each party computes a Diffie-Hellman agreement using their private key 
 and the remote party's public key.
-So party \(A\) computes \(\operatorname{ECDH}\left(K_B^{\mathit{public}},K_A^{\mathit{private}}\right)\)
-and party \(B\) computes \(\operatorname{ECDH}\left(K_A^{\mathit{public}},K_B^{\mathit{private}}\right)\).
+So party \(A\) computes \(\operatorname{ECDH}\left(K_B^{public},K_A^{private}\right)\)
+and party \(B\) computes \(\operatorname{ECDH}\left(K_A^{public},K_B^{private}\right)\).

-Where this document uses \(\operatorname{HKDF}\left(\mathit{salt},\mathit{IKM},\mathit{info},L\right)\) it
+Where this document uses \(\operatorname{HKDF}\left(salt,IKM,info,L\right)\) it
 refers to the [HMAC-based key derivation function][] with a salt value of
-\(\mathit{salt}\), input key material of \(\mathit{IKM}\), context string \(\mathit{info}\),
+\(salt\), input key material of \(IKM\), context string \(info\),
 and output keying material length of \(L\) bytes.

 ## The Olm Algorithm
@ -226,9 +226,9 @@ significant bits are stored in the first byte.

 **Name**|**Tag**|**Type**|**Meaning**
 :-----:|:-----:|:-----:|:-----:
-Ratchet-Key|0x0A|String|The public part of the ratchet key of the message, \(T_i\).
-Chain-Index|0x10|Integer|The chain index of the message, \(j\).
-Cipher-Text|0x22|String|The cipher-text of the message, \(X_{i,j}\).
+Ratchet-Key|0x0A|String|The public part of the ratchet key, Ti, of the message
+Chain-Index|0x10|Integer|The chain index, j, of the message
+Cipher-Text|0x22|String|The cipher-text, Xi, j, of the message

 The length of the MAC is determined by the authenticated encryption algorithm
 being used. (Olm version 1 uses [HMAC-SHA-256][], truncated to 8 bytes). The
@ -251,9 +251,9 @@ The payload uses the same key-value format as for normal messages.

 **Name**|**Tag**|**Type**|**Meaning**
 :-----:|:-----:|:-----:|:-----:
-One-Time-Key|0x0A|String|The public part of Bob's single-use key, \(E_B\).
-Base-Key|0x12|String|The public part of Alice's single-use key, \(E_A\).
-Identity-Key|0x1A|String|The public part of Alice's identity key, \(I_A\).
+One-Time-Key|0x0A|String|The public part of Bob's single-use key, Eb.
+Base-Key|0x12|String|The public part of Alice's single-use key, Ea.
+Identity-Key|0x1A|String|The public part of Alice's identity key, Ia.
 Message|0x22|String|An embedded Olm message with its own version and MAC.

 ## Olm Authenticated Encryption
@ -268,13 +268,13 @@ message key using [HKDF-SHA-256][] using the default salt and an info of

 \[
 \begin{aligned}
-    \mathit{AES\_KEY}_{i,j}\;\parallel\;\mathit{HMAC\_KEY}_{i,j}\;\parallel\;\mathit{AES\_IV}_{i,j}
+    AES\_KEY_{i,j}\;\parallel\;HMAC\_KEY_{i,j}\;\parallel\;AES\_IV_{i,j}
    &= \operatorname{HKDF}\left(0,M_{i,j},\text{``OLM\_KEYS"},80\right)
 \end{aligned}
 \]

-The plain-text is encrypted with AES-256, using the key \(\mathit{AES\_KEY}_{i,j}\)
-and the IV \(\mathit{AES\_IV}_{i,j}\) to give the cipher-text, \(X_{i,j}\).
+The plain-text is encrypted with AES-256, using the key \(AES\_KEY_{i,j}\)
+and the IV \(AES\_IV_{i,j}\) to give the cipher-text, \(X_{i,j}\).

 Then the entire message (including the Version Byte and all Payload Bytes) are
 passed through [HMAC-SHA-256][]. The first 8 bytes of the MAC are appended to the message.
--- a/data/api/client-server/account-data.yaml
+++ b/data/api/client-server/account-data.yaml
@ -26,6 +26,7 @@ paths:
        [/sync](/client-server-api/#get_matrixclientv3sync).
      operationId: setAccountData
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -117,6 +118,7 @@ paths:
        that set the account data.
      operationId: getAccountData
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -186,6 +188,7 @@ paths:
        clients in the per-room entries via [/sync](/client-server-api/#get_matrixclientv3sync).
      operationId: setAccountDataPerRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -285,6 +288,7 @@ paths:
        visible to the user that set the account data.
      operationId: getAccountDataPerRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -379,5 +383,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/account_deactivation.yaml
+++ b/data/api/client-server/account_deactivation.yaml
@ -45,6 +45,7 @@ paths:
        {{% /boxes/warning %}}
      security:
        - {}
+        - accessTokenQuery: []
        - accessTokenBearer: []
      operationId: deactivateAccount
      requestBody:
@ -142,5 +143,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/admin.yaml
+++ b/data/api/client-server/admin.yaml
@ -27,6 +27,7 @@ paths:
        specified in this document.
      operationId: getWhoIs
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -119,6 +120,7 @@ paths:
        prior to trying to do account lookups.
      operationId: getAdminSuspendUser
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -206,6 +208,7 @@ paths:
        prior to trying to do account lookups.
      operationId: setAdminSuspendUser
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -310,6 +313,7 @@ paths:
        prior to trying to do account lookups.
      operationId: getAdminLockUser
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -396,6 +400,7 @@ paths:
        prior to trying to do account lookups.
      operationId: setAdminLockUser
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -501,5 +506,7 @@ servers:
        default: /_matrix/client
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/administrative_contact.yaml
+++ b/data/api/client-server/administrative_contact.yaml
@ -31,6 +31,7 @@ paths:
        identifiers that it will accept to reset the user's account password.
      operationId: getAccount3PIDs
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -105,6 +106,7 @@ paths:
      operationId: post3PIDs
      deprecated: true
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -214,6 +216,7 @@ paths:
        {{% /boxes/warning %}}
      operationId: add3PID
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -276,6 +279,7 @@ paths:
        Homeservers should track successful binds so they can be unbound later.
      operationId: bind3PID
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -341,6 +345,7 @@ paths:
        to determine if this endpoint is available.
      operationId: delete3pidFromAccount
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -410,6 +415,7 @@ paths:
        identity server instead.
      operationId: unbind3pidFromAccount
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -608,5 +614,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/appservice_ping.yaml
+++ b/data/api/client-server/appservice_ping.yaml
@ -57,6 +57,7 @@ paths:
                  example: mautrix-go_1683636478256400935_123
        required: true
      security:
+        - appserviceAccessTokenQuery: []
        - appserviceAccessTokenBearer: []
      responses:
        "200":
@ -176,5 +177,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    appserviceAccessTokenQuery:
+      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
    appserviceAccessTokenBearer:
      $ref: definitions/security.yaml#/appserviceAccessTokenBearer
--- a/data/api/client-server/appservice_room_directory.yaml
+++ b/data/api/client-server/appservice_room_directory.yaml
@ -70,6 +70,7 @@ paths:
                - visibility
        required: true
      security:
+        - appserviceAccessTokenQuery: []
        - appserviceAccessTokenBearer: []
      responses:
        "200":
@ -97,5 +98,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    appserviceAccessTokenQuery:
+      $ref: definitions/security.yaml#/appserviceAccessTokenQuery
    appserviceAccessTokenBearer:
      $ref: definitions/security.yaml#/appserviceAccessTokenBearer
--- a/data/api/client-server/authed-content-repo.yaml
+++ b/data/api/client-server/authed-content-repo.yaml
@ -33,6 +33,7 @@ paths:
        Delivery Network (CDN).
      operationId: getContentAuthed
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -105,6 +106,7 @@ paths:
        Delivery Network (CDN).
      operationId: getContentOverrideNameAuthed
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -175,6 +177,7 @@ paths:
        Delivery Network (CDN).
      operationId: getContentThumbnailAuthed
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -350,6 +353,7 @@ paths:
        {{% /boxes/note %}}
      operationId: getUrlPreviewAuthed
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -428,6 +432,7 @@ paths:
        {{% /boxes/note %}}
      operationId: getConfigAuthed
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -467,6 +472,8 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/banning.yaml
+++ b/data/api/client-server/banning.yaml
@ -27,6 +27,7 @@ paths:
        The caller must have the required power level in order to perform this operation.
      operationId: ban
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -100,6 +101,7 @@ paths:
        The caller must have the required power level in order to perform this operation.
      operationId: unban
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -177,5 +179,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/capabilities.yaml
+++ b/data/api/client-server/capabilities.yaml
@ -24,6 +24,7 @@ paths:
        and other relevant capabilities.
      operationId: getCapabilities
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -217,6 +218,8 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  schemas:
--- a/data/api/client-server/content-repo.yaml
+++ b/data/api/client-server/content-repo.yaml
@ -22,6 +22,7 @@ paths:
      summary: Upload some content to the content repository.
      operationId: uploadContent
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/contentType'
@ -81,6 +82,7 @@ paths:
      operationId: uploadContentToMXC
      x-addedInMatrixVersion: "1.7"
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/serverName'
@ -190,6 +192,7 @@ paths:
      operationId: createContent
      x-addedInMatrixVersion: "1.7"
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      # empty json object
      responses:
@ -576,6 +579,7 @@ paths:
        being shared should also not be shared with the homeserver.
      operationId: getUrlPreview
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -656,6 +660,7 @@ paths:
        than is advertised by the server on this endpoint.
      operationId: getConfig
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -695,6 +700,8 @@ servers:
        default: /_matrix
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/create_room.yaml
+++ b/data/api/client-server/create_room.yaml
@ -80,6 +80,7 @@ paths:
      x-changedInMatrixVersion:
        "1.16": Added server behaviour for how the initial power levels change depending on room version.
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -303,5 +304,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/cross_signing.yaml
+++ b/data/api/client-server/cross_signing.yaml
@ -52,6 +52,7 @@ paths:
        {{% /boxes/note %}}
      operationId: uploadCrossSigningKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -181,6 +182,7 @@ paths:
        property, which contains the new signature(s) to add.
      operationId: uploadCrossSigningSignatures
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -292,5 +294,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/definitions/device_keys.yaml
+++ b/data/api/client-server/definitions/device_keys.yaml
@ -20,8 +20,6 @@ properties:
    description: |-
      The ID of the user the device belongs to. Must match the user ID used
      when logging in.
-    format: mx-user-id
-    pattern: "^@"
    example: "@alice:example.com"
  device_id:
    type: string
--- a/data/api/client-server/definitions/olm_plaintext.yaml
+++ b/data/api/client-server/definitions/olm_plaintext.yaml
@ -14,9 +14,9 @@


 type: object
-title: OlmPlaintext
+title: OlmPayload
 description: |-
-  The plaintext of an event encrypted using Olm.
+  The plaintext payload of an event encrypted using Olm.
 properties:
  type:
    type: string
@ -27,13 +27,9 @@ properties:
  sender:
    type: string
    description: The user ID of the event sender.
-    format: mx-user-id
-    pattern: "^@"
  recipient:
    type: string
    description: The user ID of the intended event recipient.
-    format: mx-user-id
-    pattern: "^@"
  recipient_keys:
    description: The recipient's signing keys of the encrypted event.
    $ref: "#/components/schemas/SigningKeys"
--- a/data/api/client-server/definitions/public_rooms_chunk.yaml
+++ b/data/api/client-server/definitions/public_rooms_chunk.yaml
@ -54,8 +54,7 @@ properties:
    example: true
  avatar_url:
    type: string
-    format: mx-mxc-uri
-    pattern: "^mxc:\\/\\/"
+    format: uri
    description: The URL for the room's avatar, if one is set.
    example: "mxc://example.org/abcdef"
  join_rule:
--- a/data/api/client-server/definitions/security.yaml
+++ b/data/api/client-server/definitions/security.yaml
@ -11,6 +11,15 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+accessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `access_token` obtained during [account registration](/client-server-api/#account-registration)
+    or [login](/client-server-api/#login), as a query parameter.
+
+    It can also be the `as_token` of an application service.
+  name: access_token
+  in: query
 accessTokenBearer:
  type: http
  description: |-
@ -18,10 +27,21 @@ accessTokenBearer:
    or [login](/client-server-api/#login), using the `Authorization: Bearer` header.

    It can also be the `as_token` of an application service.
+
+    This is the preferred method.
  scheme: bearer
+appserviceAccessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `as_token` of an application service, as a query
+    parameter.
+  name: access_token
+  in: query
 appserviceAccessTokenBearer:
  type: http
  description: |-
    The `as_token` of an application service, using the `Authorization: Bearer`
    header.
+
+    This is the preferred method.
  scheme: bearer
--- a/data/api/client-server/device_management.yaml
+++ b/data/api/client-server/device_management.yaml
@ -22,6 +22,7 @@ paths:
      description: Gets information about all devices for the current user.
      operationId: getDevices
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -56,6 +57,7 @@ paths:
      description: Gets information on a single device, by device id.
      operationId: getDevice
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -102,6 +104,7 @@ paths:
        rate limits.
      operationId: updateDevice
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -176,6 +179,7 @@ paths:
        {{% /boxes/warning %}}
      operationId: deleteDevice
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -244,6 +248,7 @@ paths:
        {{% /boxes/warning %}}
      operationId: deleteDevices
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -303,5 +308,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/directory.yaml
+++ b/data/api/client-server/directory.yaml
@ -21,6 +21,7 @@ paths:
      summary: Create a new mapping from room alias to room ID.
      operationId: setRoomAlias
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -181,6 +182,7 @@ paths:
        have permission to update the `m.room.canonical_alias` event.
      operationId: deleteRoomAlias
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -240,6 +242,7 @@ paths:
        state event.
      operationId: getLocalAliases
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -324,5 +327,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/event_context.yaml
+++ b/data/api/client-server/event_context.yaml
@ -28,6 +28,7 @@ paths:
        [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
      operationId: getEventContext
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -154,5 +155,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/filter.yaml
+++ b/data/api/client-server/filter.yaml
@ -25,6 +25,7 @@ paths:
        restrict which events are returned to the client.
      operationId: defineFilter
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -121,6 +122,7 @@ paths:
      summary: Download a filter
      operationId: getFilter
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -216,5 +218,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/inviting.yaml
+++ b/data/api/client-server/inviting.yaml
@ -38,6 +38,7 @@ paths:
        `m.room.member` event to the room.
      operationId: inviteUser
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -146,5 +147,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/joining.yaml
+++ b/data/api/client-server/joining.yaml
@ -33,6 +33,7 @@ paths:
        and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
      operationId: joinRoomById
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -130,6 +131,7 @@ paths:
        and [`/sync`](/client-server-api/#get_matrixclientv3sync) APIs.
      operationId: joinRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -243,5 +245,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/key_backup.yaml
+++ b/data/api/client-server/key_backup.yaml
@ -23,6 +23,7 @@ paths:
      description: Creates a new backup.
      operationId: postRoomKeysVersion
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -80,6 +81,7 @@ paths:
      description: Get information about the latest backup version.
      operationId: getRoomKeysVersionCurrent
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -155,6 +157,7 @@ paths:
      description: Get information about an existing backup.
      operationId: getRoomKeysVersion
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -242,6 +245,7 @@ paths:
        be modified.
      operationId: putRoomKeysVersion
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -344,6 +348,7 @@ paths:
        as well as all key data related to the backup will be deleted.
      operationId: deleteRoomKeysVersion
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -396,6 +401,7 @@ paths:
      description: Store a key in the backup.
      operationId: putRoomKeyBySessionId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -463,6 +469,7 @@ paths:
      description: Retrieve a key from the backup.
      operationId: getRoomKeyBySessionId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -519,6 +526,7 @@ paths:
      description: Delete a key from the backup.
      operationId: deleteRoomKeyBySessionId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -576,6 +584,7 @@ paths:
      description: Store several keys in the backup for a given room.
      operationId: putRoomKeysByRoomId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -648,6 +657,7 @@ paths:
      description: Retrieve the keys from the backup for a given room.
      operationId: getRoomKeysByRoomId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -700,6 +710,7 @@ paths:
      description: Delete the keys from the backup for a given room.
      operationId: deleteRoomKeysByRoomId
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -750,6 +761,7 @@ paths:
      description: Store several keys in the backup.
      operationId: putRoomKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -837,6 +849,7 @@ paths:
      description: Retrieve the keys from the backup.
      operationId: getRoomKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -903,6 +916,7 @@ paths:
      description: Delete the keys from the backup.
      operationId: deleteRoomKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -973,5 +987,7 @@ components:
        - etag
        - count
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/keys.yaml
+++ b/data/api/client-server/keys.yaml
@ -24,6 +24,7 @@ paths:
      description: Publishes end-to-end encryption keys for the device.
      operationId: uploadKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -116,6 +117,7 @@ paths:
      description: Returns the current devices and identity keys for the given users.
      operationId: queryKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -304,6 +306,7 @@ paths:
        the same key.
      operationId: claimKeys
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -402,6 +405,7 @@ paths:
          identity keys, between `from` and `to`.
      operationId: getKeysChanges
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -472,5 +476,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/kicking.yaml
+++ b/data/api/client-server/kicking.yaml
@ -29,6 +29,7 @@ paths:
        the target member's state by making a request to `/rooms/<room id>/state/m.room.member/<user id>`.
      operationId: kick
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -107,5 +108,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/knocking.yaml
+++ b/data/api/client-server/knocking.yaml
@ -38,6 +38,7 @@ paths:
        [`/sync`](/client-server-api/#get_matrixclientv3sync) API.
      operationId: knockRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -154,5 +155,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/leaving.yaml
+++ b/data/api/client-server/leaving.yaml
@ -44,6 +44,7 @@ paths:
        to see.
      operationId: leaveRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -104,6 +105,7 @@ paths:
        before calling this API.
      operationId: forgetRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -159,5 +161,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/list_joined_rooms.yaml
+++ b/data/api/client-server/list_joined_rooms.yaml
@ -22,6 +22,7 @@ paths:
      description: This API returns a list of the user's current rooms.
      operationId: getJoinedRooms
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -63,5 +64,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/list_public_rooms.yaml
+++ b/data/api/client-server/list_public_rooms.yaml
@ -76,6 +76,7 @@ paths:
        or a server administrator.
      operationId: setRoomVisibilityOnDirectory
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -188,6 +189,7 @@ paths:
        stable order is recommended.
      operationId: queryPublicRooms
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -286,5 +288,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/login_token.yaml
+++ b/data/api/client-server/login_token.yaml
@ -53,6 +53,7 @@ paths:
      operationId: generateLoginToken
      x-addedInMatrixVersion: "1.7"
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -131,5 +132,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/logout.yaml
+++ b/data/api/client-server/logout.yaml
@ -25,6 +25,7 @@ paths:
        [Device keys](/client-server-api/#device-keys) for the device are deleted alongside the device.
      operationId: logout
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -53,6 +54,7 @@ paths:
        this way.
      operationId: logout_all
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -78,5 +80,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/message_pagination.yaml
+++ b/data/api/client-server/message_pagination.yaml
@ -27,6 +27,7 @@ paths:
        [Lazy-loading room members](/client-server-api/#lazy-loading-room-members) for more information.
      operationId: getRoomEvents
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -187,5 +188,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/mutual_rooms.yaml
+++ b/data/api/client-server/mutual_rooms.yaml
@ -25,6 +25,7 @@ paths:
        specified `user_id`.
      operationId: getMutualRooms
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -120,5 +121,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/notifications.yaml
+++ b/data/api/client-server/notifications.yaml
@ -24,6 +24,7 @@ paths:
        user has been, or would have been notified about.
      operationId: getNotifications
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -145,5 +146,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/old_sync.yaml
+++ b/data/api/client-server/old_sync.yaml
@ -29,6 +29,7 @@ paths:
        the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: getEvents
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -99,6 +100,7 @@ paths:
        the [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: initialSync
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -327,6 +329,7 @@ paths:
        or the [/rooms/{roomId}/context/{eventId}](/client-server-api/#get_matrixclientv3roomsroomidcontexteventid) API.
      operationId: getOneEvent
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -370,5 +373,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/openid.yaml
+++ b/data/api/client-server/openid.yaml
@ -30,6 +30,7 @@ paths:
        example.
      operationId: requestOpenIdToken
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -91,5 +92,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/password_management.yaml
+++ b/data/api/client-server/password_management.yaml
@ -40,6 +40,7 @@ paths:
        to determine if this endpoint is available.
      security:
        - {}
+        - accessTokenQuery: []
        - accessTokenBearer: []
      operationId: changePassword
      requestBody:
@ -239,5 +240,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/peeking_events.yaml
+++ b/data/api/client-server/peeking_events.yaml
@ -34,6 +34,7 @@ paths:
        yet known.
      operationId: peekEvents
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -115,5 +116,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/presence.yaml
+++ b/data/api/client-server/presence.yaml
@ -26,6 +26,7 @@ paths:
        presence state of another user.
      operationId: setPresence
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -82,6 +83,7 @@ paths:
      description: Get the given user's presence state.
      operationId: getPresence
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -161,5 +163,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/profile.yaml
+++ b/data/api/client-server/profile.yaml
@ -36,6 +36,7 @@ paths:
        which `keyName`s they are allowed to modify.
      operationId: setProfileField
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -209,6 +210,7 @@ paths:
      description: Remove a specific field from a user's profile.
      operationId: deleteProfileField
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -366,5 +368,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/pusher.yaml
+++ b/data/api/client-server/pusher.yaml
@ -23,6 +23,7 @@ paths:
      description: Gets all currently active pushers for the authenticated user.
      operationId: getPushers
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -136,6 +137,7 @@ paths:
        user is deleted.
      operationId: postPusher
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -295,5 +297,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/pushrules.yaml
+++ b/data/api/client-server/pushrules.yaml
@ -24,6 +24,7 @@ paths:
        defined is `global`.
      operationId: getPushRules
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -50,6 +51,7 @@ paths:
        Retrieve all push rules for this user.
      operationId: getPushRulesGlobal
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -66,6 +68,7 @@ paths:
      description: Retrieve a single specified push rule.
      operationId: getPushRule
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -130,6 +133,7 @@ paths:
      description: This endpoint removes the push rule defined in the path.
      operationId: deletePushRule
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -199,6 +203,7 @@ paths:
        When creating push rules, they MUST be enabled by default.
      operationId: setPushRule
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -328,6 +333,7 @@ paths:
      description: This endpoint gets whether the specified push rule is enabled.
      operationId: isPushRuleEnabled
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -390,6 +396,7 @@ paths:
        push rule.
      operationId: setPushRuleEnabled
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -461,6 +468,7 @@ paths:
      description: This endpoint get the actions for the specified push rule.
      operationId: getPushRuleActions
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -532,6 +540,7 @@ paths:
        This can be used to change the actions of builtin rules.
      operationId: setPushRuleActions
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -618,5 +627,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/read_markers.yaml
+++ b/data/api/client-server/read_markers.yaml
@ -25,6 +25,7 @@ paths:
        the read receipt's location.
      operationId: setReadMarker
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -96,5 +97,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/receipts.yaml
+++ b/data/api/client-server/receipts.yaml
@ -25,6 +25,7 @@ paths:
        specified.
      operationId: postReceipt
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -137,5 +138,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/redaction.yaml
+++ b/data/api/client-server/redaction.yaml
@ -33,6 +33,7 @@ paths:
        Server administrators may redact events sent by users on their server.
      operationId: redactEvent
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -109,5 +110,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/relations.yaml
+++ b/data/api/client-server/relations.yaml
@ -31,6 +31,7 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEvents
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -88,6 +89,7 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEventsWithRelType
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -149,6 +151,7 @@ paths:
        page 1 and a `to` token from page 2 to paginate over the same range, however.
      operationId: getRelatingEventsWithRelTypeAndEventType
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - $ref: '#/components/parameters/roomId'
@ -217,6 +220,8 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
  parameters:
--- a/data/api/client-server/report_content.yaml
+++ b/data/api/client-server/report_content.yaml
@ -59,6 +59,7 @@ paths:
                - reason
        required: true
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        1.18: |
@ -142,6 +143,7 @@ paths:
                  description: The reason the content is being reported.
        required: true
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        1.8: |
@ -226,6 +228,7 @@ paths:
                - reason
        required: true
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -274,5 +277,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_event_by_timestamp.yaml
+++ b/data/api/client-server/room_event_by_timestamp.yaml
@ -46,6 +46,7 @@ paths:
        found in that direction is outside of the expected range.
      operationId: getEventByTimestamp
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -140,5 +141,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_initial_sync.yaml
+++ b/data/api/client-server/room_initial_sync.yaml
@ -17,6 +17,7 @@ paths:
        [migration guide](https://matrix.org/docs/guides/migrating-from-client-server-api-v-1#deprecated-endpoints).
      operationId: roomInitialSync
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -181,5 +182,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_send.yaml
+++ b/data/api/client-server/room_send.yaml
@ -39,6 +39,7 @@ paths:
        the event.
      operationId: sendMessage
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -123,5 +124,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_state.yaml
+++ b/data/api/client-server/room_state.yaml
@ -39,6 +39,7 @@ paths:
        being removed or are already present in the state event.
      operationId: setRoomStateWithKey
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -152,5 +153,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/room_upgrades.yaml
+++ b/data/api/client-server/room_upgrades.yaml
@ -22,6 +22,7 @@ paths:
      description: Upgrades the given room to a particular room version.
      operationId: upgradeRoom
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -123,5 +124,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/rooms.yaml
+++ b/data/api/client-server/rooms.yaml
@ -24,6 +24,7 @@ paths:
        retrieve this event e.g. by being a member in the room for this event.
      operationId: getOneRoomEvent
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -82,6 +83,7 @@ paths:
        taken from the state of the room when they left.
      operationId: getRoomStateWithKey
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -152,6 +154,7 @@ paths:
      description: Get the state events for the current state of a room.
      operationId: getRoomState
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -262,6 +265,7 @@ paths:
              - leave
              - ban
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -314,6 +318,7 @@ paths:
            format: mx-room-id
            pattern: "^!"
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -335,8 +340,7 @@ paths:
                            description: The display name of the user this object is representing.
                          avatar_url:
                            type: string
-                            format: mx-mxc-uri
-                            pattern: "^mxc:\\/\\/"
+                            format: uri
                            description: The avatar of the user this object is representing, as an [`mxc://`
                              URI](/client-server-api/#matrix-content-mxc-uris).
                    description: A map from user ID to a RoomMember object.
@ -370,5 +374,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/search.yaml
+++ b/data/api/client-server/search.yaml
@ -22,6 +22,7 @@ paths:
      description: Performs a full text search across different categories.
      operationId: search
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -237,8 +238,7 @@ paths:
                                              title: Display name
                                            avatar_url:
                                              type: string
-                                              format: mx-mxc-uri
-                                              pattern: "^mxc:\\/\\/"
+                                              format: uri
                                              title: Avatar Url
                                    events_before:
                                      type: array
@ -379,5 +379,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/space_hierarchy.yaml
+++ b/data/api/client-server/space_hierarchy.yaml
@ -30,6 +30,7 @@ paths:
        Invalid child rooms and parent events are not covered by this endpoint.
      operationId: getSpaceHierarchy
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -230,5 +231,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/sync.yaml
+++ b/data/api/client-server/sync.yaml
@ -44,6 +44,7 @@ paths:
        events, alongside other state, when lazy-loading is not enabled.
      operationId: sync
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -685,5 +686,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/tags.yaml
+++ b/data/api/client-server/tags.yaml
@ -23,6 +23,7 @@ paths:
      description: List the tags set by a user on a room.
      operationId: getRoomTags
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -74,6 +75,7 @@ paths:
      description: Add a tag to the room.
      operationId: setRoomTag
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -123,6 +125,7 @@ paths:
      description: Remove a tag from the room.
      operationId: deleteRoomTag
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -174,5 +177,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/third_party_lookup.yaml
+++ b/data/api/client-server/third_party_lookup.yaml
@ -25,6 +25,7 @@ paths:
        required for queries against each protocol.
      operationId: getProtocols
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -100,6 +101,7 @@ paths:
        third-party protocol.
      operationId: getProtocolMetadata
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -143,6 +145,7 @@ paths:
        as reasonably possible given the network type.
      operationId: queryLocationByProtocol
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -189,6 +192,7 @@ paths:
        a set of user parameters.
      operationId: queryUserByProtocol
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -234,6 +238,7 @@ paths:
        alias.
      operationId: queryLocationByAlias
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -269,6 +274,7 @@ paths:
      description: Retrieve an array of third-party users from a Matrix User ID.
      operationId: queryUserByID
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -312,5 +318,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/third_party_membership.yaml
+++ b/data/api/client-server/third_party_membership.yaml
@ -59,6 +59,7 @@ paths:
        - The matrix user ID who invited them to the room
      operationId: inviteBy3PID
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -132,5 +133,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/threads_list.yaml
+++ b/data/api/client-server/threads_list.yaml
@ -27,6 +27,7 @@ paths:
        user has participated in the thread.
      operationId: getThreadRoots
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -160,5 +161,7 @@ servers:
        default: /_matrix/client/v1
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/to_device.yaml
+++ b/data/api/client-server/to_device.yaml
@ -24,6 +24,7 @@ paths:
        client devices.
      operationId: sendToDevice
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -97,5 +98,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/typing.yaml
+++ b/data/api/client-server/typing.yaml
@ -26,6 +26,7 @@ paths:
        user has stopped typing.
      operationId: setTyping
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: path
@ -100,5 +101,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/users.yaml
+++ b/data/api/client-server/users.yaml
@ -39,6 +39,7 @@ paths:
        `Accept-Language` header provided in the request, if present.
      operationId: searchUserDirectory
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -89,8 +90,7 @@ paths:
                          description: The display name of the user, if one exists.
                        avatar_url:
                          type: string
-                          format: mx-mxc-uri
-                          pattern: "^mxc:\\/\\/"
+                          format: uri
                          example: mxc://bar.com/foo
                          description: The avatar url, as an [`mxc://`
                            URI](/client-server-api/#matrix-content-mxc-uris),
@ -132,5 +132,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/versions.yaml
+++ b/data/api/client-server/versions.yaml
@ -45,6 +45,7 @@ paths:
      operationId: getVersions
      security:
        - {}
+        - accessTokenQuery: []
        - accessTokenBearer: []
      x-changedInMatrixVersion:
        "1.10": |
@ -101,5 +102,7 @@ servers:
        default: /_matrix/client
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/voip.yaml
+++ b/data/api/client-server/voip.yaml
@ -24,6 +24,7 @@ paths:
        calls.
      operationId: getTurnServer
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -88,5 +89,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/client-server/wellknown.yaml
+++ b/data/api/client-server/wellknown.yaml
@ -1,5 +1,4 @@
 # Copyright 2018 New Vector Ltd
-# Copyright 2026 Hagen Echzell
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@ -21,11 +20,7 @@ paths:
    get:
      summary: Gets Matrix server discovery information about the domain.
      description: |-
-        Gets discovery information about the domain.
-        {{% added-in v="1.20" %}} Clients SHOULD follow 30x redirects, carefully
-        avoiding redirect loops, and use normal X.509 certificate validation.
-        
-        The file may include
+        Gets discovery information about the domain. The file may include
        additional keys, which MUST follow the Java package naming convention,
        e.g. `com.example.myapp.property`. This ensures property names are
        suitably namespaced for each application and reduces the risk of
--- a/data/api/client-server/whoami.yaml
+++ b/data/api/client-server/whoami.yaml
@ -30,6 +30,7 @@ paths:
        body.
      operationId: getTokenOwner
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -114,5 +115,7 @@ servers:
        default: /_matrix/client/v3
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/definitions/security.yaml
+++ b/data/api/identity/definitions/security.yaml
@ -11,9 +11,18 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+accessTokenQuery:
+  type: apiKey
+  description: |-
+    **Deprecated.** The `access_token` returned by a call to `/register`, as a
+    query parameter.
+  name: access_token
+  in: query
 accessTokenBearer:
  type: http
  description: |-
    The `access_token` returned by a call to `/register`, using the
    `Authorization: Bearer` header.
+    
+    This is the preferred method.
  scheme: bearer
--- a/data/api/identity/v2_associations.yaml
+++ b/data/api/identity/v2_associations.yaml
@ -23,6 +23,7 @@ paths:
      description: Determines if a given 3pid has been validated by a user.
      operationId: getValidated3pidV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -128,6 +129,7 @@ paths:
        deprecated.
      operationId: bindV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -279,6 +281,7 @@ paths:
        homeserver is acting on behalf of a client.
      operationId: unbindV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -383,5 +386,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_auth.yaml
+++ b/data/api/identity/v2_auth.yaml
@ -58,6 +58,7 @@ paths:
        request.
      operationId: getAccount
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -99,6 +100,7 @@ paths:
        future requests to the server.
      operationId: logout
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -150,5 +152,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_email_associations.yaml
+++ b/data/api/identity/v2_email_associations.yaml
@ -40,6 +40,7 @@ paths:
        deprecated.
      operationId: emailRequestTokenV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -107,6 +108,7 @@ paths:
        deprecated.
      operationId: emailSubmitTokenPostV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -198,6 +200,7 @@ paths:
        used by end-users, and so the response should be human-readable.
      operationId: emailSubmitTokenGetV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -260,5 +263,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_invitation_signing.yaml
+++ b/data/api/identity/v2_invitation_signing.yaml
@ -27,6 +27,7 @@ paths:
        to `store-invite`, and fetch the sender of the invite.
      operationId: blindlySignStuffV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -132,5 +133,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_lookup.yaml
+++ b/data/api/identity/v2_lookup.yaml
@ -28,6 +28,7 @@ paths:
        any of the algorithms defined in this specification.
      operationId: getHashDetails
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      responses:
        "200":
@ -70,6 +71,7 @@ paths:
        later in this specification.
      operationId: lookupUsersV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -162,5 +164,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_phone_associations.yaml
+++ b/data/api/identity/v2_phone_associations.yaml
@ -40,6 +40,7 @@ paths:
        deprecated.
      operationId: msisdnRequestTokenV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -109,6 +110,7 @@ paths:
        deprecated.
      operationId: msisdnSubmitTokenPostV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -200,6 +202,7 @@ paths:
        used by end-users, and so the response should be human-readable.
      operationId: msisdnSubmitTokenGetV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      parameters:
        - in: query
@ -261,5 +264,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_store_invite.yaml
+++ b/data/api/identity/v2_store_invite.yaml
@ -51,6 +51,7 @@ paths:
        the `address` of the pending invite for display purposes.
      operationId: storeInviteV2
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -234,5 +235,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/identity/v2_terms.yaml
+++ b/data/api/identity/v2_terms.yaml
@ -118,6 +118,7 @@ paths:
        may not be accepting all terms at once.
      operationId: agreeToTerms
      security:
+        - accessTokenQuery: []
        - accessTokenBearer: []
      requestBody:
        content:
@ -158,5 +159,7 @@ servers:
        default: /_matrix/identity/v2
 components:
  securitySchemes:
+    accessTokenQuery:
+      $ref: definitions/security.yaml#/accessTokenQuery
    accessTokenBearer:
      $ref: definitions/security.yaml#/accessTokenBearer
--- a/data/api/server-server/query.yaml
+++ b/data/api/server-server/query.yaml
@ -172,8 +172,6 @@ paths:
                    example: John Doe
                  avatar_url:
                    type: string
-                    format: mx-mxc-uri
-                    pattern: "^mxc:\\/\\/"
                    description: |-
                      The avatar URL for the user's avatar. MUST either be omitted or set to
                      `null` if the user does not have an avatar set.
--- a/data/event-schemas/schema/m.presence.yaml
+++ b/data/event-schemas/schema/m.presence.yaml
@ -12,8 +12,6 @@
            "properties": {
                "avatar_url": {
                    "type": "string",
-                    "format": "mx-mxc-uri",
-                    "pattern": "^mxc:\\/\\/",
                    "description": "The current avatar URL for this user, if any."
                },
                "displayname": {
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`Clarify that clients must avoid producing ambiguous matrix.to URIs. Contributed by @HarHarLinks.`
				`@ -1 +0,0 @@`
				`Correct some errors in the description of the validation process for incoming Olm-encrypted messages.`
				`@ -1 +0,0 @@`
				Clients are now supposed to follow 30x redirects from `/.well-known/matrix/client` as per [MSC4402](https://github.com/matrix-org/matrix-spec-proposals/pull/4402).
				`@ -1 +0,0 @@`
				`Add further normative language in mutual rooms server behaviour.`
				`@ -1 +0,0 @@`
				`Providing access tokens via query string parameters is no longer supported.`
				`@ -1 +0,0 @@`
				`Use the User ID type in OlmPayload and DeviceKeys.`
				`@ -1 +0,0 @@`
				Improve the format description of `m.room.encrypted` (Olm/Megolm) events.
				`@ -1 +0,0 @@`
				`Wording improvements and spelling fixes. Contributed by @HarHarLinks.`
				`@ -1 +0,0 @@`
				`Rename OlmPayload to OlmPlaintext to avoid confusion with Olm message Payload Bytes.`
				`@ -1 +0,0 @@`
				Use MXC URI type for all user `avatar_url` fields. Contributed by @networkException.