blobId over JMAP.
Capability — a JMAP feature family, identified by a URN (urn:ietf:params:jmap:mail, urn:oximail:params:jmap:v2:labels, …). A client opts in per request via using; the session object advertises per-account capability objects with their limits.
Change log — the per-account history behind /changes-style delta sync (and DAV sync-collection). Retained 90 days; a sync mechanism, not an audit trail.
Crypto-erasure — making content permanently unreadable by destroying its encryption keys rather than overwriting the ciphertext. How account deletion erases blobs at any scale.
DSAR — Data Subject Access Request; here specifically an erasure request whose ticket reference can be stamped on the erasure job and later resolved to the durable completion record.
Erasure (phase machine) — account deletion as a durable, resumable sequence: enqueued → agency-frozen → residue-redacted → identity-stripped → data-swept → completed.
Fail loud — the project’s first rule: an error surfaces as an explicit error (log + typed failure), never as silently dropped data or a default that masks it.
Grant — an entry in a collection’s shareWith map: principal id → rights (mayRead, mayWrite, mayAdmin, …). The uniform sharing mechanism of every collection type.
Journaling — silently copying matching mail flows to a journal mailbox or external archiver, per organization, for record-keeping duties. Off by default.
Keyword — a per-message JMAP flag ($seen, $flagged, $junk, custom). The same state as IMAP flags. Distinct from Labels, which are first-class shareable objects (v2).
Legacy (protocols) — the IMAP / CalDAV / CardDAV / ManageSieve bridges: translation layers over the JMAP data model, feature-gated by [legacy].
Organization — the isolation unit: accounts, domains, keys, quotas, and policy live per organization. Called a tenant in the storage model and in configuration keys (tenant_id, --tenant); the two words name the same thing at different layers.
Principal — a directory entry (RFC 9670): an individual, group, resource (meeting room), location, or other (non-loginnable technical identity). Grants are keyed by principal id, not by email.
Projection — the usage domain a blob is referenced by (mail, files, avatar). The at-rest decryptor refuses cross-projection reads for delegated access — a crypto-layer backstop under the ACLs.
Reversal buffer — the encrypted, TTL-bounded capture of share grants stripped by an erasure, enabling oximail erasure undo as the honest operator-error recovery.
Role (account) — admin, member, restricted, readonly, or disabled; plus service for relay accounts. Distinct from role (mailbox) — inbox, sent, trash, … per RFC 8621.
Session (JMAP) — the authenticated discovery object at /.well-known/jmap: accounts, capabilities, endpoint URLs, state.
Shared account — a non-loginnable team identity (team@…) owning a mailbox and resources; humans reach it through grants; its principal is type: "other"; its drive has a custodian.
shared: indirection — addressing another account’s granted data by putting the granted account id in the standard accountId slot; capabilities resolve on the caller, data on the owner.
Smarthost / relay — an SMTP server that forwards outbound mail for others: OxiMail can send through one (leaf) or be one (relay accounts with DNS-proven domains).
State string — the opaque per-collection version JMAP uses for delta sync (/changes) and optimistic concurrency (ifInState → stateMismatch).
Tenant — see Organization.
Tombstone (principal) — the PII-scrubbed remnant of an erased person’s principal, kept as a graph anchor so history is not misattributed; refused as a new grantee.