> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oximail.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> The terms this documentation uses precisely: organization vs tenant, principal, capability, blob, state string, grant, erasure vocabulary, and the rest.

Terms this documentation uses with a precise meaning. Alphabetical.

**Account** — a mailbox-holding identity that can authenticate (or, for a *shared account*, be reached through grants). An account belongs to exactly one organization.

**Blob** — an immutable piece of binary content (a raw message, an attachment, a file), stored content-addressed by the SHA-256 of its cleartext and encrypted at rest. Referenced by `blobId` over JMAP.

**Capability** — a JMAP feature family, identified by a URN (`urn:ietf:params:jmap:mail`, `urn:oximail:params:jmap:v2:labels`, …). A client opts in per request via `using`; the session object advertises per-account capability objects with their limits.

**Change log** — the per-account history behind `/changes`-style delta sync (and DAV `sync-collection`). Retained 90 days; a sync mechanism, not an audit trail.

**Crypto-erasure** — making content permanently unreadable by destroying its encryption keys rather than overwriting the ciphertext. How account deletion erases blobs at any scale.

**DSAR** — Data Subject Access Request; here specifically an erasure request whose ticket reference can be stamped on the [erasure job](../operator/compliance) and later resolved to the durable completion record.

**Erasure (phase machine)** — account deletion as a durable, resumable sequence: `enqueued → agency-frozen → residue-redacted → identity-stripped → data-swept → completed`.

**Fail loud** — the project's first rule: an error surfaces as an explicit error (log + typed failure), never as silently dropped data or a default that masks it.

**Grant** — an entry in a collection's `shareWith` map: principal id → rights (`mayRead`, `mayWrite`, `mayAdmin`, …). The uniform sharing mechanism of every collection type.

**Journaling** — silently copying matching mail flows to a journal mailbox or external archiver, per organization, for record-keeping duties. Off by default.

**Keyword** — a per-message JMAP flag (`$seen`, `$flagged`, `$junk`, custom). The same state as IMAP flags. Distinct from **Labels**, which are first-class shareable objects (v2).

**Legacy (protocols)** — the IMAP / CalDAV / CardDAV / ManageSieve bridges: translation layers over the JMAP data model, feature-gated by `[legacy]`.

**Organization** — the isolation unit: accounts, domains, keys, quotas, and policy live per organization. Called a **tenant** in the storage model and in configuration keys (`tenant_id`, `--tenant`); the two words name the same thing at different layers.

**Principal** — a directory entry (RFC 9670): an `individual`, `group`, `resource` (meeting room), `location`, or `other` (non-loginnable technical identity). Grants are keyed by principal id, not by email.

**Projection** — the usage domain a blob is referenced by (mail, files, avatar). The at-rest decryptor refuses cross-projection reads for delegated access — a crypto-layer backstop under the ACLs.

**Reversal buffer** — the encrypted, TTL-bounded capture of share grants stripped by an erasure, enabling `oximail erasure undo` as the honest operator-error recovery.

**Role (account)** — `admin`, `member`, `restricted`, `readonly`, or `disabled`; plus `service` for relay accounts. Distinct from **role (mailbox)** — `inbox`, `sent`, `trash`, … per RFC 8621.

**Session (JMAP)** — the authenticated discovery object at `/.well-known/jmap`: accounts, capabilities, endpoint URLs, state.

**Shared account** — a non-loginnable team identity (`team@…`) owning a mailbox and resources; humans reach it through grants; its principal is `type: "other"`; its drive has a **custodian**.

**`shared:` indirection** — addressing another account's granted data by putting the granted account id in the standard `accountId` slot; capabilities resolve on the caller, data on the owner.

**Smarthost / relay** — an SMTP server that forwards outbound mail for others: OxiMail can send *through* one (leaf) or *be* one (relay accounts with DNS-proven domains).

**State string** — the opaque per-collection version JMAP uses for delta sync (`/changes`) and optimistic concurrency (`ifInState` → `stateMismatch`).

**Tenant** — see **Organization**.

**Tombstone (principal)** — the PII-scrubbed remnant of an erased person's principal, kept as a graph anchor so history is not misattributed; refused as a new grantee.