Moderation and rights

A bot can moderate a group only with the rights an admin granted it, never against the room's owner, admins or other bots, and every action leaves a trace.

Rights#

Right	Groups	Channels	Default when added	Allows
`can_send`	yes	—	on	Sending text; a caption on media needs it too.
`can_send_media`	yes	yes	on	Sending photos, videos, documents.
`can_post`	—	yes	on	Posting in a channel.
`can_edit_posts`	—	yes	off	Editing others' posts. Own posts are always editable.
`can_read_all`	public groups only	—	off	Receiving every message, if the bot's privacy mode is off too. Shown in red.
`can_delete_messages`	yes	—	off	Deleting others' messages up to 48 hours old.
`can_restrict_members`	yes	—	off	Muting and unmuting.
`can_ban_members`	yes	—	off	Banning and unbanning.
`can_pin`	yes	—	off	Pinning and unpinning.
`can_invite`	yes	yes	off	Creating and revoking the bot's own invite links.
`can_change_info`	Reserved. No v1 method changes a room's details, so it cannot be granted.

Moderation of members exists only in groups: channels have no member moderation, and every channel post is by an admin or a bot. An admin who adds the bot sees the rights it asks for (setMyDefaultAdministratorRights) pre-filled, and decides. Your bot learns its rights from my_chat_member.rights whenever they change.

When a bot changes owners, every grant loses can_read_all, can_delete_messages, can_restrict_members, can_ban_members, can_pin and can_invite until an admin grants them again: those were trusted to the previous owner.

Methods#

Method	Right	Notes
`deleteMessage`	`can_delete_messages` (others' messages)	Groups; ≤ 48 hours; the app's “delete for everyone”, attachments included.
`banChatMember` / `unbanChatMember`	`can_ban_members`	The app's own ban. Unban makes the person a member again (unlike Telegram).
`restrictChatMember`	`can_restrict_members`	Mute (for good or until a time) or lift with `permissions: {"can_send_messages": true}`.
`pinChatMessage` / `unpinChatMessage`	`can_pin`	Up to 3 pinned messages per group.
`createChatInviteLink` / `revokeChatInviteLink`	`can_invite`	The bot's own links, with optional expiry and member limit. Groups and channels.
`getChatMember`, `getChatAdministrators`, `getChatMemberCount`	none	Reads, allowed while restricted. Channels: only the owner and admins are shown.

Who is protected#

A bot never acts against: the group's creator, anyone whose role is owner or admin (banned or not — an unban would hand the role back), or another bot; nor deletes a message of any of them. These answer 403 target_protected. A user_id that is not, or no longer, in the group answers 404 user_not_found.

Repeating an action that is already in effect — banning a banned member, muting a muted one, pinning a pinned message — answers true and changes nothing.

Checks run under the group's lock, so an admin's concurrent change to the bot's rights, or its removal, wins if it came first.

Lines and the audit log#

Every action that changed something is written to the bot's audit log (action, right used, target, reason, request id), which Qivuna keeps for 180 days for review by the Qivuna team.
The room sees a line, for example “🤖 @guard_bot muted Avi · spam”. The reason appears in the line only if the bot could post text in that room itself; it is always in the audit log. Lines are limited: one per bot, room, target and action per 10 minutes, and at most one “deleted a message” line per bot and room per 10 minutes. An unban or unmute writes a line only when it ends a ban or mute that a bot made.
Reasons are at most 200 characters and pass the content rules.

Limits#

Moderation calls (bans, mutes, deletes of others' messages, pins, invite links) are limited to 30 per bot per room per minute, on top of the bot's overall API limit.

Seeing joins and leaves#

To follow membership, add chat_member to allowed_updates. It is delivered in groups where the bot reads all messages or holds can_restrict_members or can_ban_members, for joins, leaves, removals, bans, unbans, mutes and unmutes — including those your bot made and timed mutes ending. from is whoever made the change when known; it is absent for departures made in the app.

Encrypted groups#

In an end-to-end encrypted group nothing of this is possible: moderation, member reads and media answer 403 e2ee_unsupported. Bots there work only in addressed mode.