@1claw/openapi-spec 0.24.0 → 0.25.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +6 -2
  2. package/openapi.json +532 -0
  3. package/openapi.yaml +328 -0
  4. package/package.json +1 -1
package/README.md CHANGED
@@ -40,11 +40,15 @@ openapi-generator generate \
40
40
  import spec from "@1claw/openapi-spec/openapi.json";
41
41
  ```
42
42
 
43
- ## What's in the spec (v0.23.2 — API `info.version` 2.13.0)
43
+ ## What's in the spec (v0.25.0 — API `info.version` 2.14.0)
44
44
 
45
45
  - **OIDC Federation (1claw as IdP)** — `GET /.well-known/openid-configuration` (public discovery: issuer, jwks_uri, supported algs `["EdDSA","RS256"]`, supported grant types incl. token-exchange), `GET /.well-known/jwks.json` (public JWKS — every active EdDSA + RS256 key version, keyed by deterministic `kid`), `POST /v1/auth/federated-token` (RFC 8693 token exchange — accepts JSON or `application/x-www-form-urlencoded`; subject token is an agent JWT or `ocv_` API key; returns RS256 JWT scoped to `audience`). Agent fields: `federation_enabled`, `federation_audiences[]`, `federated_token_ttl_seconds`. Designed for Anthropic Workload Identity Federation, GCP STS, AWS STS, etc.
46
46
  - **Auth — agent JWT** — `POST /v1/auth/agent-token` documents optional JWT claim **`shroud_config`** when the agent has Shroud enabled (mirrors DB; consumed by Shroud PolicyEngine on LLM requests). Re-exchange after changing agent Shroud settings. Federation tokens use a separate KMS RSA-2048 key and are signed RS256.
47
47
  - **Auth — password reset** — `POST /v1/auth/forgot-password`, `POST /v1/auth/reset-password` (public; anti-enumeration on forgot)
48
+ - **Auth — set password** — `POST /v1/auth/set-password` (for platform OIDC users who don't have a password yet)
49
+ - **Auth — email change** — `POST /v1/auth/change-email` (request, sends verification code), `POST /v1/auth/verify-email-change` (verify with code)
50
+ - **Auth — passkeys (WebAuthn)** — `POST /v1/auth/passkeys/register/begin`, `POST .../register/complete`, `POST /v1/auth/passkeys/assert/begin`, `POST .../assert/complete`, `GET /v1/auth/passkeys` (list), `DELETE /v1/auth/passkeys/{passkey_id}`
51
+ - **Approvals** — Human-in-the-loop approval workflow: `POST /v1/approvals/request`, `GET /v1/approvals`, `GET /v1/approvals/{id}`, `POST /v1/approvals/{id}/decide`
48
52
  - **Billing — LLM token billing** — `GET /v1/billing/llm-token-billing` (`LlmTokenBillingStatus`: `enabled`, `subscription_status`, optional `credit_balance`, optional `billing_cycle_usage` with `metered_lines[]`), `POST .../subscribe`, `POST .../disable` (Stripe AI Gateway add-on; optional org feature)
49
53
  - **Treasury** — Safe multisig treasuries: `POST/GET /v1/treasury`, `GET/PATCH/DELETE /v1/treasury/{id}`, signers, agent access requests (`requests[]` on list)
50
54
  - **Treasury Wallets** — Multi-chain wallet generation for human users (replaces CDP embedded wallets): `POST /v1/treasury/wallets/generate`, `GET /v1/treasury/wallets`, `GET /v1/treasury/wallets/{chain}`, `POST .../export`, `POST .../rotate`, `DELETE /v1/treasury/wallets/{chain}`. Supported chains: ethereum, bitcoin, solana, xrp, cardano, tron. Private keys stored in per-org `__treasury-keys` vault with tier-appropriate MPC custody.
@@ -58,7 +62,7 @@ import spec from "@1claw/openapi-spec/openapi.json";
58
62
  - **Billing** — Subscriptions, credits, x402, LLM token billing (see above)
59
63
  - **Audit** — Hash-chained event log
60
64
  - **Chains** — Supported blockchain registry
61
- - **Auth** — JWT, API keys, agent tokens, MFA, device flow, Google OAuth, **federated tokens (RFC 8693)**
65
+ - **Auth** — JWT, API keys, agent tokens, MFA, device flow, Google OAuth, **passkeys (WebAuthn)**, **federated tokens (RFC 8693)**
62
66
  - **Platform** — Platform API for building multi-tenant apps on 1Claw: `POST/GET /v1/platform/apps`, `GET/PATCH/DELETE /v1/platform/apps/{id}`, `POST/GET /v1/platform/apps/{id}/templates`, `POST /v1/platform/users/upsert`, `POST /v1/platform/connections/{id}/bootstrap`, `GET /v1/platform/apps/{id}/users`, `GET /v1/platform/apps/{id}/audit`, `GET/DELETE /v1/platform/connected-apps`, `GET /v1/platform/claim/{token}` (preview), `POST /v1/platform/claim/{token}` (redeem). Platform apps authenticate with `plt_` prefixed API keys. Supports OIDC user provisioning, bootstrap templates, and billing models (platform_pays, user_pays, hybrid).
63
67
  - **Org** — List members, invite, update/remove member; `GET /v1/org/agent-keys-vault` (users only, returns __agent-keys vault id or 404)
64
68
 
package/openapi.json CHANGED
@@ -622,6 +622,538 @@
622
622
  }
623
623
  }
624
624
  },
625
+ "/v1/auth/set-password": {
626
+ "post": {
627
+ "tags": [
628
+ "Authentication"
629
+ ],
630
+ "summary": "Set initial password for platform users",
631
+ "description": "Only allowed when the user has no password set (platform_oidc users after claiming).",
632
+ "operationId": "setPassword",
633
+ "requestBody": {
634
+ "required": true,
635
+ "content": {
636
+ "application/json": {
637
+ "schema": {
638
+ "type": "object",
639
+ "required": [
640
+ "password",
641
+ "password_confirm"
642
+ ],
643
+ "properties": {
644
+ "password": {
645
+ "type": "string",
646
+ "minLength": 12
647
+ },
648
+ "password_confirm": {
649
+ "type": "string"
650
+ }
651
+ }
652
+ }
653
+ }
654
+ }
655
+ },
656
+ "responses": {
657
+ "200": {
658
+ "description": "Password set successfully",
659
+ "content": {
660
+ "application/json": {
661
+ "schema": {
662
+ "type": "object",
663
+ "properties": {
664
+ "message": {
665
+ "type": "string"
666
+ }
667
+ }
668
+ }
669
+ }
670
+ }
671
+ },
672
+ "400": {
673
+ "$ref": "#/components/responses/BadRequest"
674
+ }
675
+ }
676
+ }
677
+ },
678
+ "/v1/auth/change-email": {
679
+ "post": {
680
+ "tags": [
681
+ "Authentication"
682
+ ],
683
+ "summary": "Request email change",
684
+ "description": "Sends a 6-digit verification code to the new email address. Code expires in 10 minutes.",
685
+ "operationId": "changeEmail",
686
+ "requestBody": {
687
+ "required": true,
688
+ "content": {
689
+ "application/json": {
690
+ "schema": {
691
+ "type": "object",
692
+ "required": [
693
+ "new_email"
694
+ ],
695
+ "properties": {
696
+ "new_email": {
697
+ "type": "string",
698
+ "format": "email"
699
+ }
700
+ }
701
+ }
702
+ }
703
+ }
704
+ },
705
+ "responses": {
706
+ "200": {
707
+ "description": "Verification code sent",
708
+ "content": {
709
+ "application/json": {
710
+ "schema": {
711
+ "type": "object",
712
+ "properties": {
713
+ "message": {
714
+ "type": "string"
715
+ },
716
+ "new_email": {
717
+ "type": "string"
718
+ },
719
+ "expires_in_seconds": {
720
+ "type": "integer"
721
+ }
722
+ }
723
+ }
724
+ }
725
+ }
726
+ },
727
+ "400": {
728
+ "$ref": "#/components/responses/BadRequest"
729
+ },
730
+ "409": {
731
+ "description": "Email already in use"
732
+ }
733
+ }
734
+ }
735
+ },
736
+ "/v1/auth/verify-email-change": {
737
+ "post": {
738
+ "tags": [
739
+ "Authentication"
740
+ ],
741
+ "summary": "Verify email change with code",
742
+ "operationId": "verifyEmailChange",
743
+ "requestBody": {
744
+ "required": true,
745
+ "content": {
746
+ "application/json": {
747
+ "schema": {
748
+ "type": "object",
749
+ "required": [
750
+ "code"
751
+ ],
752
+ "properties": {
753
+ "code": {
754
+ "type": "string"
755
+ }
756
+ }
757
+ }
758
+ }
759
+ }
760
+ },
761
+ "responses": {
762
+ "200": {
763
+ "description": "Email updated",
764
+ "content": {
765
+ "application/json": {
766
+ "schema": {
767
+ "type": "object",
768
+ "properties": {
769
+ "message": {
770
+ "type": "string"
771
+ },
772
+ "email": {
773
+ "type": "string"
774
+ }
775
+ }
776
+ }
777
+ }
778
+ }
779
+ },
780
+ "400": {
781
+ "$ref": "#/components/responses/BadRequest"
782
+ }
783
+ }
784
+ }
785
+ },
786
+ "/v1/auth/passkeys/register/begin": {
787
+ "post": {
788
+ "tags": [
789
+ "Authentication"
790
+ ],
791
+ "summary": "Begin passkey registration",
792
+ "description": "Returns a WebAuthn challenge for creating a new passkey credential.",
793
+ "operationId": "passkeyRegisterBegin",
794
+ "responses": {
795
+ "200": {
796
+ "description": "Registration options",
797
+ "content": {
798
+ "application/json": {
799
+ "schema": {
800
+ "type": "object",
801
+ "properties": {
802
+ "challenge": {
803
+ "type": "string"
804
+ },
805
+ "rp_id": {
806
+ "type": "string"
807
+ },
808
+ "rp_name": {
809
+ "type": "string"
810
+ },
811
+ "user_id": {
812
+ "type": "string"
813
+ },
814
+ "user_name": {
815
+ "type": "string"
816
+ },
817
+ "user_display_name": {
818
+ "type": "string"
819
+ },
820
+ "attestation": {
821
+ "type": "string"
822
+ },
823
+ "authenticator_selection": {
824
+ "type": "object"
825
+ }
826
+ }
827
+ }
828
+ }
829
+ }
830
+ }
831
+ }
832
+ }
833
+ },
834
+ "/v1/auth/passkeys/register/complete": {
835
+ "post": {
836
+ "tags": [
837
+ "Authentication"
838
+ ],
839
+ "summary": "Complete passkey registration",
840
+ "operationId": "passkeyRegisterComplete",
841
+ "requestBody": {
842
+ "required": true,
843
+ "content": {
844
+ "application/json": {
845
+ "schema": {
846
+ "type": "object",
847
+ "required": [
848
+ "credential_id",
849
+ "attestation_object",
850
+ "client_data_json"
851
+ ],
852
+ "properties": {
853
+ "credential_id": {
854
+ "type": "string"
855
+ },
856
+ "attestation_object": {
857
+ "type": "string"
858
+ },
859
+ "client_data_json": {
860
+ "type": "string"
861
+ },
862
+ "transports": {
863
+ "type": "array",
864
+ "items": {
865
+ "type": "string"
866
+ }
867
+ },
868
+ "name": {
869
+ "type": "string"
870
+ }
871
+ }
872
+ }
873
+ }
874
+ }
875
+ },
876
+ "responses": {
877
+ "201": {
878
+ "description": "Passkey registered",
879
+ "content": {
880
+ "application/json": {
881
+ "schema": {
882
+ "type": "object",
883
+ "properties": {
884
+ "passkey_id": {
885
+ "type": "string",
886
+ "format": "uuid"
887
+ },
888
+ "credential_id": {
889
+ "type": "string"
890
+ }
891
+ }
892
+ }
893
+ }
894
+ }
895
+ }
896
+ }
897
+ }
898
+ },
899
+ "/v1/auth/passkeys/assert/begin": {
900
+ "post": {
901
+ "tags": [
902
+ "Authentication"
903
+ ],
904
+ "summary": "Begin passkey authentication",
905
+ "operationId": "passkeyAssertBegin",
906
+ "security": [],
907
+ "requestBody": {
908
+ "required": true,
909
+ "content": {
910
+ "application/json": {
911
+ "schema": {
912
+ "type": "object",
913
+ "properties": {
914
+ "email": {
915
+ "type": "string",
916
+ "format": "email"
917
+ }
918
+ }
919
+ }
920
+ }
921
+ }
922
+ },
923
+ "responses": {
924
+ "200": {
925
+ "description": "Assertion options",
926
+ "content": {
927
+ "application/json": {
928
+ "schema": {
929
+ "type": "object",
930
+ "properties": {
931
+ "challenge": {
932
+ "type": "string"
933
+ },
934
+ "rp_id": {
935
+ "type": "string"
936
+ },
937
+ "timeout": {
938
+ "type": "integer"
939
+ },
940
+ "user_verification": {
941
+ "type": "string"
942
+ },
943
+ "allow_credentials": {
944
+ "type": "array",
945
+ "items": {
946
+ "type": "object"
947
+ }
948
+ }
949
+ }
950
+ }
951
+ }
952
+ }
953
+ }
954
+ }
955
+ }
956
+ },
957
+ "/v1/auth/passkeys/assert/complete": {
958
+ "post": {
959
+ "tags": [
960
+ "Authentication"
961
+ ],
962
+ "summary": "Complete passkey authentication",
963
+ "operationId": "passkeyAssertComplete",
964
+ "security": [],
965
+ "requestBody": {
966
+ "required": true,
967
+ "content": {
968
+ "application/json": {
969
+ "schema": {
970
+ "type": "object",
971
+ "required": [
972
+ "credential_id",
973
+ "authenticator_data",
974
+ "client_data_json",
975
+ "signature"
976
+ ],
977
+ "properties": {
978
+ "credential_id": {
979
+ "type": "string"
980
+ },
981
+ "authenticator_data": {
982
+ "type": "string"
983
+ },
984
+ "client_data_json": {
985
+ "type": "string"
986
+ },
987
+ "signature": {
988
+ "type": "string"
989
+ }
990
+ }
991
+ }
992
+ }
993
+ }
994
+ },
995
+ "responses": {
996
+ "200": {
997
+ "description": "Authentication successful",
998
+ "content": {
999
+ "application/json": {
1000
+ "schema": {
1001
+ "type": "object",
1002
+ "properties": {
1003
+ "token": {
1004
+ "type": "string"
1005
+ },
1006
+ "refresh_token": {
1007
+ "type": "string"
1008
+ },
1009
+ "user": {
1010
+ "type": "object"
1011
+ }
1012
+ }
1013
+ }
1014
+ }
1015
+ }
1016
+ }
1017
+ }
1018
+ }
1019
+ },
1020
+ "/v1/auth/passkeys": {
1021
+ "get": {
1022
+ "tags": [
1023
+ "Authentication"
1024
+ ],
1025
+ "summary": "List registered passkeys",
1026
+ "operationId": "listPasskeys",
1027
+ "responses": {
1028
+ "200": {
1029
+ "description": "List of passkeys",
1030
+ "content": {
1031
+ "application/json": {
1032
+ "schema": {
1033
+ "type": "object",
1034
+ "properties": {
1035
+ "passkeys": {
1036
+ "type": "array",
1037
+ "items": {
1038
+ "type": "object",
1039
+ "properties": {
1040
+ "id": {
1041
+ "type": "string",
1042
+ "format": "uuid"
1043
+ },
1044
+ "credential_id": {
1045
+ "type": "string"
1046
+ },
1047
+ "name": {
1048
+ "type": "string"
1049
+ },
1050
+ "last_used_at": {
1051
+ "type": "string"
1052
+ },
1053
+ "created_at": {
1054
+ "type": "string"
1055
+ }
1056
+ }
1057
+ }
1058
+ }
1059
+ }
1060
+ }
1061
+ }
1062
+ }
1063
+ }
1064
+ }
1065
+ }
1066
+ },
1067
+ "/v1/auth/passkeys/{passkey_id}": {
1068
+ "delete": {
1069
+ "tags": [
1070
+ "Authentication"
1071
+ ],
1072
+ "summary": "Delete a passkey",
1073
+ "operationId": "deletePasskey",
1074
+ "parameters": [
1075
+ {
1076
+ "name": "passkey_id",
1077
+ "in": "path",
1078
+ "required": true,
1079
+ "schema": {
1080
+ "type": "string",
1081
+ "format": "uuid"
1082
+ }
1083
+ }
1084
+ ],
1085
+ "responses": {
1086
+ "200": {
1087
+ "description": "Passkey deleted"
1088
+ }
1089
+ }
1090
+ }
1091
+ },
1092
+ "/v1/approvals/request": {
1093
+ "post": {
1094
+ "tags": [
1095
+ "Approvals"
1096
+ ],
1097
+ "summary": "Request human approval (agent-only)",
1098
+ "description": "Agents can request policy changes or other sensitive actions that require human approval.",
1099
+ "operationId": "requestApproval",
1100
+ "requestBody": {
1101
+ "required": true,
1102
+ "content": {
1103
+ "application/json": {
1104
+ "schema": {
1105
+ "type": "object",
1106
+ "required": [
1107
+ "action",
1108
+ "target_type",
1109
+ "target_id",
1110
+ "summary"
1111
+ ],
1112
+ "properties": {
1113
+ "action": {
1114
+ "type": "string",
1115
+ "description": "Type of action (e.g. policy_change)"
1116
+ },
1117
+ "target_type": {
1118
+ "type": "string"
1119
+ },
1120
+ "target_id": {
1121
+ "type": "string"
1122
+ },
1123
+ "summary": {
1124
+ "type": "object",
1125
+ "description": "JSON payload describing the request"
1126
+ },
1127
+ "reason": {
1128
+ "type": "string"
1129
+ },
1130
+ "risk_tier": {
1131
+ "type": "integer",
1132
+ "minimum": 1,
1133
+ "maximum": 5
1134
+ }
1135
+ }
1136
+ }
1137
+ }
1138
+ }
1139
+ },
1140
+ "responses": {
1141
+ "202": {
1142
+ "description": "Approval request created",
1143
+ "content": {
1144
+ "application/json": {
1145
+ "schema": {
1146
+ "$ref": "#/components/schemas/ApprovalResponse"
1147
+ }
1148
+ }
1149
+ }
1150
+ },
1151
+ "403": {
1152
+ "$ref": "#/components/responses/Forbidden"
1153
+ }
1154
+ }
1155
+ }
1156
+ },
625
1157
  "/v1/auth/me": {
626
1158
  "get": {
627
1159
  "tags": [
package/openapi.yaml CHANGED
@@ -448,6 +448,334 @@ paths:
448
448
  "400":
449
449
  $ref: "#/components/responses/BadRequest"
450
450
 
451
+ /v1/auth/set-password:
452
+ post:
453
+ tags: [Authentication]
454
+ summary: Set initial password for platform users
455
+ description: Only allowed when the user has no password set (platform_oidc users after claiming).
456
+ operationId: setPassword
457
+ requestBody:
458
+ required: true
459
+ content:
460
+ application/json:
461
+ schema:
462
+ type: object
463
+ required: [password, password_confirm]
464
+ properties:
465
+ password:
466
+ type: string
467
+ minLength: 12
468
+ password_confirm:
469
+ type: string
470
+ responses:
471
+ "200":
472
+ description: Password set successfully
473
+ content:
474
+ application/json:
475
+ schema:
476
+ type: object
477
+ properties:
478
+ message:
479
+ type: string
480
+ "400":
481
+ $ref: "#/components/responses/BadRequest"
482
+
483
+ /v1/auth/change-email:
484
+ post:
485
+ tags: [Authentication]
486
+ summary: Request email change
487
+ description: Sends a 6-digit verification code to the new email address. Code expires in 10 minutes.
488
+ operationId: changeEmail
489
+ requestBody:
490
+ required: true
491
+ content:
492
+ application/json:
493
+ schema:
494
+ type: object
495
+ required: [new_email]
496
+ properties:
497
+ new_email:
498
+ type: string
499
+ format: email
500
+ responses:
501
+ "200":
502
+ description: Verification code sent
503
+ content:
504
+ application/json:
505
+ schema:
506
+ type: object
507
+ properties:
508
+ message:
509
+ type: string
510
+ new_email:
511
+ type: string
512
+ expires_in_seconds:
513
+ type: integer
514
+ "400":
515
+ $ref: "#/components/responses/BadRequest"
516
+ "409":
517
+ description: Email already in use
518
+
519
+ /v1/auth/verify-email-change:
520
+ post:
521
+ tags: [Authentication]
522
+ summary: Verify email change with code
523
+ operationId: verifyEmailChange
524
+ requestBody:
525
+ required: true
526
+ content:
527
+ application/json:
528
+ schema:
529
+ type: object
530
+ required: [code]
531
+ properties:
532
+ code:
533
+ type: string
534
+ responses:
535
+ "200":
536
+ description: Email updated
537
+ content:
538
+ application/json:
539
+ schema:
540
+ type: object
541
+ properties:
542
+ message:
543
+ type: string
544
+ email:
545
+ type: string
546
+ "400":
547
+ $ref: "#/components/responses/BadRequest"
548
+
549
+ /v1/auth/passkeys/register/begin:
550
+ post:
551
+ tags: [Authentication]
552
+ summary: Begin passkey registration
553
+ description: Returns a WebAuthn challenge for creating a new passkey credential.
554
+ operationId: passkeyRegisterBegin
555
+ responses:
556
+ "200":
557
+ description: Registration options
558
+ content:
559
+ application/json:
560
+ schema:
561
+ type: object
562
+ properties:
563
+ challenge:
564
+ type: string
565
+ rp_id:
566
+ type: string
567
+ rp_name:
568
+ type: string
569
+ user_id:
570
+ type: string
571
+ user_name:
572
+ type: string
573
+ user_display_name:
574
+ type: string
575
+ attestation:
576
+ type: string
577
+ authenticator_selection:
578
+ type: object
579
+
580
+ /v1/auth/passkeys/register/complete:
581
+ post:
582
+ tags: [Authentication]
583
+ summary: Complete passkey registration
584
+ operationId: passkeyRegisterComplete
585
+ requestBody:
586
+ required: true
587
+ content:
588
+ application/json:
589
+ schema:
590
+ type: object
591
+ required: [credential_id, attestation_object, client_data_json]
592
+ properties:
593
+ credential_id:
594
+ type: string
595
+ attestation_object:
596
+ type: string
597
+ client_data_json:
598
+ type: string
599
+ transports:
600
+ type: array
601
+ items:
602
+ type: string
603
+ name:
604
+ type: string
605
+ responses:
606
+ "201":
607
+ description: Passkey registered
608
+ content:
609
+ application/json:
610
+ schema:
611
+ type: object
612
+ properties:
613
+ passkey_id:
614
+ type: string
615
+ format: uuid
616
+ credential_id:
617
+ type: string
618
+
619
+ /v1/auth/passkeys/assert/begin:
620
+ post:
621
+ tags: [Authentication]
622
+ summary: Begin passkey authentication
623
+ operationId: passkeyAssertBegin
624
+ security: []
625
+ requestBody:
626
+ required: true
627
+ content:
628
+ application/json:
629
+ schema:
630
+ type: object
631
+ properties:
632
+ email:
633
+ type: string
634
+ format: email
635
+ responses:
636
+ "200":
637
+ description: Assertion options
638
+ content:
639
+ application/json:
640
+ schema:
641
+ type: object
642
+ properties:
643
+ challenge:
644
+ type: string
645
+ rp_id:
646
+ type: string
647
+ timeout:
648
+ type: integer
649
+ user_verification:
650
+ type: string
651
+ allow_credentials:
652
+ type: array
653
+ items:
654
+ type: object
655
+
656
+ /v1/auth/passkeys/assert/complete:
657
+ post:
658
+ tags: [Authentication]
659
+ summary: Complete passkey authentication
660
+ operationId: passkeyAssertComplete
661
+ security: []
662
+ requestBody:
663
+ required: true
664
+ content:
665
+ application/json:
666
+ schema:
667
+ type: object
668
+ required: [credential_id, authenticator_data, client_data_json, signature]
669
+ properties:
670
+ credential_id:
671
+ type: string
672
+ authenticator_data:
673
+ type: string
674
+ client_data_json:
675
+ type: string
676
+ signature:
677
+ type: string
678
+ responses:
679
+ "200":
680
+ description: Authentication successful
681
+ content:
682
+ application/json:
683
+ schema:
684
+ type: object
685
+ properties:
686
+ token:
687
+ type: string
688
+ refresh_token:
689
+ type: string
690
+ user:
691
+ type: object
692
+
693
+ /v1/auth/passkeys:
694
+ get:
695
+ tags: [Authentication]
696
+ summary: List registered passkeys
697
+ operationId: listPasskeys
698
+ responses:
699
+ "200":
700
+ description: List of passkeys
701
+ content:
702
+ application/json:
703
+ schema:
704
+ type: object
705
+ properties:
706
+ passkeys:
707
+ type: array
708
+ items:
709
+ type: object
710
+ properties:
711
+ id:
712
+ type: string
713
+ format: uuid
714
+ credential_id:
715
+ type: string
716
+ name:
717
+ type: string
718
+ last_used_at:
719
+ type: string
720
+ created_at:
721
+ type: string
722
+
723
+ /v1/auth/passkeys/{passkey_id}:
724
+ delete:
725
+ tags: [Authentication]
726
+ summary: Delete a passkey
727
+ operationId: deletePasskey
728
+ parameters:
729
+ - name: passkey_id
730
+ in: path
731
+ required: true
732
+ schema:
733
+ type: string
734
+ format: uuid
735
+ responses:
736
+ "200":
737
+ description: Passkey deleted
738
+
739
+ /v1/approvals/request:
740
+ post:
741
+ tags: [Approvals]
742
+ summary: Request human approval (agent-only)
743
+ description: Agents can request policy changes or other sensitive actions that require human approval.
744
+ operationId: requestApproval
745
+ requestBody:
746
+ required: true
747
+ content:
748
+ application/json:
749
+ schema:
750
+ type: object
751
+ required: [action, target_type, target_id, summary]
752
+ properties:
753
+ action:
754
+ type: string
755
+ description: "Type of action (e.g. policy_change)"
756
+ target_type:
757
+ type: string
758
+ target_id:
759
+ type: string
760
+ summary:
761
+ type: object
762
+ description: "JSON payload describing the request"
763
+ reason:
764
+ type: string
765
+ risk_tier:
766
+ type: integer
767
+ minimum: 1
768
+ maximum: 5
769
+ responses:
770
+ "202":
771
+ description: Approval request created
772
+ content:
773
+ application/json:
774
+ schema:
775
+ $ref: "#/components/schemas/ApprovalResponse"
776
+ "403":
777
+ $ref: "#/components/responses/Forbidden"
778
+
451
779
  /v1/auth/me:
452
780
  get:
453
781
  tags: [Authentication]
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@1claw/openapi-spec",
3
- "version": "0.24.0",
3
+ "version": "0.25.0",
4
4
  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
5
5
  "license": "MIT",
6
6
  "repository": {