@1claw/openapi-spec 0.25.0 → 0.27.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "2.14.0",
+    "version": "2.15.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -6165,6 +6165,77 @@
         }
       }
     },
+    "/v1/platform/apps/{appId}/rotate-key": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Rotate platform API key",
+        "description": "Generate a new API key for the platform app. The old key is immediately invalidated. Returns the new key (one-time).",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "appId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "api_key_expires_at": {
+                    "type": "string",
+                    "format": "date-time",
+                    "nullable": true,
+                    "description": "Optional expiration for the new key."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "New key generated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "api_key": {
+                      "type": "string",
+                      "description": "The new API key (shown once)"
+                    },
+                    "api_key_prefix": {
+                      "type": "string"
+                    },
+                    "api_key_expires_at": {
+                      "type": "string",
+                      "format": "date-time",
+                      "nullable": true
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Only human users can rotate platform keys"
+          }
+        }
+      }
+    },
     "/v1/platform/apps/{appId}/templates": {
       "post": {
         "tags": [
@@ -6382,6 +6453,81 @@
         }
       }
     },
+    "/v1/platform/connections/{connectionId}/reissue-claim": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Reissue a claim URL",
+        "description": "Mints a fresh 10-minute claim token for an already-bootstrapped connection without re-provisioning resources. Use when the original claim URL has expired.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "return_to": {
+                    "type": "string",
+                    "description": "Optional redirect URL after claim"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "New claim URL issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "claim_url": {
+                      "type": "string"
+                    },
+                    "claim_token": {
+                      "type": "string"
+                    },
+                    "expires_in": {
+                      "type": "integer",
+                      "description": "Seconds until expiry (600 = 10 min)"
+                    },
+                    "connection_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Connection not yet bootstrapped"
+          },
+          "404": {
+            "description": "Connection not found"
+          }
+        }
+      }
+    },
     "/v1/platform/apps/{appId}/audit": {
       "get": {
         "tags": [
@@ -8132,6 +8278,12 @@
           },
           "shroud_config": {
             "$ref": "#/components/schemas/ShroudConfig"
+          },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the agent's API key."
           }
         }
       },
@@ -8211,6 +8363,12 @@
             "maximum": 3600,
             "nullable": true,
             "description": "Per-agent TTL override for federation tokens (seconds). NULL falls\nback to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).\nHard-capped at 3600 seconds.\n"
+          },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the agent's API key. Set to null to clear."
           }
         }
       },
@@ -8359,6 +8517,12 @@
             "type": "boolean",
             "description": "Whether EIP-191 personal_sign is enabled."
           },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the agent's API key."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -11311,6 +11475,12 @@
           "max_connected_users": {
             "type": "integer",
             "nullable": true
+          },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the platform API key."
           }
         }
       },
@@ -11367,6 +11537,12 @@
           },
           "is_active": {
             "type": "boolean"
+          },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the platform API key. Set to null to clear."
           }
         }
       },
@@ -11432,6 +11608,18 @@
           "connected_users": {
             "type": "integer"
           },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "When the platform API key expires."
+          },
+          "api_key_rotated_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "When the platform API key was last rotated."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: 2.14.0
+    version: 2.15.0
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -4006,6 +4006,51 @@ paths:
                 "403":
                     description: Only human users can delete platform apps
 
+    /v1/platform/apps/{appId}/rotate-key:
+        post:
+            tags: [Platform]
+            summary: Rotate platform API key
+            description: Generate a new API key for the platform app. The old key is immediately invalidated. Returns the new key (one-time).
+            security:
+                - BearerAuth: []
+            parameters:
+                - name: appId
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            properties:
+                                api_key_expires_at:
+                                    type: string
+                                    format: date-time
+                                    nullable: true
+                                    description: Optional expiration for the new key.
+            responses:
+                "200":
+                    description: New key generated
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    api_key:
+                                        type: string
+                                        description: The new API key (shown once)
+                                    api_key_prefix:
+                                        type: string
+                                    api_key_expires_at:
+                                        type: string
+                                        format: date-time
+                                        nullable: true
+                "403":
+                    description: Only human users can rotate platform keys
+
     /v1/platform/apps/{appId}/templates:
         post:
             tags: [Platform]
@@ -4134,6 +4179,53 @@ paths:
                             schema:
                                 $ref: "#/components/schemas/BootstrapResponse"
 
+    /v1/platform/connections/{connectionId}/reissue-claim:
+        post:
+            tags: [Platform]
+            summary: Reissue a claim URL
+            description: Mints a fresh 10-minute claim token for an already-bootstrapped connection without re-provisioning resources. Use when the original claim URL has expired.
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: false
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            properties:
+                                return_to:
+                                    type: string
+                                    description: Optional redirect URL after claim
+            responses:
+                "200":
+                    description: New claim URL issued
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    claim_url:
+                                        type: string
+                                    claim_token:
+                                        type: string
+                                    expires_in:
+                                        type: integer
+                                        description: Seconds until expiry (600 = 10 min)
+                                    connection_id:
+                                        type: string
+                                        format: uuid
+                "400":
+                    description: Connection not yet bootstrapped
+                "404":
+                    description: Connection not found
+
     /v1/platform/apps/{appId}/audit:
         get:
             tags: [Platform]
@@ -5346,6 +5438,11 @@ components:
                     description: Enable Shroud LLM Proxy for this agent
                 shroud_config:
                     $ref: "#/components/schemas/ShroudConfig"
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: Optional expiration time for the agent's API key.
 
         UpdateAgentRequest:
             type: object
@@ -5412,6 +5509,11 @@ components:
                         Per-agent TTL override for federation tokens (seconds). NULL falls
                         back to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).
                         Hard-capped at 3600 seconds.
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: Optional expiration time for the agent's API key. Set to null to clear.
 
         AgentResponse:
             type: object
@@ -5519,6 +5621,11 @@ components:
                 message_signing_enabled:
                     type: boolean
                     description: Whether EIP-191 personal_sign is enabled.
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: Optional expiration time for the agent's API key.
                 created_at:
                     type: string
                     format: date-time
@@ -7560,6 +7667,11 @@ components:
                 max_connected_users:
                     type: integer
                     nullable: true
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: Optional expiration time for the platform API key.
 
         UpdatePlatformAppRequest:
             type: object
@@ -7594,6 +7706,11 @@ components:
                     nullable: true
                 is_active:
                     type: boolean
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: Optional expiration time for the platform API key. Set to null to clear.
 
         PlatformAppResponse:
             type: object
@@ -7640,6 +7757,16 @@ components:
                     nullable: true
                 connected_users:
                     type: integer
+                api_key_expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: When the platform API key expires.
+                api_key_rotated_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                    description: When the platform API key was last rotated.
                 created_at:
                     type: string
                     format: date-time

package/package.json

@@ -1,40 +1,40 @@
 {
-    "name": "@1claw/openapi-spec",
-    "version": "0.25.0",
-    "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/1clawAI/1claw.git",
-        "directory": "packages/openapi-spec"
-    },
-    "files": [
-        "openapi.yaml",
-        "openapi.json",
-        "README.md"
-    ],
-    "exports": {
-        "./openapi.yaml": "./openapi.yaml",
-        "./openapi.json": "./openapi.json"
-    },
-    "scripts": {
-        "build": "node scripts/yaml-to-json.mjs",
-        "prepublishOnly": "npm run build"
-    },
-    "publishConfig": {
-        "access": "public"
-    },
-    "keywords": [
-        "1claw",
-        "openapi",
-        "api-spec",
-        "codegen",
-        "swagger",
-        "secrets",
-        "vault",
-        "ai-agents"
-    ],
-    "devDependencies": {
-        "js-yaml": "^4.1.1"
-    }
+  "name": "@1claw/openapi-spec",
+  "version": "0.27.0",
+  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/1clawAI/1claw.git",
+    "directory": "packages/openapi-spec"
+  },
+  "files": [
+    "openapi.yaml",
+    "openapi.json",
+    "README.md"
+  ],
+  "exports": {
+    "./openapi.yaml": "./openapi.yaml",
+    "./openapi.json": "./openapi.json"
+  },
+  "scripts": {
+    "build": "node scripts/yaml-to-json.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "1claw",
+    "openapi",
+    "api-spec",
+    "codegen",
+    "swagger",
+    "secrets",
+    "vault",
+    "ai-agents"
+  ],
+  "devDependencies": {
+    "js-yaml": "^4.1.1"
+  }
 }