@1claw/openapi-spec 0.26.0 → 0.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/openapi.json +650 -1
  2. package/openapi.yaml +428 -1
  3. package/package.json +2 -2
package/openapi.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "openapi": "3.1.0",
3
3
  "info": {
4
4
  "title": "1Claw API",
5
- "version": "2.14.0",
5
+ "version": "2.15.0",
6
6
  "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
7
7
  "contact": {
8
8
  "email": "ops@1claw.xyz"
@@ -5152,6 +5152,342 @@
5152
5152
  }
5153
5153
  }
5154
5154
  },
5155
+ "/v1/treasury/{treasury_id}/proposals": {
5156
+ "post": {
5157
+ "tags": [
5158
+ "Treasury Proposals"
5159
+ ],
5160
+ "summary": "Create a multisig proposal",
5161
+ "description": "Create a new Safe multisig transaction proposal. The proposer must be a\ntreasury signer or an agent with an active delegation for the treasury.\nIf auto-approve rules match, the agent's signature is auto-inserted and\nauto-execute fires if threshold is met.\n",
5162
+ "operationId": "createTreasuryProposal",
5163
+ "security": [
5164
+ {
5165
+ "BearerAuth": []
5166
+ }
5167
+ ],
5168
+ "parameters": [
5169
+ {
5170
+ "name": "treasury_id",
5171
+ "in": "path",
5172
+ "required": true,
5173
+ "schema": {
5174
+ "type": "string",
5175
+ "format": "uuid"
5176
+ }
5177
+ }
5178
+ ],
5179
+ "requestBody": {
5180
+ "required": true,
5181
+ "content": {
5182
+ "application/json": {
5183
+ "schema": {
5184
+ "$ref": "#/components/schemas/CreateTreasuryProposalRequest"
5185
+ }
5186
+ }
5187
+ }
5188
+ },
5189
+ "responses": {
5190
+ "201": {
5191
+ "description": "Proposal created",
5192
+ "content": {
5193
+ "application/json": {
5194
+ "schema": {
5195
+ "$ref": "#/components/schemas/TreasuryProposalResponse"
5196
+ }
5197
+ }
5198
+ }
5199
+ },
5200
+ "400": {
5201
+ "$ref": "#/components/responses/BadRequest"
5202
+ },
5203
+ "401": {
5204
+ "$ref": "#/components/responses/Unauthorized"
5205
+ },
5206
+ "403": {
5207
+ "$ref": "#/components/responses/Forbidden"
5208
+ }
5209
+ }
5210
+ },
5211
+ "get": {
5212
+ "tags": [
5213
+ "Treasury Proposals"
5214
+ ],
5215
+ "summary": "List proposals for a treasury",
5216
+ "operationId": "listTreasuryProposals",
5217
+ "security": [
5218
+ {
5219
+ "BearerAuth": []
5220
+ }
5221
+ ],
5222
+ "parameters": [
5223
+ {
5224
+ "name": "treasury_id",
5225
+ "in": "path",
5226
+ "required": true,
5227
+ "schema": {
5228
+ "type": "string",
5229
+ "format": "uuid"
5230
+ }
5231
+ },
5232
+ {
5233
+ "name": "status",
5234
+ "in": "query",
5235
+ "required": false,
5236
+ "schema": {
5237
+ "type": "string",
5238
+ "enum": [
5239
+ "pending",
5240
+ "approved",
5241
+ "executing",
5242
+ "executed",
5243
+ "rejected",
5244
+ "expired"
5245
+ ]
5246
+ }
5247
+ }
5248
+ ],
5249
+ "responses": {
5250
+ "200": {
5251
+ "description": "Proposal list",
5252
+ "content": {
5253
+ "application/json": {
5254
+ "schema": {
5255
+ "$ref": "#/components/schemas/TreasuryProposalListResponse"
5256
+ }
5257
+ }
5258
+ }
5259
+ },
5260
+ "401": {
5261
+ "$ref": "#/components/responses/Unauthorized"
5262
+ },
5263
+ "403": {
5264
+ "$ref": "#/components/responses/Forbidden"
5265
+ }
5266
+ }
5267
+ }
5268
+ },
5269
+ "/v1/treasury/{treasury_id}/proposals/{proposal_id}": {
5270
+ "get": {
5271
+ "tags": [
5272
+ "Treasury Proposals"
5273
+ ],
5274
+ "summary": "Get a proposal with collected signatures",
5275
+ "operationId": "getTreasuryProposal",
5276
+ "security": [
5277
+ {
5278
+ "BearerAuth": []
5279
+ }
5280
+ ],
5281
+ "parameters": [
5282
+ {
5283
+ "name": "treasury_id",
5284
+ "in": "path",
5285
+ "required": true,
5286
+ "schema": {
5287
+ "type": "string",
5288
+ "format": "uuid"
5289
+ }
5290
+ },
5291
+ {
5292
+ "name": "proposal_id",
5293
+ "in": "path",
5294
+ "required": true,
5295
+ "schema": {
5296
+ "type": "string",
5297
+ "format": "uuid"
5298
+ }
5299
+ }
5300
+ ],
5301
+ "responses": {
5302
+ "200": {
5303
+ "description": "Proposal details",
5304
+ "content": {
5305
+ "application/json": {
5306
+ "schema": {
5307
+ "$ref": "#/components/schemas/TreasuryProposalResponse"
5308
+ }
5309
+ }
5310
+ }
5311
+ },
5312
+ "401": {
5313
+ "$ref": "#/components/responses/Unauthorized"
5314
+ },
5315
+ "404": {
5316
+ "$ref": "#/components/responses/NotFound"
5317
+ }
5318
+ }
5319
+ },
5320
+ "delete": {
5321
+ "tags": [
5322
+ "Treasury Proposals"
5323
+ ],
5324
+ "summary": "Cancel a pending proposal (proposer only)",
5325
+ "operationId": "cancelTreasuryProposal",
5326
+ "security": [
5327
+ {
5328
+ "BearerAuth": []
5329
+ }
5330
+ ],
5331
+ "parameters": [
5332
+ {
5333
+ "name": "treasury_id",
5334
+ "in": "path",
5335
+ "required": true,
5336
+ "schema": {
5337
+ "type": "string",
5338
+ "format": "uuid"
5339
+ }
5340
+ },
5341
+ {
5342
+ "name": "proposal_id",
5343
+ "in": "path",
5344
+ "required": true,
5345
+ "schema": {
5346
+ "type": "string",
5347
+ "format": "uuid"
5348
+ }
5349
+ }
5350
+ ],
5351
+ "responses": {
5352
+ "204": {
5353
+ "description": "Proposal cancelled"
5354
+ },
5355
+ "401": {
5356
+ "$ref": "#/components/responses/Unauthorized"
5357
+ },
5358
+ "403": {
5359
+ "$ref": "#/components/responses/Forbidden"
5360
+ },
5361
+ "404": {
5362
+ "$ref": "#/components/responses/NotFound"
5363
+ }
5364
+ }
5365
+ }
5366
+ },
5367
+ "/v1/treasury/{treasury_id}/proposals/{proposal_id}/sign": {
5368
+ "post": {
5369
+ "tags": [
5370
+ "Treasury Proposals"
5371
+ ],
5372
+ "summary": "Sign a proposal (approve or reject)",
5373
+ "description": "Submit an EIP-712 signature for a pending proposal. When approve signatures\nreach the Safe threshold, auto-execute fires: signatures are collected in\naddress-sorted order, `execTransaction` calldata is built, and the transaction\nis broadcast via RPC.\n",
5374
+ "operationId": "signTreasuryProposal",
5375
+ "security": [
5376
+ {
5377
+ "BearerAuth": []
5378
+ }
5379
+ ],
5380
+ "parameters": [
5381
+ {
5382
+ "name": "treasury_id",
5383
+ "in": "path",
5384
+ "required": true,
5385
+ "schema": {
5386
+ "type": "string",
5387
+ "format": "uuid"
5388
+ }
5389
+ },
5390
+ {
5391
+ "name": "proposal_id",
5392
+ "in": "path",
5393
+ "required": true,
5394
+ "schema": {
5395
+ "type": "string",
5396
+ "format": "uuid"
5397
+ }
5398
+ }
5399
+ ],
5400
+ "requestBody": {
5401
+ "required": true,
5402
+ "content": {
5403
+ "application/json": {
5404
+ "schema": {
5405
+ "$ref": "#/components/schemas/SignTreasuryProposalRequest"
5406
+ }
5407
+ }
5408
+ }
5409
+ },
5410
+ "responses": {
5411
+ "200": {
5412
+ "description": "Signature recorded (may include executed_tx_hash if auto-executed)",
5413
+ "content": {
5414
+ "application/json": {
5415
+ "schema": {
5416
+ "$ref": "#/components/schemas/TreasuryProposalResponse"
5417
+ }
5418
+ }
5419
+ }
5420
+ },
5421
+ "400": {
5422
+ "$ref": "#/components/responses/BadRequest"
5423
+ },
5424
+ "401": {
5425
+ "$ref": "#/components/responses/Unauthorized"
5426
+ },
5427
+ "403": {
5428
+ "$ref": "#/components/responses/Forbidden"
5429
+ },
5430
+ "404": {
5431
+ "$ref": "#/components/responses/NotFound"
5432
+ }
5433
+ }
5434
+ }
5435
+ },
5436
+ "/v1/treasury/{treasury_id}/proposals/{proposal_id}/execute": {
5437
+ "post": {
5438
+ "tags": [
5439
+ "Treasury Proposals"
5440
+ ],
5441
+ "summary": "Force-execute a proposal if threshold is met (user-only)",
5442
+ "operationId": "executeTreasuryProposal",
5443
+ "security": [
5444
+ {
5445
+ "BearerAuth": []
5446
+ }
5447
+ ],
5448
+ "parameters": [
5449
+ {
5450
+ "name": "treasury_id",
5451
+ "in": "path",
5452
+ "required": true,
5453
+ "schema": {
5454
+ "type": "string",
5455
+ "format": "uuid"
5456
+ }
5457
+ },
5458
+ {
5459
+ "name": "proposal_id",
5460
+ "in": "path",
5461
+ "required": true,
5462
+ "schema": {
5463
+ "type": "string",
5464
+ "format": "uuid"
5465
+ }
5466
+ }
5467
+ ],
5468
+ "responses": {
5469
+ "200": {
5470
+ "description": "Proposal executed",
5471
+ "content": {
5472
+ "application/json": {
5473
+ "schema": {
5474
+ "$ref": "#/components/schemas/TreasuryProposalResponse"
5475
+ }
5476
+ }
5477
+ }
5478
+ },
5479
+ "401": {
5480
+ "$ref": "#/components/responses/Unauthorized"
5481
+ },
5482
+ "403": {
5483
+ "$ref": "#/components/responses/Forbidden"
5484
+ },
5485
+ "404": {
5486
+ "$ref": "#/components/responses/NotFound"
5487
+ }
5488
+ }
5489
+ }
5490
+ },
5155
5491
  "/v1/treasury/wallets/generate": {
5156
5492
  "post": {
5157
5493
  "tags": [
@@ -6165,6 +6501,77 @@
6165
6501
  }
6166
6502
  }
6167
6503
  },
6504
+ "/v1/platform/apps/{appId}/rotate-key": {
6505
+ "post": {
6506
+ "tags": [
6507
+ "Platform"
6508
+ ],
6509
+ "summary": "Rotate platform API key",
6510
+ "description": "Generate a new API key for the platform app. The old key is immediately invalidated. Returns the new key (one-time).",
6511
+ "security": [
6512
+ {
6513
+ "BearerAuth": []
6514
+ }
6515
+ ],
6516
+ "parameters": [
6517
+ {
6518
+ "name": "appId",
6519
+ "in": "path",
6520
+ "required": true,
6521
+ "schema": {
6522
+ "type": "string",
6523
+ "format": "uuid"
6524
+ }
6525
+ }
6526
+ ],
6527
+ "requestBody": {
6528
+ "content": {
6529
+ "application/json": {
6530
+ "schema": {
6531
+ "type": "object",
6532
+ "properties": {
6533
+ "api_key_expires_at": {
6534
+ "type": "string",
6535
+ "format": "date-time",
6536
+ "nullable": true,
6537
+ "description": "Optional expiration for the new key."
6538
+ }
6539
+ }
6540
+ }
6541
+ }
6542
+ }
6543
+ },
6544
+ "responses": {
6545
+ "200": {
6546
+ "description": "New key generated",
6547
+ "content": {
6548
+ "application/json": {
6549
+ "schema": {
6550
+ "type": "object",
6551
+ "properties": {
6552
+ "api_key": {
6553
+ "type": "string",
6554
+ "description": "The new API key (shown once)"
6555
+ },
6556
+ "api_key_prefix": {
6557
+ "type": "string"
6558
+ },
6559
+ "api_key_expires_at": {
6560
+ "type": "string",
6561
+ "format": "date-time",
6562
+ "nullable": true
6563
+ }
6564
+ }
6565
+ }
6566
+ }
6567
+ }
6568
+ },
6569
+ "403": {
6570
+ "description": "Only human users can rotate platform keys"
6571
+ }
6572
+ }
6573
+ }
6574
+ },
6168
6575
  "/v1/platform/apps/{appId}/templates": {
6169
6576
  "post": {
6170
6577
  "tags": [
@@ -8207,6 +8614,12 @@
8207
8614
  },
8208
8615
  "shroud_config": {
8209
8616
  "$ref": "#/components/schemas/ShroudConfig"
8617
+ },
8618
+ "api_key_expires_at": {
8619
+ "type": "string",
8620
+ "format": "date-time",
8621
+ "nullable": true,
8622
+ "description": "Optional expiration time for the agent's API key."
8210
8623
  }
8211
8624
  }
8212
8625
  },
@@ -8286,6 +8699,12 @@
8286
8699
  "maximum": 3600,
8287
8700
  "nullable": true,
8288
8701
  "description": "Per-agent TTL override for federation tokens (seconds). NULL falls\nback to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).\nHard-capped at 3600 seconds.\n"
8702
+ },
8703
+ "api_key_expires_at": {
8704
+ "type": "string",
8705
+ "format": "date-time",
8706
+ "nullable": true,
8707
+ "description": "Optional expiration time for the agent's API key. Set to null to clear."
8289
8708
  }
8290
8709
  }
8291
8710
  },
@@ -8434,6 +8853,17 @@
8434
8853
  "type": "boolean",
8435
8854
  "description": "Whether EIP-191 personal_sign is enabled."
8436
8855
  },
8856
+ "api_key_expires_at": {
8857
+ "type": "string",
8858
+ "format": "date-time",
8859
+ "nullable": true,
8860
+ "description": "Optional expiration time for the agent's API key."
8861
+ },
8862
+ "evm_address": {
8863
+ "type": "string",
8864
+ "nullable": true,
8865
+ "description": "Agent's Ethereum EOA address (used as Safe signer for smart accounts and Intents API)."
8866
+ },
8437
8867
  "created_at": {
8438
8868
  "type": "string",
8439
8869
  "format": "date-time"
@@ -10941,6 +11371,201 @@
10941
11371
  }
10942
11372
  }
10943
11373
  },
11374
+ "CreateTreasuryProposalRequest": {
11375
+ "type": "object",
11376
+ "required": [
11377
+ "to_address",
11378
+ "value_wei",
11379
+ "chain"
11380
+ ],
11381
+ "properties": {
11382
+ "to_address": {
11383
+ "type": "string",
11384
+ "description": "Destination address (0x-prefixed)"
11385
+ },
11386
+ "value_wei": {
11387
+ "type": "string",
11388
+ "description": "Transaction value in wei"
11389
+ },
11390
+ "chain": {
11391
+ "type": "string",
11392
+ "description": "Chain name (e.g. ethereum, base)"
11393
+ },
11394
+ "chain_id": {
11395
+ "type": "integer",
11396
+ "description": "Numeric chain ID (alternative to chain name)"
11397
+ },
11398
+ "data_hex": {
11399
+ "type": "string",
11400
+ "description": "Hex-encoded calldata (optional)"
11401
+ },
11402
+ "operation": {
11403
+ "type": "integer",
11404
+ "description": "Safe operation type (0 = Call, 1 = DelegateCall)",
11405
+ "default": 0
11406
+ }
11407
+ }
11408
+ },
11409
+ "SignTreasuryProposalRequest": {
11410
+ "type": "object",
11411
+ "required": [
11412
+ "decision"
11413
+ ],
11414
+ "properties": {
11415
+ "decision": {
11416
+ "type": "string",
11417
+ "enum": [
11418
+ "approve",
11419
+ "reject"
11420
+ ],
11421
+ "description": "Whether to approve or reject the proposal"
11422
+ },
11423
+ "signature": {
11424
+ "type": "string",
11425
+ "description": "EIP-712 signature (hex). If omitted, server signs with caller's key."
11426
+ }
11427
+ }
11428
+ },
11429
+ "TreasuryProposalResponse": {
11430
+ "type": "object",
11431
+ "properties": {
11432
+ "id": {
11433
+ "type": "string",
11434
+ "format": "uuid"
11435
+ },
11436
+ "treasury_id": {
11437
+ "type": "string",
11438
+ "format": "uuid"
11439
+ },
11440
+ "proposed_by": {
11441
+ "type": "string",
11442
+ "format": "uuid"
11443
+ },
11444
+ "proposed_by_type": {
11445
+ "type": "string",
11446
+ "enum": [
11447
+ "user",
11448
+ "agent"
11449
+ ]
11450
+ },
11451
+ "chain": {
11452
+ "type": "string"
11453
+ },
11454
+ "chain_id": {
11455
+ "type": "integer"
11456
+ },
11457
+ "safe_address": {
11458
+ "type": "string"
11459
+ },
11460
+ "to_address": {
11461
+ "type": "string"
11462
+ },
11463
+ "value_wei": {
11464
+ "type": "string"
11465
+ },
11466
+ "data_hex": {
11467
+ "type": "string",
11468
+ "nullable": true
11469
+ },
11470
+ "operation": {
11471
+ "type": "integer"
11472
+ },
11473
+ "safe_tx_hash": {
11474
+ "type": "string",
11475
+ "nullable": true
11476
+ },
11477
+ "nonce": {
11478
+ "type": "integer",
11479
+ "nullable": true
11480
+ },
11481
+ "status": {
11482
+ "type": "string",
11483
+ "enum": [
11484
+ "pending",
11485
+ "approved",
11486
+ "executing",
11487
+ "executed",
11488
+ "rejected",
11489
+ "expired"
11490
+ ]
11491
+ },
11492
+ "threshold": {
11493
+ "type": "integer"
11494
+ },
11495
+ "expires_at": {
11496
+ "type": "string",
11497
+ "format": "date-time",
11498
+ "nullable": true
11499
+ },
11500
+ "executed_tx_hash": {
11501
+ "type": "string",
11502
+ "nullable": true
11503
+ },
11504
+ "executed_at": {
11505
+ "type": "string",
11506
+ "format": "date-time",
11507
+ "nullable": true
11508
+ },
11509
+ "signatures": {
11510
+ "type": "array",
11511
+ "items": {
11512
+ "$ref": "#/components/schemas/ProposalSignatureResponse"
11513
+ }
11514
+ },
11515
+ "created_at": {
11516
+ "type": "string",
11517
+ "format": "date-time"
11518
+ }
11519
+ }
11520
+ },
11521
+ "ProposalSignatureResponse": {
11522
+ "type": "object",
11523
+ "properties": {
11524
+ "id": {
11525
+ "type": "string",
11526
+ "format": "uuid"
11527
+ },
11528
+ "signer_id": {
11529
+ "type": "string",
11530
+ "format": "uuid"
11531
+ },
11532
+ "signer_type": {
11533
+ "type": "string",
11534
+ "enum": [
11535
+ "user",
11536
+ "agent"
11537
+ ]
11538
+ },
11539
+ "signer_address": {
11540
+ "type": "string"
11541
+ },
11542
+ "signature": {
11543
+ "type": "string"
11544
+ },
11545
+ "decision": {
11546
+ "type": "string",
11547
+ "enum": [
11548
+ "approve",
11549
+ "reject"
11550
+ ]
11551
+ },
11552
+ "created_at": {
11553
+ "type": "string",
11554
+ "format": "date-time"
11555
+ }
11556
+ }
11557
+ },
11558
+ "TreasuryProposalListResponse": {
11559
+ "type": "object",
11560
+ "properties": {
11561
+ "proposals": {
11562
+ "type": "array",
11563
+ "items": {
11564
+ "$ref": "#/components/schemas/TreasuryProposalResponse"
11565
+ }
11566
+ }
11567
+ }
11568
+ },
10944
11569
  "GenerateTreasuryWalletsRequest": {
10945
11570
  "type": "object",
10946
11571
  "properties": {
@@ -11386,6 +12011,12 @@
11386
12011
  "max_connected_users": {
11387
12012
  "type": "integer",
11388
12013
  "nullable": true
12014
+ },
12015
+ "api_key_expires_at": {
12016
+ "type": "string",
12017
+ "format": "date-time",
12018
+ "nullable": true,
12019
+ "description": "Optional expiration time for the platform API key."
11389
12020
  }
11390
12021
  }
11391
12022
  },
@@ -11442,6 +12073,12 @@
11442
12073
  },
11443
12074
  "is_active": {
11444
12075
  "type": "boolean"
12076
+ },
12077
+ "api_key_expires_at": {
12078
+ "type": "string",
12079
+ "format": "date-time",
12080
+ "nullable": true,
12081
+ "description": "Optional expiration time for the platform API key. Set to null to clear."
11445
12082
  }
11446
12083
  }
11447
12084
  },
@@ -11507,6 +12144,18 @@
11507
12144
  "connected_users": {
11508
12145
  "type": "integer"
11509
12146
  },
12147
+ "api_key_expires_at": {
12148
+ "type": "string",
12149
+ "format": "date-time",
12150
+ "nullable": true,
12151
+ "description": "When the platform API key expires."
12152
+ },
12153
+ "api_key_rotated_at": {
12154
+ "type": "string",
12155
+ "format": "date-time",
12156
+ "nullable": true,
12157
+ "description": "When the platform API key was last rotated."
12158
+ },
11510
12159
  "created_at": {
11511
12160
  "type": "string",
11512
12161
  "format": "date-time"
package/openapi.yaml CHANGED
@@ -2,7 +2,7 @@ openapi: 3.1.0
2
2
 
3
3
  info:
4
4
  title: 1Claw API
5
- version: 2.14.0
5
+ version: 2.15.0
6
6
  description: |
7
7
  Secure secret management for AI agents. Provides vaults, secrets,
8
8
  policy-based access control, agent identity, Intents API,
@@ -3356,6 +3356,220 @@ paths:
3356
3356
  "404":
3357
3357
  $ref: "#/components/responses/NotFound"
3358
3358
 
3359
+ # ---------------------------------------------------------------------------
3360
+ # Treasury Proposals (multisig propose / sign / execute)
3361
+ # ---------------------------------------------------------------------------
3362
+
3363
+ /v1/treasury/{treasury_id}/proposals:
3364
+ post:
3365
+ tags: [Treasury Proposals]
3366
+ summary: Create a multisig proposal
3367
+ description: |
3368
+ Create a new Safe multisig transaction proposal. The proposer must be a
3369
+ treasury signer or an agent with an active delegation for the treasury.
3370
+ If auto-approve rules match, the agent's signature is auto-inserted and
3371
+ auto-execute fires if threshold is met.
3372
+ operationId: createTreasuryProposal
3373
+ security:
3374
+ - BearerAuth: []
3375
+ parameters:
3376
+ - name: treasury_id
3377
+ in: path
3378
+ required: true
3379
+ schema:
3380
+ type: string
3381
+ format: uuid
3382
+ requestBody:
3383
+ required: true
3384
+ content:
3385
+ application/json:
3386
+ schema:
3387
+ $ref: "#/components/schemas/CreateTreasuryProposalRequest"
3388
+ responses:
3389
+ "201":
3390
+ description: Proposal created
3391
+ content:
3392
+ application/json:
3393
+ schema:
3394
+ $ref: "#/components/schemas/TreasuryProposalResponse"
3395
+ "400":
3396
+ $ref: "#/components/responses/BadRequest"
3397
+ "401":
3398
+ $ref: "#/components/responses/Unauthorized"
3399
+ "403":
3400
+ $ref: "#/components/responses/Forbidden"
3401
+ get:
3402
+ tags: [Treasury Proposals]
3403
+ summary: List proposals for a treasury
3404
+ operationId: listTreasuryProposals
3405
+ security:
3406
+ - BearerAuth: []
3407
+ parameters:
3408
+ - name: treasury_id
3409
+ in: path
3410
+ required: true
3411
+ schema:
3412
+ type: string
3413
+ format: uuid
3414
+ - name: status
3415
+ in: query
3416
+ required: false
3417
+ schema:
3418
+ type: string
3419
+ enum: [pending, approved, executing, executed, rejected, expired]
3420
+ responses:
3421
+ "200":
3422
+ description: Proposal list
3423
+ content:
3424
+ application/json:
3425
+ schema:
3426
+ $ref: "#/components/schemas/TreasuryProposalListResponse"
3427
+ "401":
3428
+ $ref: "#/components/responses/Unauthorized"
3429
+ "403":
3430
+ $ref: "#/components/responses/Forbidden"
3431
+
3432
+ /v1/treasury/{treasury_id}/proposals/{proposal_id}:
3433
+ get:
3434
+ tags: [Treasury Proposals]
3435
+ summary: Get a proposal with collected signatures
3436
+ operationId: getTreasuryProposal
3437
+ security:
3438
+ - BearerAuth: []
3439
+ parameters:
3440
+ - name: treasury_id
3441
+ in: path
3442
+ required: true
3443
+ schema:
3444
+ type: string
3445
+ format: uuid
3446
+ - name: proposal_id
3447
+ in: path
3448
+ required: true
3449
+ schema:
3450
+ type: string
3451
+ format: uuid
3452
+ responses:
3453
+ "200":
3454
+ description: Proposal details
3455
+ content:
3456
+ application/json:
3457
+ schema:
3458
+ $ref: "#/components/schemas/TreasuryProposalResponse"
3459
+ "401":
3460
+ $ref: "#/components/responses/Unauthorized"
3461
+ "404":
3462
+ $ref: "#/components/responses/NotFound"
3463
+ delete:
3464
+ tags: [Treasury Proposals]
3465
+ summary: Cancel a pending proposal (proposer only)
3466
+ operationId: cancelTreasuryProposal
3467
+ security:
3468
+ - BearerAuth: []
3469
+ parameters:
3470
+ - name: treasury_id
3471
+ in: path
3472
+ required: true
3473
+ schema:
3474
+ type: string
3475
+ format: uuid
3476
+ - name: proposal_id
3477
+ in: path
3478
+ required: true
3479
+ schema:
3480
+ type: string
3481
+ format: uuid
3482
+ responses:
3483
+ "204":
3484
+ description: Proposal cancelled
3485
+ "401":
3486
+ $ref: "#/components/responses/Unauthorized"
3487
+ "403":
3488
+ $ref: "#/components/responses/Forbidden"
3489
+ "404":
3490
+ $ref: "#/components/responses/NotFound"
3491
+
3492
+ /v1/treasury/{treasury_id}/proposals/{proposal_id}/sign:
3493
+ post:
3494
+ tags: [Treasury Proposals]
3495
+ summary: Sign a proposal (approve or reject)
3496
+ description: |
3497
+ Submit an EIP-712 signature for a pending proposal. When approve signatures
3498
+ reach the Safe threshold, auto-execute fires: signatures are collected in
3499
+ address-sorted order, `execTransaction` calldata is built, and the transaction
3500
+ is broadcast via RPC.
3501
+ operationId: signTreasuryProposal
3502
+ security:
3503
+ - BearerAuth: []
3504
+ parameters:
3505
+ - name: treasury_id
3506
+ in: path
3507
+ required: true
3508
+ schema:
3509
+ type: string
3510
+ format: uuid
3511
+ - name: proposal_id
3512
+ in: path
3513
+ required: true
3514
+ schema:
3515
+ type: string
3516
+ format: uuid
3517
+ requestBody:
3518
+ required: true
3519
+ content:
3520
+ application/json:
3521
+ schema:
3522
+ $ref: "#/components/schemas/SignTreasuryProposalRequest"
3523
+ responses:
3524
+ "200":
3525
+ description: Signature recorded (may include executed_tx_hash if auto-executed)
3526
+ content:
3527
+ application/json:
3528
+ schema:
3529
+ $ref: "#/components/schemas/TreasuryProposalResponse"
3530
+ "400":
3531
+ $ref: "#/components/responses/BadRequest"
3532
+ "401":
3533
+ $ref: "#/components/responses/Unauthorized"
3534
+ "403":
3535
+ $ref: "#/components/responses/Forbidden"
3536
+ "404":
3537
+ $ref: "#/components/responses/NotFound"
3538
+
3539
+ /v1/treasury/{treasury_id}/proposals/{proposal_id}/execute:
3540
+ post:
3541
+ tags: [Treasury Proposals]
3542
+ summary: Force-execute a proposal if threshold is met (user-only)
3543
+ operationId: executeTreasuryProposal
3544
+ security:
3545
+ - BearerAuth: []
3546
+ parameters:
3547
+ - name: treasury_id
3548
+ in: path
3549
+ required: true
3550
+ schema:
3551
+ type: string
3552
+ format: uuid
3553
+ - name: proposal_id
3554
+ in: path
3555
+ required: true
3556
+ schema:
3557
+ type: string
3558
+ format: uuid
3559
+ responses:
3560
+ "200":
3561
+ description: Proposal executed
3562
+ content:
3563
+ application/json:
3564
+ schema:
3565
+ $ref: "#/components/schemas/TreasuryProposalResponse"
3566
+ "401":
3567
+ $ref: "#/components/responses/Unauthorized"
3568
+ "403":
3569
+ $ref: "#/components/responses/Forbidden"
3570
+ "404":
3571
+ $ref: "#/components/responses/NotFound"
3572
+
3359
3573
  # ---------------------------------------------------------------------------
3360
3574
  # Treasury Wallets (multi-chain key generation for human users)
3361
3575
  # ---------------------------------------------------------------------------
@@ -4006,6 +4220,51 @@ paths:
4006
4220
  "403":
4007
4221
  description: Only human users can delete platform apps
4008
4222
 
4223
+ /v1/platform/apps/{appId}/rotate-key:
4224
+ post:
4225
+ tags: [Platform]
4226
+ summary: Rotate platform API key
4227
+ description: Generate a new API key for the platform app. The old key is immediately invalidated. Returns the new key (one-time).
4228
+ security:
4229
+ - BearerAuth: []
4230
+ parameters:
4231
+ - name: appId
4232
+ in: path
4233
+ required: true
4234
+ schema:
4235
+ type: string
4236
+ format: uuid
4237
+ requestBody:
4238
+ content:
4239
+ application/json:
4240
+ schema:
4241
+ type: object
4242
+ properties:
4243
+ api_key_expires_at:
4244
+ type: string
4245
+ format: date-time
4246
+ nullable: true
4247
+ description: Optional expiration for the new key.
4248
+ responses:
4249
+ "200":
4250
+ description: New key generated
4251
+ content:
4252
+ application/json:
4253
+ schema:
4254
+ type: object
4255
+ properties:
4256
+ api_key:
4257
+ type: string
4258
+ description: The new API key (shown once)
4259
+ api_key_prefix:
4260
+ type: string
4261
+ api_key_expires_at:
4262
+ type: string
4263
+ format: date-time
4264
+ nullable: true
4265
+ "403":
4266
+ description: Only human users can rotate platform keys
4267
+
4009
4268
  /v1/platform/apps/{appId}/templates:
4010
4269
  post:
4011
4270
  tags: [Platform]
@@ -5393,6 +5652,11 @@ components:
5393
5652
  description: Enable Shroud LLM Proxy for this agent
5394
5653
  shroud_config:
5395
5654
  $ref: "#/components/schemas/ShroudConfig"
5655
+ api_key_expires_at:
5656
+ type: string
5657
+ format: date-time
5658
+ nullable: true
5659
+ description: Optional expiration time for the agent's API key.
5396
5660
 
5397
5661
  UpdateAgentRequest:
5398
5662
  type: object
@@ -5459,6 +5723,11 @@ components:
5459
5723
  Per-agent TTL override for federation tokens (seconds). NULL falls
5460
5724
  back to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).
5461
5725
  Hard-capped at 3600 seconds.
5726
+ api_key_expires_at:
5727
+ type: string
5728
+ format: date-time
5729
+ nullable: true
5730
+ description: Optional expiration time for the agent's API key. Set to null to clear.
5462
5731
 
5463
5732
  AgentResponse:
5464
5733
  type: object
@@ -5566,6 +5835,15 @@ components:
5566
5835
  message_signing_enabled:
5567
5836
  type: boolean
5568
5837
  description: Whether EIP-191 personal_sign is enabled.
5838
+ api_key_expires_at:
5839
+ type: string
5840
+ format: date-time
5841
+ nullable: true
5842
+ description: Optional expiration time for the agent's API key.
5843
+ evm_address:
5844
+ type: string
5845
+ nullable: true
5846
+ description: Agent's Ethereum EOA address (used as Safe signer for smart accounts and Intents API).
5569
5847
  created_at:
5570
5848
  type: string
5571
5849
  format: date-time
@@ -7284,6 +7562,135 @@ components:
7284
7562
  type: string
7285
7563
  format: date-time
7286
7564
 
7565
+ # --- Treasury Proposals ---
7566
+
7567
+ CreateTreasuryProposalRequest:
7568
+ type: object
7569
+ required: [to_address, value_wei, chain]
7570
+ properties:
7571
+ to_address:
7572
+ type: string
7573
+ description: Destination address (0x-prefixed)
7574
+ value_wei:
7575
+ type: string
7576
+ description: Transaction value in wei
7577
+ chain:
7578
+ type: string
7579
+ description: Chain name (e.g. ethereum, base)
7580
+ chain_id:
7581
+ type: integer
7582
+ description: Numeric chain ID (alternative to chain name)
7583
+ data_hex:
7584
+ type: string
7585
+ description: Hex-encoded calldata (optional)
7586
+ operation:
7587
+ type: integer
7588
+ description: Safe operation type (0 = Call, 1 = DelegateCall)
7589
+ default: 0
7590
+
7591
+ SignTreasuryProposalRequest:
7592
+ type: object
7593
+ required: [decision]
7594
+ properties:
7595
+ decision:
7596
+ type: string
7597
+ enum: [approve, reject]
7598
+ description: Whether to approve or reject the proposal
7599
+ signature:
7600
+ type: string
7601
+ description: EIP-712 signature (hex). If omitted, server signs with caller's key.
7602
+
7603
+ TreasuryProposalResponse:
7604
+ type: object
7605
+ properties:
7606
+ id:
7607
+ type: string
7608
+ format: uuid
7609
+ treasury_id:
7610
+ type: string
7611
+ format: uuid
7612
+ proposed_by:
7613
+ type: string
7614
+ format: uuid
7615
+ proposed_by_type:
7616
+ type: string
7617
+ enum: [user, agent]
7618
+ chain:
7619
+ type: string
7620
+ chain_id:
7621
+ type: integer
7622
+ safe_address:
7623
+ type: string
7624
+ to_address:
7625
+ type: string
7626
+ value_wei:
7627
+ type: string
7628
+ data_hex:
7629
+ type: string
7630
+ nullable: true
7631
+ operation:
7632
+ type: integer
7633
+ safe_tx_hash:
7634
+ type: string
7635
+ nullable: true
7636
+ nonce:
7637
+ type: integer
7638
+ nullable: true
7639
+ status:
7640
+ type: string
7641
+ enum: [pending, approved, executing, executed, rejected, expired]
7642
+ threshold:
7643
+ type: integer
7644
+ expires_at:
7645
+ type: string
7646
+ format: date-time
7647
+ nullable: true
7648
+ executed_tx_hash:
7649
+ type: string
7650
+ nullable: true
7651
+ executed_at:
7652
+ type: string
7653
+ format: date-time
7654
+ nullable: true
7655
+ signatures:
7656
+ type: array
7657
+ items:
7658
+ $ref: "#/components/schemas/ProposalSignatureResponse"
7659
+ created_at:
7660
+ type: string
7661
+ format: date-time
7662
+
7663
+ ProposalSignatureResponse:
7664
+ type: object
7665
+ properties:
7666
+ id:
7667
+ type: string
7668
+ format: uuid
7669
+ signer_id:
7670
+ type: string
7671
+ format: uuid
7672
+ signer_type:
7673
+ type: string
7674
+ enum: [user, agent]
7675
+ signer_address:
7676
+ type: string
7677
+ signature:
7678
+ type: string
7679
+ decision:
7680
+ type: string
7681
+ enum: [approve, reject]
7682
+ created_at:
7683
+ type: string
7684
+ format: date-time
7685
+
7686
+ TreasuryProposalListResponse:
7687
+ type: object
7688
+ properties:
7689
+ proposals:
7690
+ type: array
7691
+ items:
7692
+ $ref: "#/components/schemas/TreasuryProposalResponse"
7693
+
7287
7694
  # --- Treasury Wallets ---
7288
7695
 
7289
7696
  GenerateTreasuryWalletsRequest:
@@ -7607,6 +8014,11 @@ components:
7607
8014
  max_connected_users:
7608
8015
  type: integer
7609
8016
  nullable: true
8017
+ api_key_expires_at:
8018
+ type: string
8019
+ format: date-time
8020
+ nullable: true
8021
+ description: Optional expiration time for the platform API key.
7610
8022
 
7611
8023
  UpdatePlatformAppRequest:
7612
8024
  type: object
@@ -7641,6 +8053,11 @@ components:
7641
8053
  nullable: true
7642
8054
  is_active:
7643
8055
  type: boolean
8056
+ api_key_expires_at:
8057
+ type: string
8058
+ format: date-time
8059
+ nullable: true
8060
+ description: Optional expiration time for the platform API key. Set to null to clear.
7644
8061
 
7645
8062
  PlatformAppResponse:
7646
8063
  type: object
@@ -7687,6 +8104,16 @@ components:
7687
8104
  nullable: true
7688
8105
  connected_users:
7689
8106
  type: integer
8107
+ api_key_expires_at:
8108
+ type: string
8109
+ format: date-time
8110
+ nullable: true
8111
+ description: When the platform API key expires.
8112
+ api_key_rotated_at:
8113
+ type: string
8114
+ format: date-time
8115
+ nullable: true
8116
+ description: When the platform API key was last rotated.
7690
8117
  created_at:
7691
8118
  type: string
7692
8119
  format: date-time
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@1claw/openapi-spec",
3
- "version": "0.26.0",
3
+ "version": "0.28.0",
4
4
  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
5
5
  "license": "MIT",
6
6
  "repository": {
@@ -37,4 +37,4 @@
37
37
  "devDependencies": {
38
38
  "js-yaml": "^4.1.1"
39
39
  }
40
- }
40
+ }