@1claw/openapi-spec 0.29.1 → 0.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -40,7 +40,16 @@ openapi-generator generate \
40
40
  import spec from "@1claw/openapi-spec/openapi.json";
41
41
  ```
42
42
 
43
- ## What's in the spec (v0.28.0 — API `info.version` 2.15.0)
43
+ ## What's in the spec (v0.31.0 — API `info.version` 2.17.0)
44
+
45
+ ### CDP parity & embedded wallet (2.16+)
46
+ - **Deposit destinations** — `POST/GET/PATCH /v1/deposit-destinations`, `GET /v1/deposit-destinations/{id}`
47
+ - **Internal accounts** — `POST/GET /v1/internal-accounts`, `POST /v1/internal-transfers` (supports `Idempotency-Key`), `GET /v1/internal-accounts/{id}/ledger`
48
+ - **Fiat ramps** — `POST /v1/fiat/onramp/session`, `POST /v1/fiat/offramp/initiate`, `POST /v1/fiat/webhooks` (MoonPay signature required in production)
49
+ - **Social login** — `POST /v1/auth/social-login` (Google/Apple ID tokens with audience validation; Discord authorization code + `oauth_redirect_uri`; no email auto-linking — 409 on conflict)
50
+ - **Passkey tx auth** — `POST /v1/auth/passkeys/tx-assert/begin|complete` → `X-Passkey-Token` (+ optional `X-Passkey-Tx-Digest`) on treasury send
51
+
52
+ ### Core API (summary)
44
53
 
45
54
  - **OIDC Federation (1claw as IdP)** — `GET /.well-known/openid-configuration` (public discovery: issuer, jwks_uri, supported algs `["EdDSA","RS256"]`, supported grant types incl. token-exchange), `GET /.well-known/jwks.json` (public JWKS — every active EdDSA + RS256 key version, keyed by deterministic `kid`), `POST /v1/auth/federated-token` (RFC 8693 token exchange — accepts JSON or `application/x-www-form-urlencoded`; subject token is an agent JWT or `ocv_` API key; returns RS256 JWT scoped to `audience`). Agent fields: `federation_enabled`, `federation_audiences[]`, `federated_token_ttl_seconds`. Designed for Anthropic Workload Identity Federation, GCP STS, AWS STS, etc.
46
55
  - **Auth — agent JWT** — `POST /v1/auth/agent-token` documents optional JWT claim **`shroud_config`** when the agent has Shroud enabled (mirrors DB; consumed by Shroud PolicyEngine on LLM requests). Re-exchange after changing agent Shroud settings. Federation tokens use a separate KMS RSA-2048 key and are signed RS256.
package/openapi.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "openapi": "3.1.0",
3
3
  "info": {
4
4
  "title": "1Claw API",
5
- "version": "2.15.0",
5
+ "version": "2.17.0",
6
6
  "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
7
7
  "contact": {
8
8
  "email": "ops@1claw.xyz"
@@ -7674,6 +7674,457 @@
7674
7674
  }
7675
7675
  }
7676
7676
  }
7677
+ },
7678
+ "/v1/deposit-destinations": {
7679
+ "post": {
7680
+ "tags": [
7681
+ "Treasury"
7682
+ ],
7683
+ "summary": "Create deposit destination",
7684
+ "operationId": "createDepositDestination",
7685
+ "security": [
7686
+ {
7687
+ "BearerAuth": []
7688
+ }
7689
+ ],
7690
+ "requestBody": {
7691
+ "required": true,
7692
+ "content": {
7693
+ "application/json": {
7694
+ "schema": {
7695
+ "type": "object",
7696
+ "required": [
7697
+ "chain"
7698
+ ],
7699
+ "properties": {
7700
+ "chain": {
7701
+ "type": "string"
7702
+ },
7703
+ "label": {
7704
+ "type": "string"
7705
+ },
7706
+ "treasury_wallet_id": {
7707
+ "type": "string",
7708
+ "format": "uuid"
7709
+ }
7710
+ }
7711
+ }
7712
+ }
7713
+ }
7714
+ },
7715
+ "responses": {
7716
+ "201": {
7717
+ "description": "Destination created"
7718
+ },
7719
+ "401": {
7720
+ "$ref": "#/components/responses/Unauthorized"
7721
+ }
7722
+ }
7723
+ },
7724
+ "get": {
7725
+ "tags": [
7726
+ "Treasury"
7727
+ ],
7728
+ "summary": "List deposit destinations",
7729
+ "operationId": "listDepositDestinations",
7730
+ "security": [
7731
+ {
7732
+ "BearerAuth": []
7733
+ }
7734
+ ],
7735
+ "responses": {
7736
+ "200": {
7737
+ "description": "List of destinations"
7738
+ }
7739
+ }
7740
+ }
7741
+ },
7742
+ "/v1/deposit-destinations/{id}": {
7743
+ "get": {
7744
+ "tags": [
7745
+ "Treasury"
7746
+ ],
7747
+ "summary": "Get deposit destination",
7748
+ "operationId": "getDepositDestination",
7749
+ "security": [
7750
+ {
7751
+ "BearerAuth": []
7752
+ }
7753
+ ],
7754
+ "parameters": [
7755
+ {
7756
+ "name": "id",
7757
+ "in": "path",
7758
+ "required": true,
7759
+ "schema": {
7760
+ "type": "string",
7761
+ "format": "uuid"
7762
+ }
7763
+ }
7764
+ ],
7765
+ "responses": {
7766
+ "200": {
7767
+ "description": "Destination detail with events"
7768
+ }
7769
+ }
7770
+ },
7771
+ "patch": {
7772
+ "tags": [
7773
+ "Treasury"
7774
+ ],
7775
+ "summary": "Update deposit destination status",
7776
+ "operationId": "updateDepositDestination",
7777
+ "security": [
7778
+ {
7779
+ "BearerAuth": []
7780
+ }
7781
+ ],
7782
+ "parameters": [
7783
+ {
7784
+ "name": "id",
7785
+ "in": "path",
7786
+ "required": true,
7787
+ "schema": {
7788
+ "type": "string",
7789
+ "format": "uuid"
7790
+ }
7791
+ }
7792
+ ],
7793
+ "requestBody": {
7794
+ "required": true,
7795
+ "content": {
7796
+ "application/json": {
7797
+ "schema": {
7798
+ "type": "object",
7799
+ "properties": {
7800
+ "status": {
7801
+ "type": "string",
7802
+ "enum": [
7803
+ "active",
7804
+ "paused",
7805
+ "archived"
7806
+ ]
7807
+ }
7808
+ }
7809
+ }
7810
+ }
7811
+ }
7812
+ },
7813
+ "responses": {
7814
+ "200": {
7815
+ "description": "Updated destination"
7816
+ }
7817
+ }
7818
+ }
7819
+ },
7820
+ "/v1/internal-accounts": {
7821
+ "post": {
7822
+ "tags": [
7823
+ "Treasury"
7824
+ ],
7825
+ "summary": "Create internal account",
7826
+ "operationId": "createInternalAccount",
7827
+ "security": [
7828
+ {
7829
+ "BearerAuth": []
7830
+ }
7831
+ ],
7832
+ "requestBody": {
7833
+ "required": true,
7834
+ "content": {
7835
+ "application/json": {
7836
+ "schema": {
7837
+ "type": "object",
7838
+ "required": [
7839
+ "name"
7840
+ ],
7841
+ "properties": {
7842
+ "name": {
7843
+ "type": "string"
7844
+ },
7845
+ "description": {
7846
+ "type": "string"
7847
+ }
7848
+ }
7849
+ }
7850
+ }
7851
+ }
7852
+ },
7853
+ "responses": {
7854
+ "201": {
7855
+ "description": "Account created"
7856
+ }
7857
+ }
7858
+ },
7859
+ "get": {
7860
+ "tags": [
7861
+ "Treasury"
7862
+ ],
7863
+ "summary": "List internal accounts",
7864
+ "operationId": "listInternalAccounts",
7865
+ "security": [
7866
+ {
7867
+ "BearerAuth": []
7868
+ }
7869
+ ],
7870
+ "responses": {
7871
+ "200": {
7872
+ "description": "Account list with balances"
7873
+ }
7874
+ }
7875
+ }
7876
+ },
7877
+ "/v1/internal-accounts/{id}": {
7878
+ "get": {
7879
+ "tags": [
7880
+ "Treasury"
7881
+ ],
7882
+ "summary": "Get internal account",
7883
+ "operationId": "getInternalAccount",
7884
+ "security": [
7885
+ {
7886
+ "BearerAuth": []
7887
+ }
7888
+ ],
7889
+ "parameters": [
7890
+ {
7891
+ "name": "id",
7892
+ "in": "path",
7893
+ "required": true,
7894
+ "schema": {
7895
+ "type": "string",
7896
+ "format": "uuid"
7897
+ }
7898
+ }
7899
+ ],
7900
+ "responses": {
7901
+ "200": {
7902
+ "description": "Account detail"
7903
+ }
7904
+ }
7905
+ }
7906
+ },
7907
+ "/v1/internal-accounts/{id}/ledger": {
7908
+ "get": {
7909
+ "tags": [
7910
+ "Treasury"
7911
+ ],
7912
+ "summary": "Get account ledger",
7913
+ "operationId": "getInternalAccountLedger",
7914
+ "security": [
7915
+ {
7916
+ "BearerAuth": []
7917
+ }
7918
+ ],
7919
+ "parameters": [
7920
+ {
7921
+ "name": "id",
7922
+ "in": "path",
7923
+ "required": true,
7924
+ "schema": {
7925
+ "type": "string",
7926
+ "format": "uuid"
7927
+ }
7928
+ }
7929
+ ],
7930
+ "responses": {
7931
+ "200": {
7932
+ "description": "Ledger entries"
7933
+ }
7934
+ }
7935
+ }
7936
+ },
7937
+ "/v1/internal-transfers": {
7938
+ "post": {
7939
+ "tags": [
7940
+ "Treasury"
7941
+ ],
7942
+ "summary": "Transfer between internal accounts",
7943
+ "operationId": "createInternalTransfer",
7944
+ "security": [
7945
+ {
7946
+ "BearerAuth": []
7947
+ }
7948
+ ],
7949
+ "requestBody": {
7950
+ "required": true,
7951
+ "content": {
7952
+ "application/json": {
7953
+ "schema": {
7954
+ "type": "object",
7955
+ "required": [
7956
+ "from_account_id",
7957
+ "to_account_id",
7958
+ "asset",
7959
+ "amount"
7960
+ ],
7961
+ "properties": {
7962
+ "from_account_id": {
7963
+ "type": "string",
7964
+ "format": "uuid"
7965
+ },
7966
+ "to_account_id": {
7967
+ "type": "string",
7968
+ "format": "uuid"
7969
+ },
7970
+ "asset": {
7971
+ "type": "string"
7972
+ },
7973
+ "amount": {
7974
+ "type": "string"
7975
+ },
7976
+ "memo": {
7977
+ "type": "string"
7978
+ }
7979
+ }
7980
+ }
7981
+ }
7982
+ }
7983
+ },
7984
+ "responses": {
7985
+ "201": {
7986
+ "description": "Transfer completed"
7987
+ }
7988
+ }
7989
+ }
7990
+ },
7991
+ "/v1/fiat/onramp/session": {
7992
+ "post": {
7993
+ "tags": [
7994
+ "Billing"
7995
+ ],
7996
+ "summary": "Create fiat onramp session",
7997
+ "operationId": "createFiatOnrampSession",
7998
+ "security": [
7999
+ {
8000
+ "BearerAuth": []
8001
+ }
8002
+ ],
8003
+ "responses": {
8004
+ "201": {
8005
+ "description": "Onramp widget URL"
8006
+ }
8007
+ }
8008
+ }
8009
+ },
8010
+ "/v1/fiat/offramp/initiate": {
8011
+ "post": {
8012
+ "tags": [
8013
+ "Billing"
8014
+ ],
8015
+ "summary": "Initiate fiat offramp",
8016
+ "operationId": "initiateFiatOfframp",
8017
+ "security": [
8018
+ {
8019
+ "BearerAuth": []
8020
+ }
8021
+ ],
8022
+ "responses": {
8023
+ "201": {
8024
+ "description": "Offramp widget URL"
8025
+ }
8026
+ }
8027
+ }
8028
+ },
8029
+ "/v1/auth/social-login": {
8030
+ "post": {
8031
+ "tags": [
8032
+ "Authentication"
8033
+ ],
8034
+ "summary": "Social login (Google, Apple, Discord)",
8035
+ "operationId": "socialLogin",
8036
+ "security": [],
8037
+ "requestBody": {
8038
+ "required": true,
8039
+ "content": {
8040
+ "application/json": {
8041
+ "schema": {
8042
+ "type": "object",
8043
+ "required": [
8044
+ "provider",
8045
+ "id_token"
8046
+ ],
8047
+ "properties": {
8048
+ "provider": {
8049
+ "type": "string",
8050
+ "enum": [
8051
+ "google",
8052
+ "apple",
8053
+ "discord"
8054
+ ]
8055
+ },
8056
+ "id_token": {
8057
+ "type": "string",
8058
+ "description": "Google/Apple ID token, or Discord OAuth authorization code"
8059
+ },
8060
+ "oauth_redirect_uri": {
8061
+ "type": "string",
8062
+ "description": "Required for Discord — must match the redirect URI used in the OAuth flow"
8063
+ },
8064
+ "auto_provision_chains": {
8065
+ "type": "array",
8066
+ "items": {
8067
+ "type": "string"
8068
+ }
8069
+ }
8070
+ }
8071
+ }
8072
+ }
8073
+ }
8074
+ },
8075
+ "responses": {
8076
+ "200": {
8077
+ "description": "Login successful"
8078
+ },
8079
+ "201": {
8080
+ "description": "New user created"
8081
+ },
8082
+ "401": {
8083
+ "description": "Invalid or unverified token"
8084
+ },
8085
+ "409": {
8086
+ "description": "Email already registered (no auto-linking)"
8087
+ }
8088
+ }
8089
+ }
8090
+ },
8091
+ "/v1/auth/passkeys/tx-assert/begin": {
8092
+ "post": {
8093
+ "tags": [
8094
+ "Authentication"
8095
+ ],
8096
+ "summary": "Begin passkey transaction authorization",
8097
+ "operationId": "passkeyTxAssertBegin",
8098
+ "security": [
8099
+ {
8100
+ "BearerAuth": []
8101
+ }
8102
+ ],
8103
+ "responses": {
8104
+ "200": {
8105
+ "description": "WebAuthn challenge"
8106
+ }
8107
+ }
8108
+ }
8109
+ },
8110
+ "/v1/auth/passkeys/tx-assert/complete": {
8111
+ "post": {
8112
+ "tags": [
8113
+ "Authentication"
8114
+ ],
8115
+ "summary": "Complete passkey transaction authorization",
8116
+ "operationId": "passkeyTxAssertComplete",
8117
+ "security": [
8118
+ {
8119
+ "BearerAuth": []
8120
+ }
8121
+ ],
8122
+ "responses": {
8123
+ "200": {
8124
+ "description": "Passkey token for X-Passkey-Token header"
8125
+ }
8126
+ }
8127
+ }
7677
8128
  }
7678
8129
  },
7679
8130
  "components": {
package/openapi.yaml CHANGED
@@ -2,7 +2,7 @@ openapi: 3.1.0
2
2
 
3
3
  info:
4
4
  title: 1Claw API
5
- version: 2.15.0
5
+ version: 2.17.0
6
6
  description: |
7
7
  Secure secret management for AI agents. Provides vaults, secrets,
8
8
  policy-based access control, agent identity, Intents API,
@@ -4956,6 +4956,241 @@ paths:
4956
4956
  "409":
4957
4957
  $ref: "#/components/responses/Conflict"
4958
4958
 
4959
+ /v1/deposit-destinations:
4960
+ post:
4961
+ tags: [Treasury]
4962
+ summary: Create deposit destination
4963
+ operationId: createDepositDestination
4964
+ security:
4965
+ - BearerAuth: []
4966
+ requestBody:
4967
+ required: true
4968
+ content:
4969
+ application/json:
4970
+ schema:
4971
+ type: object
4972
+ required: [chain]
4973
+ properties:
4974
+ chain: { type: string }
4975
+ label: { type: string }
4976
+ treasury_wallet_id: { type: string, format: uuid }
4977
+ responses:
4978
+ "201":
4979
+ description: Destination created
4980
+ "401":
4981
+ $ref: "#/components/responses/Unauthorized"
4982
+ get:
4983
+ tags: [Treasury]
4984
+ summary: List deposit destinations
4985
+ operationId: listDepositDestinations
4986
+ security:
4987
+ - BearerAuth: []
4988
+ responses:
4989
+ "200":
4990
+ description: List of destinations
4991
+
4992
+ /v1/deposit-destinations/{id}:
4993
+ get:
4994
+ tags: [Treasury]
4995
+ summary: Get deposit destination
4996
+ operationId: getDepositDestination
4997
+ security:
4998
+ - BearerAuth: []
4999
+ parameters:
5000
+ - name: id
5001
+ in: path
5002
+ required: true
5003
+ schema: { type: string, format: uuid }
5004
+ responses:
5005
+ "200":
5006
+ description: Destination detail with events
5007
+ patch:
5008
+ tags: [Treasury]
5009
+ summary: Update deposit destination status
5010
+ operationId: updateDepositDestination
5011
+ security:
5012
+ - BearerAuth: []
5013
+ parameters:
5014
+ - name: id
5015
+ in: path
5016
+ required: true
5017
+ schema: { type: string, format: uuid }
5018
+ requestBody:
5019
+ required: true
5020
+ content:
5021
+ application/json:
5022
+ schema:
5023
+ type: object
5024
+ properties:
5025
+ status: { type: string, enum: [active, paused, archived] }
5026
+ responses:
5027
+ "200":
5028
+ description: Updated destination
5029
+
5030
+ /v1/internal-accounts:
5031
+ post:
5032
+ tags: [Treasury]
5033
+ summary: Create internal account
5034
+ operationId: createInternalAccount
5035
+ security:
5036
+ - BearerAuth: []
5037
+ requestBody:
5038
+ required: true
5039
+ content:
5040
+ application/json:
5041
+ schema:
5042
+ type: object
5043
+ required: [name]
5044
+ properties:
5045
+ name: { type: string }
5046
+ description: { type: string }
5047
+ responses:
5048
+ "201":
5049
+ description: Account created
5050
+ get:
5051
+ tags: [Treasury]
5052
+ summary: List internal accounts
5053
+ operationId: listInternalAccounts
5054
+ security:
5055
+ - BearerAuth: []
5056
+ responses:
5057
+ "200":
5058
+ description: Account list with balances
5059
+
5060
+ /v1/internal-accounts/{id}:
5061
+ get:
5062
+ tags: [Treasury]
5063
+ summary: Get internal account
5064
+ operationId: getInternalAccount
5065
+ security:
5066
+ - BearerAuth: []
5067
+ parameters:
5068
+ - name: id
5069
+ in: path
5070
+ required: true
5071
+ schema: { type: string, format: uuid }
5072
+ responses:
5073
+ "200":
5074
+ description: Account detail
5075
+
5076
+ /v1/internal-accounts/{id}/ledger:
5077
+ get:
5078
+ tags: [Treasury]
5079
+ summary: Get account ledger
5080
+ operationId: getInternalAccountLedger
5081
+ security:
5082
+ - BearerAuth: []
5083
+ parameters:
5084
+ - name: id
5085
+ in: path
5086
+ required: true
5087
+ schema: { type: string, format: uuid }
5088
+ responses:
5089
+ "200":
5090
+ description: Ledger entries
5091
+
5092
+ /v1/internal-transfers:
5093
+ post:
5094
+ tags: [Treasury]
5095
+ summary: Transfer between internal accounts
5096
+ operationId: createInternalTransfer
5097
+ security:
5098
+ - BearerAuth: []
5099
+ requestBody:
5100
+ required: true
5101
+ content:
5102
+ application/json:
5103
+ schema:
5104
+ type: object
5105
+ required: [from_account_id, to_account_id, asset, amount]
5106
+ properties:
5107
+ from_account_id: { type: string, format: uuid }
5108
+ to_account_id: { type: string, format: uuid }
5109
+ asset: { type: string }
5110
+ amount: { type: string }
5111
+ memo: { type: string }
5112
+ responses:
5113
+ "201":
5114
+ description: Transfer completed
5115
+
5116
+ /v1/fiat/onramp/session:
5117
+ post:
5118
+ tags: [Billing]
5119
+ summary: Create fiat onramp session
5120
+ operationId: createFiatOnrampSession
5121
+ security:
5122
+ - BearerAuth: []
5123
+ responses:
5124
+ "201":
5125
+ description: Onramp widget URL
5126
+
5127
+ /v1/fiat/offramp/initiate:
5128
+ post:
5129
+ tags: [Billing]
5130
+ summary: Initiate fiat offramp
5131
+ operationId: initiateFiatOfframp
5132
+ security:
5133
+ - BearerAuth: []
5134
+ responses:
5135
+ "201":
5136
+ description: Offramp widget URL
5137
+
5138
+ /v1/auth/social-login:
5139
+ post:
5140
+ tags: [Authentication]
5141
+ summary: Social login (Google, Apple, Discord)
5142
+ operationId: socialLogin
5143
+ security: []
5144
+ requestBody:
5145
+ required: true
5146
+ content:
5147
+ application/json:
5148
+ schema:
5149
+ type: object
5150
+ required: [provider, id_token]
5151
+ properties:
5152
+ provider: { type: string, enum: [google, apple, discord] }
5153
+ id_token:
5154
+ type: string
5155
+ description: Google/Apple ID token, or Discord OAuth authorization code
5156
+ oauth_redirect_uri:
5157
+ type: string
5158
+ description: Required for Discord — must match the redirect URI used in the OAuth flow
5159
+ auto_provision_chains:
5160
+ type: array
5161
+ items: { type: string }
5162
+ responses:
5163
+ "200":
5164
+ description: Login successful
5165
+ "201":
5166
+ description: New user created
5167
+ "409":
5168
+ description: Email already registered (no auto-linking)
5169
+ "401":
5170
+ description: Invalid or unverified token
5171
+
5172
+ /v1/auth/passkeys/tx-assert/begin:
5173
+ post:
5174
+ tags: [Authentication]
5175
+ summary: Begin passkey transaction authorization
5176
+ operationId: passkeyTxAssertBegin
5177
+ security:
5178
+ - BearerAuth: []
5179
+ responses:
5180
+ "200":
5181
+ description: WebAuthn challenge
5182
+
5183
+ /v1/auth/passkeys/tx-assert/complete:
5184
+ post:
5185
+ tags: [Authentication]
5186
+ summary: Complete passkey transaction authorization
5187
+ operationId: passkeyTxAssertComplete
5188
+ security:
5189
+ - BearerAuth: []
5190
+ responses:
5191
+ "200":
5192
+ description: Passkey token for X-Passkey-Token header
5193
+
4959
5194
  # =============================================================================
4960
5195
  # COMPONENTS
4961
5196
  # =============================================================================
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@1claw/openapi-spec",
3
- "version": "0.29.1",
3
+ "version": "0.31.0",
4
4
  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
5
5
  "license": "MIT",
6
6
  "repository": {