@1claw/openapi-spec 0.32.1 → 0.34.0

package/openapi.json

@@ -114,6 +114,14 @@
     {
       "name": "Platform",
       "description": "Platform API for developers building on 1Claw (plt_ keys, user provisioning, bootstrap templates)"
+    },
+    {
+      "name": "OAuth",
+      "description": "OAuth 2.0 authorization server (PKCE, consent, token exchange, OIDC UserInfo)"
+    },
+    {
+      "name": "Risk Engine",
+      "description": "Risk events, verdicts, and honeytoken management"
     }
   ],
   "paths": {
@@ -4273,6 +4281,74 @@
         }
       }
     },
+    "/v1/org/bankr-config": {
+      "get": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Get org Bankr partner configuration",
+        "description": "Returns whether the org has configured Bankr BYOK (partner key prefix and default wallet only — never the secret). Users only.",
+        "operationId": "getOrgBankrConfig",
+        "responses": {
+          "200": {
+            "description": "Bankr configuration status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgBankrConfigResponse"
+                }
+              }
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Set org Bankr partner configuration",
+        "description": "Store or replace the org's Bankr partner key (`bk_ptr_...`) and optional default wallet (`wlt_...`). Owner/admin only. Partner key encrypted at rest.",
+        "operationId": "upsertOrgBankrConfig",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpsertOrgBankrConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Configuration saved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgBankrConfigResponse"
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Remove org Bankr partner configuration",
+        "description": "Delete BYOK credentials for the org. Owner/admin only.",
+        "operationId": "deleteOrgBankrConfig",
+        "responses": {
+          "204": {
+            "description": "Configuration removed"
+          },
+          "404": {
+            "description": "Configuration not found"
+          }
+        }
+      }
+    },
     "/v1/org/invite": {
       "post": {
         "tags": [
@@ -6106,6 +6182,46 @@
         }
       }
     },
+    "/v1/treasury/wallets/spend-policy": {
+      "get": {
+        "tags": [
+          "Treasury Wallets"
+        ],
+        "summary": "Get effective spend policy for current user",
+        "description": "Returns the effective spend policy governing the authenticated user's\nwallet transactions. Resolves from per-user override (if set) or the\napp-wide default. Returns null if no policy is configured.\n",
+        "operationId": "getEffectiveSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Effective spend policy",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "policy": {
+                      "nullable": true,
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/SpendPolicyResponse"
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
     "/v1/webhooks": {
       "post": {
         "tags": [
@@ -7622,6 +7738,200 @@
         }
       }
     },
+    "/v1/platform/apps/{appId}/spend-policies": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Create wallet spend policy",
+        "description": "Create an app-wide spend policy that governs what embedded wallet users\ncan do with their wallets. Policies apply to all connected users by default\nand can be overridden per-user via connection-level policies.\n",
+        "operationId": "createSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateSpendPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Spend policy created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SpendPolicyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List spend policies for app",
+        "description": "Returns all spend policies configured for the platform app.",
+        "operationId": "listSpendPolicies",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Spend policies",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "policies": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/SpendPolicyResponse"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/{appId}/spend-policies/{policyId}": {
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Delete a spend policy",
+        "operationId": "deleteSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "policyId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deleted"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/spend-policy": {
+      "put": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Set per-user spend policy override",
+        "description": "Override the app-wide spend policy for a specific connected user. This\npolicy takes precedence over the app default. Remove by deleting the\nconnection-level policy.\n",
+        "operationId": "setUserSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateSpendPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Spend policy set",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SpendPolicyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
     "/v1/approvals": {
       "get": {
         "tags": [
@@ -8251,6 +8561,682 @@
           }
         }
       }
+    },
+    "/v1/auth/email-otp/send": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Send email OTP code",
+        "description": "Sends a 6-digit one-time code to the specified email address.\nNo authentication required. Rate-limited per IP and per email.\n",
+        "operationId": "sendEmailOtp",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "email"
+                ],
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email"
+                  },
+                  "platform_app_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Optional platform app context for embedded wallet flows"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OTP sent",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "sent"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limited"
+          }
+        }
+      }
+    },
+    "/v1/auth/email-otp/verify": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Verify email OTP and get JWT",
+        "description": "Verifies the 6-digit code sent to the user's email. If the user does not\nexist, a new account is created. Optionally auto-provisions treasury wallets\nfor the specified chains. Returns a JWT for subsequent API calls.\n",
+        "operationId": "verifyEmailOtp",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "email",
+                  "code"
+                ],
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email"
+                  },
+                  "code": {
+                    "type": "string",
+                    "description": "6-digit OTP code"
+                  },
+                  "platform_app_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "auto_provision_chains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Chains to auto-generate wallets for (e.g. [\"ethereum\", \"base\"])"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Existing user authenticated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EmailOtpVerifyResponse"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "New user created and authenticated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EmailOtpVerifyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid or expired code"
+          },
+          "429": {
+            "description": "Rate limited"
+          }
+        }
+      }
+    },
+    "/v1/oauth/authorize": {
+      "get": {
+        "tags": [
+          "OAuth"
+        ],
+        "summary": "Get OAuth consent info",
+        "description": "Returns information about the platform app requesting authorization so the\nUI can display a consent screen. Used by the 1Claw-hosted consent page.\n",
+        "operationId": "getOAuthConsent",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "client_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Platform app slug"
+          },
+          {
+            "name": "redirect_uri",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uri"
+            }
+          },
+          {
+            "name": "response_type",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "code"
+              ]
+            }
+          },
+          {
+            "name": "scope",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Space-delimited scopes (e.g. \"openid email wallet\")"
+          },
+          {
+            "name": "state",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "code_challenge",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "PKCE code challenge"
+          },
+          {
+            "name": "code_challenge_method",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "S256",
+                "plain"
+              ]
+            }
+          },
+          {
+            "name": "nonce",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "OIDC nonce for ID token replay protection"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Consent screen data",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthConsentResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid client_id, redirect_uri, or response_type"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "OAuth"
+        ],
+        "summary": "Submit OAuth consent decision",
+        "description": "The user approves or denies the authorization request. On approval, returns\na redirect URL containing the authorization code. On denial, returns a\nredirect URL with an error parameter.\n",
+        "operationId": "submitOAuthConsent",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "approve",
+                  "client_id",
+                  "redirect_uri"
+                ],
+                "properties": {
+                  "approve": {
+                    "type": "boolean"
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "redirect_uri": {
+                    "type": "string",
+                    "format": "uri"
+                  },
+                  "scope": {
+                    "type": "string"
+                  },
+                  "state": {
+                    "type": "string"
+                  },
+                  "code_challenge": {
+                    "type": "string"
+                  },
+                  "code_challenge_method": {
+                    "type": "string",
+                    "enum": [
+                      "S256",
+                      "plain"
+                    ]
+                  },
+                  "nonce": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Redirect URL with authorization code or error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "redirect_url"
+                  ],
+                  "properties": {
+                    "redirect_url": {
+                      "type": "string",
+                      "format": "uri"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request"
+          }
+        }
+      }
+    },
+    "/v1/oauth/token": {
+      "post": {
+        "tags": [
+          "OAuth"
+        ],
+        "summary": "Exchange authorization code for tokens",
+        "description": "Standard OAuth 2.0 token endpoint. Exchanges an authorization code for an\naccess token and optional OIDC ID token. Supports PKCE via `code_verifier`.\n",
+        "operationId": "exchangeOAuthToken",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "grant_type",
+                  "code",
+                  "client_id",
+                  "redirect_uri"
+                ],
+                "properties": {
+                  "grant_type": {
+                    "type": "string",
+                    "enum": [
+                      "authorization_code"
+                    ]
+                  },
+                  "code": {
+                    "type": "string"
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "redirect_uri": {
+                    "type": "string",
+                    "format": "uri"
+                  },
+                  "code_verifier": {
+                    "type": "string",
+                    "description": "PKCE code verifier (required when code_challenge was used)"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Token response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthTokenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid grant, code, or verifier"
+          },
+          "401": {
+            "description": "Invalid client credentials"
+          }
+        }
+      }
+    },
+    "/v1/oauth/userinfo": {
+      "get": {
+        "tags": [
+          "OAuth"
+        ],
+        "summary": "Get authenticated user info (OIDC UserInfo)",
+        "description": "Standard OIDC UserInfo endpoint. Returns claims about the authenticated user\nbased on the granted scopes.\n",
+        "operationId": "getOAuthUserInfo",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "User info",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthUserInfoResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/risk/events": {
+      "get": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "List risk events",
+        "description": "Returns risk events detected by the risk engine, ordered by most recent first.\nFilter by severity or principal type.\n",
+        "operationId": "listRiskEvents",
+        "parameters": [
+          {
+            "name": "severity",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "low",
+                "medium",
+                "high",
+                "critical"
+              ]
+            },
+            "description": "Filter events by severity level"
+          },
+          {
+            "name": "principal_type",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "user",
+                "agent"
+              ]
+            },
+            "description": "Filter events by principal type"
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Risk event list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RiskEventListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/risk/verdicts": {
+      "get": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "List risk verdicts",
+        "description": "Returns all active risk verdicts for the caller's organization.",
+        "operationId": "listRiskVerdicts",
+        "responses": {
+          "200": {
+            "description": "Verdict list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RiskVerdictListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/risk/verdicts/{principal_type}/{principal_id}": {
+      "get": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "Get risk verdict for a principal",
+        "description": "Returns the current risk verdict for a specific user or agent.",
+        "operationId": "getRiskVerdict",
+        "parameters": [
+          {
+            "name": "principal_type",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "user",
+                "agent"
+              ]
+            }
+          },
+          {
+            "name": "principal_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Risk verdict (null if no verdict exists)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "verdict": {
+                      "$ref": "#/components/schemas/RiskVerdict",
+                      "nullable": true
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/risk/honeytokens": {
+      "get": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "List honeytokens",
+        "description": "Returns all honeytokens (canary secrets) configured for the caller's organization.",
+        "operationId": "listHoneytokens",
+        "responses": {
+          "200": {
+            "description": "Honeytoken list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HoneytokenListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "Create a honeytoken",
+        "description": "Register a secret path as a honeytoken (canary). Any access to this secret\ntriggers a risk event and increments the trigger counter.\n",
+        "operationId": "createHoneytoken",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateHoneytokenRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Honeytoken created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "honeytoken": {
+                      "$ref": "#/components/schemas/Honeytoken"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/risk/honeytokens/{id}": {
+      "delete": {
+        "tags": [
+          "Risk Engine"
+        ],
+        "summary": "Delete a honeytoken",
+        "description": "Remove a honeytoken registration. The underlying secret is not affected.",
+        "operationId": "deleteHoneytoken",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Honeytoken deleted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "deleted": {
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
     }
   },
   "components": {
@@ -11621,6 +12607,43 @@
           }
         }
       },
+      "OrgBankrConfigResponse": {
+        "type": "object",
+        "properties": {
+          "configured": {
+            "type": "boolean"
+          },
+          "partner_key_prefix": {
+            "type": "string"
+          },
+          "default_wallet_id": {
+            "type": "string"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "using_platform_fallback": {
+            "type": "boolean"
+          }
+        }
+      },
+      "UpsertOrgBankrConfigRequest": {
+        "type": "object",
+        "required": [
+          "partner_key"
+        ],
+        "properties": {
+          "partner_key": {
+            "type": "string",
+            "description": "Bankr partner API key (bk_ptr_...)"
+          },
+          "default_wallet_id": {
+            "type": "string",
+            "description": "Default provisioned wallet (wlt_...)"
+          }
+        }
+      },
       "UsageSummaryResponse": {
         "type": "object",
         "properties": {
@@ -12379,26 +13402,264 @@
           "name": {
             "type": "string"
           },
-          "safe_address": {
-            "type": "string"
+          "safe_address": {
+            "type": "string"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "chain_id": {
+            "type": "integer"
+          },
+          "threshold": {
+            "type": "integer"
+          },
+          "created_by": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "signers": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TreasurySignerResponse"
+            }
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "TreasurySignerResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "signer_type": {
+            "type": "string",
+            "enum": [
+              "user",
+              "agent"
+            ]
+          },
+          "signer_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "signer_address": {
+            "type": "string"
+          },
+          "added_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "AddSignerRequest": {
+        "type": "object",
+        "required": [
+          "signer_type",
+          "signer_id",
+          "signer_address"
+        ],
+        "properties": {
+          "signer_type": {
+            "type": "string",
+            "enum": [
+              "user",
+              "agent"
+            ]
+          },
+          "signer_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "signer_address": {
+            "type": "string"
+          }
+        }
+      },
+      "AccessRequestResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "treasury_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "approved",
+              "denied"
+            ]
+          },
+          "reason": {
+            "type": "string"
+          },
+          "requested_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "resolved_by": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "resolved_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateTreasuryProposalRequest": {
+        "type": "object",
+        "required": [
+          "to_address",
+          "value_wei",
+          "chain"
+        ],
+        "properties": {
+          "to_address": {
+            "type": "string",
+            "description": "Destination address (0x-prefixed)"
+          },
+          "value_wei": {
+            "type": "string",
+            "description": "Transaction value in wei"
+          },
+          "chain": {
+            "type": "string",
+            "description": "Chain name (e.g. ethereum, base)"
+          },
+          "chain_id": {
+            "type": "integer",
+            "description": "Numeric chain ID (alternative to chain name)"
+          },
+          "data_hex": {
+            "type": "string",
+            "description": "Hex-encoded calldata (optional)"
+          },
+          "operation": {
+            "type": "integer",
+            "description": "Safe operation type (0 = Call, 1 = DelegateCall)",
+            "default": 0
+          }
+        }
+      },
+      "SignTreasuryProposalRequest": {
+        "type": "object",
+        "required": [
+          "decision"
+        ],
+        "properties": {
+          "decision": {
+            "type": "string",
+            "enum": [
+              "approve",
+              "reject"
+            ],
+            "description": "Whether to approve or reject the proposal"
+          },
+          "signature": {
+            "type": "string",
+            "description": "EIP-712 signature (hex). If omitted, server signs with caller's key."
+          }
+        }
+      },
+      "TreasuryProposalResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "treasury_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "proposed_by": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "proposed_by_type": {
+            "type": "string",
+            "enum": [
+              "user",
+              "agent"
+            ]
+          },
+          "chain": {
+            "type": "string"
+          },
+          "chain_id": {
+            "type": "integer"
+          },
+          "safe_address": {
+            "type": "string"
+          },
+          "to_address": {
+            "type": "string"
+          },
+          "value_wei": {
+            "type": "string"
+          },
+          "data_hex": {
+            "type": "string",
+            "nullable": true
+          },
+          "operation": {
+            "type": "integer"
+          },
+          "safe_tx_hash": {
+            "type": "string",
+            "nullable": true
           },
-          "chain": {
-            "type": "string"
+          "nonce": {
+            "type": "integer",
+            "nullable": true
           },
-          "chain_id": {
-            "type": "integer"
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "approved",
+              "executing",
+              "executed",
+              "rejected",
+              "expired"
+            ]
           },
           "threshold": {
             "type": "integer"
           },
-          "created_by": {
+          "expires_at": {
             "type": "string",
-            "format": "uuid"
+            "format": "date-time",
+            "nullable": true
           },
-          "signers": {
+          "executed_tx_hash": {
+            "type": "string",
+            "nullable": true
+          },
+          "executed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "signatures": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/TreasurySignerResponse"
+              "$ref": "#/components/schemas/ProposalSignatureResponse"
             }
           },
           "created_at": {
@@ -12407,13 +13668,17 @@
           }
         }
       },
-      "TreasurySignerResponse": {
+      "ProposalSignatureResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
+          "signer_id": {
+            "type": "string",
+            "format": "uuid"
+          },
           "signer_type": {
             "type": "string",
             "enum": [
@@ -12421,312 +13686,350 @@
               "agent"
             ]
           },
-          "signer_id": {
-            "type": "string",
-            "format": "uuid"
-          },
           "signer_address": {
             "type": "string"
           },
-          "added_at": {
+          "signature": {
+            "type": "string"
+          },
+          "decision": {
+            "type": "string",
+            "enum": [
+              "approve",
+              "reject"
+            ]
+          },
+          "created_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "AddSignerRequest": {
+      "TreasuryProposalListResponse": {
         "type": "object",
-        "required": [
-          "signer_type",
-          "signer_id",
-          "signer_address"
-        ],
         "properties": {
-          "signer_type": {
-            "type": "string",
-            "enum": [
-              "user",
-              "agent"
-            ]
-          },
-          "signer_id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "signer_address": {
-            "type": "string"
+          "proposals": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TreasuryProposalResponse"
+            }
           }
         }
       },
-      "AccessRequestResponse": {
+      "GenerateTreasuryWalletsRequest": {
+        "type": "object",
+        "properties": {
+          "chains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Chains to generate wallets for (e.g. [\"ethereum\", \"solana\"]). Omit for all supported chains."
+          }
+        }
+      },
+      "TreasuryWalletResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "treasury_id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "agent_id": {
-            "type": "string",
-            "format": "uuid"
+          "chain": {
+            "type": "string"
           },
-          "status": {
+          "curve": {
             "type": "string",
-            "enum": [
-              "pending",
-              "approved",
-              "denied"
-            ]
+            "description": "Cryptographic curve (e.g. secp256k1, ed25519)"
           },
-          "reason": {
+          "public_key_hex": {
             "type": "string"
           },
-          "requested_at": {
-            "type": "string",
-            "format": "date-time"
+          "address": {
+            "type": "string"
           },
-          "resolved_by": {
-            "type": "string",
-            "format": "uuid"
+          "is_active": {
+            "type": "boolean"
           },
-          "resolved_at": {
+          "created_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "CreateTreasuryProposalRequest": {
+      "TreasuryWalletListResponse": {
+        "type": "object",
+        "properties": {
+          "wallets": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TreasuryWalletResponse"
+            }
+          }
+        }
+      },
+      "TreasuryWalletExportResponse": {
         "type": "object",
-        "required": [
-          "to_address",
-          "value_wei",
-          "chain"
-        ],
         "properties": {
-          "to_address": {
-            "type": "string",
-            "description": "Destination address (0x-prefixed)"
-          },
-          "value_wei": {
-            "type": "string",
-            "description": "Transaction value in wei"
-          },
           "chain": {
-            "type": "string",
-            "description": "Chain name (e.g. ethereum, base)"
+            "type": "string"
           },
-          "chain_id": {
-            "type": "integer",
-            "description": "Numeric chain ID (alternative to chain name)"
+          "address": {
+            "type": "string"
           },
-          "data_hex": {
+          "private_key_hex": {
             "type": "string",
-            "description": "Hex-encoded calldata (optional)"
-          },
-          "operation": {
-            "type": "integer",
-            "description": "Safe operation type (0 = Call, 1 = DelegateCall)",
-            "default": 0
+            "description": "Raw private key in hex encoding. Handle with extreme care."
           }
         }
       },
-      "SignTreasuryProposalRequest": {
+      "TreasuryWalletBalanceResponse": {
         "type": "object",
         "required": [
-          "decision"
+          "chain",
+          "address",
+          "native"
         ],
         "properties": {
-          "decision": {
-            "type": "string",
-            "enum": [
-              "approve",
-              "reject"
+          "chain": {
+            "type": "string"
+          },
+          "address": {
+            "type": "string"
+          },
+          "native": {
+            "type": "object",
+            "required": [
+              "symbol",
+              "balance_wei",
+              "balance_display"
             ],
-            "description": "Whether to approve or reject the proposal"
+            "properties": {
+              "symbol": {
+                "type": "string"
+              },
+              "balance_wei": {
+                "type": "string"
+              },
+              "balance_display": {
+                "type": "string"
+              }
+            }
           },
-          "signature": {
-            "type": "string",
-            "description": "EIP-712 signature (hex). If omitted, server signs with caller's key."
+          "tokens": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "contract_address",
+                "balance_raw"
+              ],
+              "properties": {
+                "contract_address": {
+                  "type": "string"
+                },
+                "balance_raw": {
+                  "type": "string"
+                }
+              }
+            }
           }
         }
       },
-      "TreasuryProposalResponse": {
+      "TreasuryWalletSendRequest": {
         "type": "object",
+        "required": [
+          "to",
+          "value_wei"
+        ],
         "properties": {
-          "id": {
+          "to": {
             "type": "string",
-            "format": "uuid"
+            "description": "Destination address (0x-prefixed)"
           },
-          "treasury_id": {
+          "value_wei": {
             "type": "string",
-            "format": "uuid"
+            "description": "Value in wei"
           },
-          "proposed_by": {
+          "data": {
             "type": "string",
-            "format": "uuid"
+            "description": "Hex-encoded calldata (optional)"
           },
-          "proposed_by_type": {
-            "type": "string",
-            "enum": [
-              "user",
-              "agent"
-            ]
+          "gas_limit": {
+            "type": "integer",
+            "description": "Gas limit override"
           },
-          "chain": {
+          "gasless": {
+            "type": "boolean",
+            "description": "When true, submits as a gasless (ERC-4337) transaction via Pimlico paymaster. The paymaster sponsors the gas cost.",
+            "default": false
+          }
+        }
+      },
+      "TreasuryWalletSendResponse": {
+        "type": "object",
+        "required": [
+          "tx_hash",
+          "from",
+          "to",
+          "value_wei",
+          "chain",
+          "status"
+        ],
+        "properties": {
+          "tx_hash": {
             "type": "string"
           },
-          "chain_id": {
-            "type": "integer"
-          },
-          "safe_address": {
+          "from": {
             "type": "string"
           },
-          "to_address": {
+          "to": {
             "type": "string"
           },
           "value_wei": {
             "type": "string"
           },
-          "data_hex": {
-            "type": "string",
-            "nullable": true
-          },
-          "operation": {
-            "type": "integer"
-          },
-          "safe_tx_hash": {
-            "type": "string",
-            "nullable": true
-          },
-          "nonce": {
-            "type": "integer",
-            "nullable": true
+          "chain": {
+            "type": "string"
           },
           "status": {
-            "type": "string",
-            "enum": [
-              "pending",
-              "approved",
-              "executing",
-              "executed",
-              "rejected",
-              "expired"
-            ]
-          },
-          "threshold": {
-            "type": "integer"
+            "type": "string"
           },
-          "expires_at": {
+          "user_op_hash": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true
-          },
-          "executed_tx_hash": {
+            "description": "UserOperation hash (only present for gasless sends via paymaster)"
+          }
+        }
+      },
+      "TreasuryWalletSwapRequest": {
+        "type": "object",
+        "required": [
+          "sell_token",
+          "buy_token",
+          "sell_amount"
+        ],
+        "properties": {
+          "sell_token": {
             "type": "string",
-            "nullable": true
+            "description": "Address of the token to sell (or \"native\" for ETH)"
           },
-          "executed_at": {
+          "buy_token": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true
-          },
-          "signatures": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ProposalSignatureResponse"
-            }
+            "description": "Address of the token to buy (or \"native\" for ETH)"
           },
-          "created_at": {
+          "sell_amount": {
             "type": "string",
-            "format": "date-time"
+            "description": "Amount to sell in token's smallest unit"
           }
         }
       },
-      "ProposalSignatureResponse": {
+      "TreasuryWalletSwapResponse": {
         "type": "object",
+        "required": [
+          "tx_hash",
+          "sell_token",
+          "buy_token",
+          "sell_amount",
+          "buy_amount",
+          "chain",
+          "status"
+        ],
         "properties": {
-          "id": {
-            "type": "string",
-            "format": "uuid"
+          "tx_hash": {
+            "type": "string"
           },
-          "signer_id": {
-            "type": "string",
-            "format": "uuid"
+          "sell_token": {
+            "type": "string"
           },
-          "signer_type": {
-            "type": "string",
-            "enum": [
-              "user",
-              "agent"
-            ]
+          "buy_token": {
+            "type": "string"
           },
-          "signer_address": {
+          "sell_amount": {
             "type": "string"
           },
-          "signature": {
+          "buy_amount": {
             "type": "string"
           },
-          "decision": {
-            "type": "string",
-            "enum": [
-              "approve",
-              "reject"
-            ]
+          "chain": {
+            "type": "string"
           },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
+          "status": {
+            "type": "string"
           }
         }
       },
-      "TreasuryProposalListResponse": {
+      "CreateWebhookRequest": {
         "type": "object",
+        "required": [
+          "url",
+          "events"
+        ],
         "properties": {
-          "proposals": {
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "HTTPS URL to deliver webhook events to"
+          },
+          "events": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/TreasuryProposalResponse"
-            }
+              "type": "string"
+            },
+            "description": "Event types to subscribe to"
+          },
+          "description": {
+            "type": "string"
           }
         }
       },
-      "GenerateTreasuryWalletsRequest": {
+      "UpdateWebhookRequest": {
         "type": "object",
         "properties": {
-          "chains": {
+          "url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "events": {
             "type": "array",
             "items": {
               "type": "string"
-            },
-            "description": "Chains to generate wallets for (e.g. [\"ethereum\", \"solana\"]). Omit for all supported chains."
+            }
+          },
+          "is_active": {
+            "type": "boolean"
+          },
+          "description": {
+            "type": "string"
           }
         }
       },
-      "TreasuryWalletResponse": {
+      "WebhookCreatedResponse": {
         "type": "object",
+        "required": [
+          "id",
+          "url",
+          "events",
+          "secret",
+          "created_at"
+        ],
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "chain": {
-            "type": "string"
-          },
-          "curve": {
+          "url": {
             "type": "string",
-            "description": "Cryptographic curve (e.g. secp256k1, ed25519)"
-          },
-          "public_key_hex": {
-            "type": "string"
+            "format": "uri"
           },
-          "address": {
-            "type": "string"
+          "events": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           },
-          "is_active": {
-            "type": "boolean"
+          "secret": {
+            "type": "string",
+            "description": "HMAC signing secret for verifying payloads (shown only once)"
           },
           "created_at": {
             "type": "string",
@@ -12734,38 +14037,63 @@
           }
         }
       },
-      "TreasuryWalletListResponse": {
+      "WebhookResponse": {
         "type": "object",
+        "required": [
+          "id",
+          "url",
+          "events",
+          "is_active",
+          "created_at"
+        ],
         "properties": {
-          "wallets": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "events": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/TreasuryWalletResponse"
+              "type": "string"
             }
+          },
+          "is_active": {
+            "type": "boolean"
+          },
+          "description": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "TreasuryWalletExportResponse": {
+      "WebhookListResponse": {
         "type": "object",
+        "required": [
+          "webhooks"
+        ],
         "properties": {
-          "chain": {
-            "type": "string"
-          },
-          "address": {
-            "type": "string"
-          },
-          "private_key_hex": {
-            "type": "string",
-            "description": "Raw private key in hex encoding. Handle with extreme care."
+          "webhooks": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/WebhookResponse"
+            }
           }
         }
       },
-      "TreasuryWalletBalanceResponse": {
+      "SigningKeyBalanceResponse": {
         "type": "object",
         "required": [
           "chain",
           "address",
-          "native"
+          "balance_wei",
+          "balance_display"
         ],
         "properties": {
           "chain": {
@@ -12774,1127 +14102,1195 @@
           "address": {
             "type": "string"
           },
-          "native": {
-            "type": "object",
-            "required": [
-              "symbol",
-              "balance_wei",
-              "balance_display"
-            ],
-            "properties": {
-              "symbol": {
-                "type": "string"
-              },
-              "balance_wei": {
-                "type": "string"
-              },
-              "balance_display": {
-                "type": "string"
-              }
-            }
+          "balance_wei": {
+            "type": "string"
           },
-          "tokens": {
+          "balance_display": {
+            "type": "string"
+          }
+        }
+      },
+      "PaymentRequirement": {
+        "type": "object",
+        "properties": {
+          "x402Version": {
+            "type": "integer"
+          },
+          "accepts": {
             "type": "array",
             "items": {
               "type": "object",
-              "required": [
-                "contract_address",
-                "balance_raw"
-              ],
               "properties": {
-                "contract_address": {
+                "scheme": {
                   "type": "string"
                 },
-                "balance_raw": {
+                "network": {
+                  "type": "string"
+                },
+                "payTo": {
+                  "type": "string"
+                },
+                "price": {
                   "type": "string"
+                },
+                "requiredDeadlineSeconds": {
+                  "type": "integer"
                 }
               }
             }
+          },
+          "description": {
+            "type": "string"
           }
         }
       },
-      "TreasuryWalletSendRequest": {
+      "ShroudActivityEvent": {
         "type": "object",
-        "required": [
-          "to",
-          "value_wei"
-        ],
         "properties": {
-          "to": {
+          "id": {
             "type": "string",
-            "description": "Destination address (0x-prefixed)"
+            "format": "uuid"
           },
-          "value_wei": {
+          "org_id": {
             "type": "string",
-            "description": "Value in wei"
+            "format": "uuid"
           },
-          "data": {
+          "agent_id": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "model": {
+            "type": "string"
+          },
+          "action": {
             "type": "string",
-            "description": "Hex-encoded calldata (optional)"
+            "description": "Action taken (allowed, blocked, warned)"
           },
-          "gas_limit": {
+          "request_tokens": {
+            "type": "integer"
+          },
+          "response_tokens": {
+            "type": "integer"
+          },
+          "latency_ms": {
+            "type": "integer"
+          },
+          "had_secrets_redacted": {
+            "type": "boolean"
+          },
+          "had_pii_detected": {
+            "type": "boolean"
+          },
+          "injection_score": {
+            "type": "number"
+          },
+          "policy_violations": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "response_injection_score": {
+            "type": "number",
+            "description": "Response-side prompt-injection score (0.0–1.0)."
+          },
+          "response_context_injection_score": {
+            "type": "number",
+            "description": "Response-side context-injection score (0.0–1.0)."
+          },
+          "response_injection_categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Category tags emitted by the response-side filters (e.g. `markdown_image_exfil`, `data_uri_blob`, `echoed_instruction`)."
+          },
+          "external_urls_flagged": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "URLs emitted by the model that were flagged as potential exfil / callback targets."
+          },
+          "unexpected_code_blocks": {
             "type": "integer",
-            "description": "Gas limit override"
+            "description": "Number of code fences in the response that were not expected for the agent's allowed task set."
           },
-          "gasless": {
+          "content_filtered": {
             "type": "boolean",
-            "description": "When true, submits as a gasless (ERC-4337) transaction via Pimlico paymaster. The paymaster sponsors the gas cost.",
-            "default": false
+            "description": "True when Shroud rewrote or blocked response content before returning it to the agent."
+          },
+          "metadata": {
+            "type": "object"
+          },
+          "timestamp": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "TreasuryWalletSendResponse": {
+      "IngestShroudActivityRequest": {
         "type": "object",
         "required": [
-          "tx_hash",
-          "from",
-          "to",
-          "value_wei",
-          "chain",
-          "status"
+          "agent_id",
+          "action"
         ],
         "properties": {
-          "tx_hash": {
+          "agent_id": {
             "type": "string"
           },
-          "from": {
+          "provider": {
             "type": "string"
           },
-          "to": {
+          "model": {
             "type": "string"
           },
-          "value_wei": {
+          "action": {
             "type": "string"
           },
-          "chain": {
-            "type": "string"
+          "request_tokens": {
+            "type": "integer",
+            "default": 0
           },
-          "status": {
-            "type": "string"
+          "response_tokens": {
+            "type": "integer",
+            "default": 0
+          },
+          "latency_ms": {
+            "type": "integer"
+          },
+          "had_secrets_redacted": {
+            "type": "boolean",
+            "default": false
+          },
+          "had_pii_detected": {
+            "type": "boolean",
+            "default": false
+          },
+          "injection_score": {
+            "type": "number",
+            "default": 0
+          },
+          "policy_violations": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "metadata": {
+            "type": "object"
+          },
+          "response_injection_score": {
+            "type": "number",
+            "default": 0
+          },
+          "response_context_injection_score": {
+            "type": "number",
+            "default": 0
+          },
+          "response_injection_categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "external_urls_flagged": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "unexpected_code_blocks": {
+            "type": "integer",
+            "default": 0
+          },
+          "content_filtered": {
+            "type": "boolean",
+            "default": false
+          }
+        }
+      },
+      "ShroudThreatSummary": {
+        "type": "object",
+        "properties": {
+          "total_requests": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "total_requests_prev": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "blocked_requests": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "detectors_triggered": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "active_agents": {
+            "type": "integer",
+            "format": "int64"
           },
-          "user_op_hash": {
-            "type": "string",
-            "description": "UserOperation hash (only present for gasless sends via paymaster)"
+          "detectors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ShroudDetectorStats"
+            }
+          },
+          "flagged_requests": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ShroudFlaggedRequest"
+            }
           }
         }
       },
-      "TreasuryWalletSwapRequest": {
+      "ShroudDetectorStats": {
         "type": "object",
-        "required": [
-          "sell_token",
-          "buy_token",
-          "sell_amount"
-        ],
         "properties": {
-          "sell_token": {
-            "type": "string",
-            "description": "Address of the token to sell (or \"native\" for ETH)"
+          "detector": {
+            "type": "string"
           },
-          "buy_token": {
-            "type": "string",
-            "description": "Address of the token to buy (or \"native\" for ETH)"
+          "detections": {
+            "type": "integer",
+            "format": "int64"
           },
-          "sell_amount": {
-            "type": "string",
-            "description": "Amount to sell in token's smallest unit"
+          "blocks": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "actions": {
+            "type": "object",
+            "properties": {
+              "blocked": {
+                "type": "integer",
+                "format": "int64"
+              },
+              "warned": {
+                "type": "integer",
+                "format": "int64"
+              },
+              "logged": {
+                "type": "integer",
+                "format": "int64"
+              }
+            }
           }
         }
       },
-      "TreasuryWalletSwapResponse": {
+      "ShroudFlaggedRequest": {
         "type": "object",
-        "required": [
-          "tx_hash",
-          "sell_token",
-          "buy_token",
-          "sell_amount",
-          "buy_amount",
-          "chain",
-          "status"
-        ],
         "properties": {
-          "tx_hash": {
+          "id": {
             "type": "string"
           },
-          "sell_token": {
-            "type": "string"
+          "timestamp": {
+            "type": "string",
+            "format": "date-time"
           },
-          "buy_token": {
+          "agent_id": {
             "type": "string"
           },
-          "sell_amount": {
+          "agent_name": {
             "type": "string"
           },
-          "buy_amount": {
-            "type": "string"
+          "score": {
+            "type": "number"
           },
-          "chain": {
+          "reason": {
             "type": "string"
           },
-          "status": {
-            "type": "string"
-          }
-        }
-      },
-      "CreateWebhookRequest": {
-        "type": "object",
-        "required": [
-          "url",
-          "events"
-        ],
-        "properties": {
-          "url": {
+          "action": {
             "type": "string",
-            "format": "uri",
-            "description": "HTTPS URL to deliver webhook events to"
-          },
-          "events": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "Event types to subscribe to"
-          },
-          "description": {
-            "type": "string"
+            "enum": [
+              "blocked",
+              "warned",
+              "logged"
+            ]
           }
         }
       },
-      "UpdateWebhookRequest": {
+      "HealthResponse": {
         "type": "object",
         "properties": {
-          "url": {
+          "status": {
             "type": "string",
-            "format": "uri"
-          },
-          "events": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          },
-          "is_active": {
-            "type": "boolean"
+            "enum": [
+              "healthy",
+              "degraded"
+            ]
           },
-          "description": {
+          "version": {
             "type": "string"
           }
         }
       },
-      "WebhookCreatedResponse": {
+      "CreatePlatformAppRequest": {
         "type": "object",
         "required": [
-          "id",
-          "url",
-          "events",
-          "secret",
-          "created_at"
+          "name",
+          "slug"
         ],
         "properties": {
-          "id": {
-            "type": "string",
-            "format": "uuid"
+          "name": {
+            "type": "string"
           },
-          "url": {
+          "slug": {
             "type": "string",
-            "format": "uri"
+            "minLength": 3,
+            "maxLength": 64,
+            "pattern": "^[a-zA-Z0-9_-]+$"
           },
-          "events": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "description": {
+            "type": "string"
           },
-          "secret": {
+          "oidc_jwks_url": {
             "type": "string",
-            "description": "HMAC signing secret for verifying payloads (shown only once)"
+            "format": "uri"
           },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
-          }
-        }
-      },
-      "WebhookResponse": {
-        "type": "object",
-        "required": [
-          "id",
-          "url",
-          "events",
-          "is_active",
-          "created_at"
-        ],
-        "properties": {
-          "id": {
+          "oidc_issuer": {
             "type": "string",
-            "format": "uuid"
+            "format": "uri"
           },
-          "url": {
+          "oidc_audience": {
             "type": "string",
-            "format": "uri"
+            "description": "Expected audience claim for OIDC token validation"
           },
-          "events": {
+          "redirect_uris": {
             "type": "array",
             "items": {
-              "type": "string"
+              "type": "string",
+              "format": "uri"
             }
           },
-          "is_active": {
-            "type": "boolean"
+          "billing_model": {
+            "type": "string",
+            "enum": [
+              "platform_pays",
+              "user_pays",
+              "hybrid"
+            ],
+            "default": "platform_pays"
           },
-          "description": {
-            "type": "string"
+          "auth_mode": {
+            "type": "string",
+            "enum": [
+              "silent",
+              "user_signin",
+              "configurable"
+            ],
+            "default": "silent"
           },
-          "created_at": {
+          "max_connected_users": {
+            "type": "integer",
+            "nullable": true
+          },
+          "api_key_expires_at": {
             "type": "string",
-            "format": "date-time"
-          }
-        }
-      },
-      "WebhookListResponse": {
-        "type": "object",
-        "required": [
-          "webhooks"
-        ],
-        "properties": {
-          "webhooks": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/WebhookResponse"
-            }
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the platform API key."
           }
         }
       },
-      "SigningKeyBalanceResponse": {
+      "UpdatePlatformAppRequest": {
         "type": "object",
-        "required": [
-          "chain",
-          "address",
-          "balance_wei",
-          "balance_display"
-        ],
         "properties": {
-          "chain": {
+          "name": {
             "type": "string"
           },
-          "address": {
+          "description": {
+            "type": "string"
+          },
+          "logo_url": {
+            "type": "string"
+          },
+          "oidc_jwks_url": {
             "type": "string"
           },
-          "balance_wei": {
+          "oidc_issuer": {
             "type": "string"
           },
-          "balance_display": {
-            "type": "string"
-          }
-        }
-      },
-      "PaymentRequirement": {
-        "type": "object",
-        "properties": {
-          "x402Version": {
-            "type": "integer"
+          "oidc_audience": {
+            "type": "string",
+            "description": "Expected audience claim for OIDC token validation"
           },
-          "accepts": {
+          "redirect_uris": {
             "type": "array",
             "items": {
-              "type": "object",
-              "properties": {
-                "scheme": {
-                  "type": "string"
-                },
-                "network": {
-                  "type": "string"
-                },
-                "payTo": {
-                  "type": "string"
-                },
-                "price": {
-                  "type": "string"
-                },
-                "requiredDeadlineSeconds": {
-                  "type": "integer"
-                }
-              }
+              "type": "string"
             }
           },
-          "description": {
+          "webhook_url": {
             "type": "string"
+          },
+          "billing_model": {
+            "type": "string",
+            "enum": [
+              "platform_pays",
+              "user_pays",
+              "hybrid"
+            ]
+          },
+          "auth_mode": {
+            "type": "string",
+            "enum": [
+              "silent",
+              "user_signin",
+              "configurable"
+            ]
+          },
+          "max_connected_users": {
+            "type": "integer",
+            "nullable": true
+          },
+          "is_active": {
+            "type": "boolean"
+          },
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "Optional expiration time for the platform API key. Set to null to clear."
           }
         }
       },
-      "ShroudActivityEvent": {
+      "PlatformAppResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "org_id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "agent_id": {
+          "name": {
             "type": "string"
           },
-          "provider": {
+          "slug": {
             "type": "string"
           },
-          "model": {
+          "description": {
             "type": "string"
           },
-          "action": {
+          "logo_url": {
             "type": "string",
-            "description": "Action taken (allowed, blocked, warned)"
-          },
-          "request_tokens": {
-            "type": "integer"
-          },
-          "response_tokens": {
-            "type": "integer"
+            "nullable": true
           },
-          "latency_ms": {
-            "type": "integer"
+          "api_key_prefix": {
+            "type": "string"
           },
-          "had_secrets_redacted": {
-            "type": "boolean"
+          "oidc_jwks_url": {
+            "type": "string",
+            "nullable": true
           },
-          "had_pii_detected": {
-            "type": "boolean"
+          "oidc_issuer": {
+            "type": "string",
+            "nullable": true
           },
-          "injection_score": {
-            "type": "number"
+          "oidc_audience": {
+            "type": "string",
+            "nullable": true,
+            "description": "Expected audience claim for OIDC token validation"
           },
-          "policy_violations": {
+          "redirect_uris": {
             "type": "array",
             "items": {
               "type": "string"
             }
           },
-          "response_injection_score": {
-            "type": "number",
-            "description": "Response-side prompt-injection score (0.0–1.0)."
+          "webhook_url": {
+            "type": "string",
+            "nullable": true
           },
-          "response_context_injection_score": {
-            "type": "number",
-            "description": "Response-side context-injection score (0.0–1.0)."
+          "is_active": {
+            "type": "boolean"
           },
-          "response_injection_categories": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "Category tags emitted by the response-side filters (e.g. `markdown_image_exfil`, `data_uri_blob`, `echoed_instruction`)."
+          "billing_model": {
+            "type": "string"
           },
-          "external_urls_flagged": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "URLs emitted by the model that were flagged as potential exfil / callback targets."
+          "auth_mode": {
+            "type": "string"
           },
-          "unexpected_code_blocks": {
+          "max_connected_users": {
             "type": "integer",
-            "description": "Number of code fences in the response that were not expected for the agent's allowed task set."
+            "nullable": true
           },
-          "content_filtered": {
-            "type": "boolean",
-            "description": "True when Shroud rewrote or blocked response content before returning it to the agent."
+          "connected_users": {
+            "type": "integer"
           },
-          "metadata": {
-            "type": "object"
+          "api_key_expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "When the platform API key expires."
           },
-          "timestamp": {
+          "api_key_rotated_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true,
+            "description": "When the platform API key was last rotated."
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "IngestShroudActivityRequest": {
+      "PlatformAppCreatedResponse": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/PlatformAppResponse"
+          },
+          {
+            "type": "object",
+            "required": [
+              "api_key"
+            ],
+            "properties": {
+              "api_key": {
+                "type": "string",
+                "description": "The platform API key. Save immediately - it cannot be retrieved again."
+              }
+            }
+          }
+        ]
+      },
+      "CreateTemplateRequest": {
         "type": "object",
         "required": [
-          "agent_id",
-          "action"
+          "name",
+          "spec"
         ],
         "properties": {
-          "agent_id": {
-            "type": "string"
-          },
-          "provider": {
-            "type": "string"
-          },
-          "model": {
+          "name": {
             "type": "string"
           },
-          "action": {
+          "description": {
             "type": "string"
           },
-          "request_tokens": {
-            "type": "integer",
-            "default": 0
-          },
-          "response_tokens": {
-            "type": "integer",
-            "default": 0
-          },
-          "latency_ms": {
-            "type": "integer"
-          },
-          "had_secrets_redacted": {
-            "type": "boolean",
-            "default": false
-          },
-          "had_pii_detected": {
-            "type": "boolean",
-            "default": false
-          },
-          "injection_score": {
-            "type": "number",
-            "default": 0
+          "spec": {
+            "type": "object",
+            "description": "Template specification defining vault, agents, policies, and signing keys to bootstrap.\nTop-level fields: `vault` (object with name, description), `agents` (array of agent specs\nwith name, description, shroud_enabled, intents, shroud_config), `policies` (array with\nvault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of\n`{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).\nWhen `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the\nbootstrapped agent.\n"
+          }
+        }
+      },
+      "PlatformTemplateResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "policy_violations": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "platform_app_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "metadata": {
-            "type": "object"
+          "name": {
+            "type": "string"
           },
-          "response_injection_score": {
-            "type": "number",
-            "default": 0
+          "description": {
+            "type": "string"
           },
-          "response_context_injection_score": {
-            "type": "number",
-            "default": 0
+          "version": {
+            "type": "integer"
           },
-          "response_injection_categories": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "spec": {
+            "type": "object"
           },
-          "external_urls_flagged": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "is_active": {
+            "type": "boolean"
           },
-          "unexpected_code_blocks": {
-            "type": "integer",
-            "default": 0
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
           },
-          "content_filtered": {
-            "type": "boolean",
-            "default": false
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "ShroudThreatSummary": {
+      "UpsertPlatformUserRequest": {
         "type": "object",
         "properties": {
-          "total_requests": {
-            "type": "integer",
-            "format": "int64"
-          },
-          "total_requests_prev": {
-            "type": "integer",
-            "format": "int64"
-          },
-          "blocked_requests": {
-            "type": "integer",
-            "format": "int64"
-          },
-          "detectors_triggered": {
-            "type": "integer",
-            "format": "int64"
+          "subject_token": {
+            "type": "string",
+            "description": "OIDC JWT from the platform's IdP (verified against JWKS)"
           },
-          "active_agents": {
-            "type": "integer",
-            "format": "int64"
+          "subject_token_type": {
+            "type": "string",
+            "default": "urn:ietf:params:oauth:token-type:jwt"
           },
-          "detectors": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ShroudDetectorStats"
-            }
+          "email": {
+            "type": "string",
+            "format": "email",
+            "description": "Fallback when subject_token is not provided"
           },
-          "flagged_requests": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ShroudFlaggedRequest"
-            }
+          "display_name": {
+            "type": "string"
           }
         }
       },
-      "ShroudDetectorStats": {
+      "PlatformUserResponse": {
         "type": "object",
         "properties": {
-          "detector": {
-            "type": "string"
+          "user_handle": {
+            "type": "string",
+            "format": "uuid"
           },
-          "detections": {
-            "type": "integer",
-            "format": "int64"
+          "is_new": {
+            "type": "boolean"
           },
-          "blocks": {
-            "type": "integer",
-            "format": "int64"
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "actions": {
-            "type": "object",
-            "properties": {
-              "blocked": {
-                "type": "integer",
-                "format": "int64"
-              },
-              "warned": {
-                "type": "integer",
-                "format": "int64"
-              },
-              "logged": {
-                "type": "integer",
-                "format": "int64"
-              }
-            }
+          "email": {
+            "type": "string"
           }
         }
       },
-      "ShroudFlaggedRequest": {
+      "PlatformConnectedUserResponse": {
         "type": "object",
         "properties": {
-          "id": {
-            "type": "string"
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "timestamp": {
+          "user_id": {
             "type": "string",
-            "format": "date-time"
+            "format": "uuid"
           },
-          "agent_id": {
+          "external_subject": {
             "type": "string"
           },
-          "agent_name": {
+          "status": {
             "type": "string"
           },
-          "score": {
-            "type": "number"
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
           },
-          "reason": {
-            "type": "string"
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
           },
-          "action": {
+          "created_at": {
             "type": "string",
-            "enum": [
-              "blocked",
-              "warned",
-              "logged"
-            ]
+            "format": "date-time"
+          },
+          "claimed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
           }
         }
       },
-      "HealthResponse": {
+      "BootstrapRequest": {
         "type": "object",
         "properties": {
-          "status": {
+          "template_id": {
             "type": "string",
-            "enum": [
-              "healthy",
-              "degraded"
-            ]
+            "format": "uuid",
+            "description": "Template to use. Falls back to the app's default template."
           },
-          "version": {
-            "type": "string"
+          "return_to": {
+            "type": "string",
+            "format": "uri",
+            "description": "URL to redirect the user to after claiming resources."
           }
         }
       },
-      "CreatePlatformAppRequest": {
+      "BootstrapResponse": {
         "type": "object",
-        "required": [
-          "name",
-          "slug"
-        ],
         "properties": {
-          "name": {
-            "type": "string"
-          },
-          "slug": {
+          "claim_url": {
             "type": "string",
-            "minLength": 3,
-            "maxLength": 64,
-            "pattern": "^[a-zA-Z0-9_-]+$"
+            "format": "uri"
           },
-          "description": {
+          "claim_token": {
             "type": "string"
           },
-          "oidc_jwks_url": {
+          "expires_in": {
+            "type": "integer",
+            "description": "Seconds until the claim token expires"
+          },
+          "connection_id": {
             "type": "string",
-            "format": "uri"
+            "format": "uuid"
+          },
+          "summary": {
+            "type": "object",
+            "properties": {
+              "vault_id": {
+                "type": "string",
+                "format": "uuid",
+                "nullable": true
+              },
+              "agent_id": {
+                "type": "string",
+                "format": "uuid",
+                "nullable": true
+              },
+              "policy_ids": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              },
+              "signing_key_chains": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Chains with provisioned signing keys"
+              },
+              "agent_api_key": {
+                "type": "string",
+                "nullable": true,
+                "description": "One-time agent API key (ocv_ prefix). Store securely — not retrievable later."
+              },
+              "signing_keys": {
+                "type": "array",
+                "description": "Provisioned signing key details (chain, address, public key)",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "chain": {
+                      "type": "string"
+                    },
+                    "curve": {
+                      "type": "string"
+                    },
+                    "public_key": {
+                      "type": "string"
+                    },
+                    "address": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "ConnectedAppResponse": {
+        "type": "object",
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "app_name": {
+            "type": "string"
           },
-          "oidc_issuer": {
-            "type": "string",
-            "format": "uri"
+          "app_slug": {
+            "type": "string"
           },
-          "oidc_audience": {
-            "type": "string",
-            "description": "Expected audience claim for OIDC token validation"
+          "status": {
+            "type": "string"
           },
-          "redirect_uris": {
+          "vault_ids": {
             "type": "array",
             "items": {
               "type": "string",
-              "format": "uri"
+              "format": "uuid"
             }
           },
-          "billing_model": {
-            "type": "string",
-            "enum": [
-              "platform_pays",
-              "user_pays",
-              "hybrid"
-            ],
-            "default": "platform_pays"
-          },
-          "auth_mode": {
-            "type": "string",
-            "enum": [
-              "silent",
-              "user_signin",
-              "configurable"
-            ],
-            "default": "silent"
-          },
-          "max_connected_users": {
-            "type": "integer",
-            "nullable": true
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
           },
-          "api_key_expires_at": {
+          "created_at": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true,
-            "description": "Optional expiration time for the platform API key."
+            "format": "date-time"
           }
         }
       },
-      "UpdatePlatformAppRequest": {
+      "ClaimPreviewResponse": {
         "type": "object",
         "properties": {
-          "name": {
-            "type": "string"
-          },
-          "description": {
+          "app_name": {
             "type": "string"
           },
-          "logo_url": {
+          "app_slug": {
             "type": "string"
           },
-          "oidc_jwks_url": {
-            "type": "string"
+          "app_logo_url": {
+            "type": "string",
+            "nullable": true
           },
-          "oidc_issuer": {
+          "auth_mode": {
             "type": "string"
           },
-          "oidc_audience": {
-            "type": "string",
-            "description": "Expected audience claim for OIDC token validation"
-          },
-          "redirect_uris": {
+          "vault_ids": {
             "type": "array",
             "items": {
-              "type": "string"
+              "type": "string",
+              "format": "uuid"
             }
           },
-          "webhook_url": {
-            "type": "string"
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
           },
-          "billing_model": {
-            "type": "string",
-            "enum": [
-              "platform_pays",
-              "user_pays",
-              "hybrid"
-            ]
+          "policy_count": {
+            "type": "integer"
           },
-          "auth_mode": {
-            "type": "string",
-            "enum": [
-              "silent",
-              "user_signin",
-              "configurable"
-            ]
+          "status": {
+            "type": "string"
           },
-          "max_connected_users": {
-            "type": "integer",
-            "nullable": true
+          "already_claimed": {
+            "type": "boolean"
           },
-          "is_active": {
+          "expired": {
             "type": "boolean"
           },
-          "api_key_expires_at": {
+          "return_to": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true,
-            "description": "Optional expiration time for the platform API key. Set to null to clear."
+            "nullable": true
           }
         }
       },
-      "PlatformAppResponse": {
+      "ClaimRedeemResponse": {
         "type": "object",
         "properties": {
-          "id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "name": {
-            "type": "string"
-          },
-          "slug": {
-            "type": "string"
-          },
-          "description": {
-            "type": "string"
-          },
-          "logo_url": {
-            "type": "string",
-            "nullable": true
-          },
-          "api_key_prefix": {
+          "status": {
             "type": "string"
           },
-          "oidc_jwks_url": {
-            "type": "string",
-            "nullable": true
-          },
-          "oidc_issuer": {
+          "connection_id": {
             "type": "string",
-            "nullable": true
+            "format": "uuid"
           },
-          "oidc_audience": {
-            "type": "string",
-            "nullable": true,
-            "description": "Expected audience claim for OIDC token validation"
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
           },
-          "redirect_uris": {
+          "agent_ids": {
             "type": "array",
             "items": {
-              "type": "string"
+              "type": "string",
+              "format": "uuid"
             }
           },
-          "webhook_url": {
+          "return_to": {
             "type": "string",
             "nullable": true
           },
-          "is_active": {
-            "type": "boolean"
-          },
-          "billing_model": {
-            "type": "string"
-          },
-          "auth_mode": {
+          "dashboard_url": {
             "type": "string"
-          },
-          "max_connected_users": {
-            "type": "integer",
-            "nullable": true
-          },
-          "connected_users": {
-            "type": "integer"
-          },
-          "api_key_expires_at": {
+          }
+        }
+      },
+      "RegisterDeviceRequest": {
+        "type": "object",
+        "required": [
+          "name",
+          "platform",
+          "public_key_pem"
+        ],
+        "properties": {
+          "name": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true,
-            "description": "When the platform API key expires."
+            "description": "Human-readable device name (e.g. \"Kevin's iPhone\")",
+            "example": "My iPhone"
           },
-          "api_key_rotated_at": {
+          "platform": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true,
-            "description": "When the platform API key was last rotated."
+            "enum": [
+              "ios",
+              "android"
+            ]
           },
-          "created_at": {
+          "public_key_pem": {
             "type": "string",
-            "format": "date-time"
+            "description": "PEM-encoded public key for step-up challenge signing"
           },
-          "updated_at": {
+          "attestation_blob": {
             "type": "string",
-            "format": "date-time"
+            "description": "Optional platform attestation (Apple DeviceCheck / Android SafetyNet)"
           }
         }
       },
-      "PlatformAppCreatedResponse": {
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/PlatformAppResponse"
+      "RegisterDeviceResponse": {
+        "type": "object",
+        "required": [
+          "device_id",
+          "attestation_verified"
+        ],
+        "properties": {
+          "device_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          {
-            "type": "object",
-            "required": [
-              "api_key"
-            ],
-            "properties": {
-              "api_key": {
-                "type": "string",
-                "description": "The platform API key. Save immediately - it cannot be retrieved again."
-              }
-            }
+          "attestation_verified": {
+            "type": "boolean"
           }
-        ]
+        }
       },
-      "CreateTemplateRequest": {
+      "DeviceListResponse": {
         "type": "object",
         "required": [
-          "name",
-          "spec"
+          "devices"
         ],
         "properties": {
-          "name": {
-            "type": "string"
-          },
-          "description": {
-            "type": "string"
-          },
-          "spec": {
-            "type": "object",
-            "description": "Template specification defining vault, agents, policies, and signing keys to bootstrap.\nTop-level fields: `vault` (object with name, description), `agents` (array of agent specs\nwith name, description, shroud_enabled, intents, shroud_config), `policies` (array with\nvault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of\n`{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).\nWhen `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the\nbootstrapped agent.\n"
+          "devices": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/DeviceResponse"
+            }
           }
         }
       },
-      "PlatformTemplateResponse": {
+      "DeviceResponse": {
         "type": "object",
+        "required": [
+          "id",
+          "name",
+          "platform",
+          "attestation_verified",
+          "created_at"
+        ],
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "platform_app_id": {
-            "type": "string",
-            "format": "uuid"
-          },
           "name": {
             "type": "string"
           },
-          "description": {
+          "platform": {
             "type": "string"
           },
-          "version": {
-            "type": "integer"
-          },
-          "spec": {
-            "type": "object"
-          },
-          "is_active": {
+          "attestation_verified": {
             "type": "boolean"
           },
-          "created_at": {
+          "last_used_at": {
             "type": "string",
-            "format": "date-time"
+            "format": "date-time",
+            "nullable": true
           },
-          "updated_at": {
+          "created_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "UpsertPlatformUserRequest": {
+      "CreateDeviceChallengeRequest": {
         "type": "object",
+        "required": [
+          "action",
+          "target_id"
+        ],
         "properties": {
-          "subject_token": {
+          "action": {
             "type": "string",
-            "description": "OIDC JWT from the platform's IdP (verified against JWKS)"
+            "description": "The action this challenge authorizes (e.g. \"approve_transaction\")"
           },
-          "subject_token_type": {
+          "target_id": {
             "type": "string",
-            "default": "urn:ietf:params:oauth:token-type:jwt"
+            "description": "ID of the resource the action targets"
+          }
+        }
+      },
+      "DeviceChallengeResponse": {
+        "type": "object",
+        "required": [
+          "challenge_nonce",
+          "expires_at",
+          "action_bound_hash"
+        ],
+        "properties": {
+          "challenge_nonce": {
+            "type": "string"
           },
-          "email": {
+          "expires_at": {
             "type": "string",
-            "format": "email",
-            "description": "Fallback when subject_token is not provided"
+            "format": "date-time"
           },
-          "display_name": {
-            "type": "string"
+          "action_bound_hash": {
+            "type": "string",
+            "description": "SHA-256 binding the challenge to the requested action and target"
           }
         }
       },
-      "PlatformUserResponse": {
+      "AttestDeviceChallengeRequest": {
         "type": "object",
+        "required": [
+          "challenge_nonce",
+          "signature"
+        ],
         "properties": {
-          "user_handle": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "is_new": {
-            "type": "boolean"
+          "challenge_nonce": {
+            "type": "string"
           },
-          "connection_id": {
+          "signature": {
             "type": "string",
-            "format": "uuid"
-          },
-          "email": {
-            "type": "string"
+            "description": "Signature over the challenge nonce using the device's private key"
           }
         }
       },
-      "PlatformConnectedUserResponse": {
+      "AttestDeviceChallengeResponse": {
         "type": "object",
+        "required": [
+          "step_up_token",
+          "expires_at"
+        ],
         "properties": {
-          "connection_id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "user_id": {
+          "step_up_token": {
             "type": "string",
-            "format": "uuid"
-          },
-          "external_subject": {
-            "type": "string"
-          },
-          "status": {
-            "type": "string"
-          },
-          "vault_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
-          },
-          "agent_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
+            "description": "Short-lived token authorizing the bound action"
           },
-          "created_at": {
+          "expires_at": {
             "type": "string",
             "format": "date-time"
-          },
-          "claimed_at": {
-            "type": "string",
-            "format": "date-time",
-            "nullable": true
           }
         }
       },
-      "BootstrapRequest": {
+      "RegisterPushTokenRequest": {
         "type": "object",
+        "required": [
+          "token",
+          "platform"
+        ],
         "properties": {
-          "template_id": {
+          "token": {
             "type": "string",
-            "format": "uuid",
-            "description": "Template to use. Falls back to the app's default template."
+            "description": "Push notification token from APNs or FCM"
           },
-          "return_to": {
+          "platform": {
             "type": "string",
-            "format": "uri",
-            "description": "URL to redirect the user to after claiming resources."
+            "enum": [
+              "apns",
+              "fcm"
+            ]
           }
         }
       },
-      "BootstrapResponse": {
+      "DecideApprovalRequest": {
         "type": "object",
+        "required": [
+          "decision"
+        ],
         "properties": {
-          "claim_url": {
+          "decision": {
             "type": "string",
-            "format": "uri"
-          },
-          "claim_token": {
-            "type": "string"
-          },
-          "expires_in": {
-            "type": "integer",
-            "description": "Seconds until the claim token expires"
+            "enum": [
+              "approve",
+              "reject"
+            ]
           },
-          "connection_id": {
+          "reason": {
             "type": "string",
-            "format": "uuid"
-          },
-          "summary": {
-            "type": "object",
-            "properties": {
-              "vault_id": {
-                "type": "string",
-                "format": "uuid",
-                "nullable": true
-              },
-              "agent_id": {
-                "type": "string",
-                "format": "uuid",
-                "nullable": true
-              },
-              "policy_ids": {
-                "type": "array",
-                "items": {
-                  "type": "string",
-                  "format": "uuid"
-                }
-              },
-              "signing_key_chains": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                },
-                "description": "Chains with provisioned signing keys"
-              },
-              "agent_api_key": {
-                "type": "string",
-                "nullable": true,
-                "description": "One-time agent API key (ocv_ prefix). Store securely — not retrievable later."
-              },
-              "signing_keys": {
-                "type": "array",
-                "description": "Provisioned signing key details (chain, address, public key)",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "chain": {
-                      "type": "string"
-                    },
-                    "curve": {
-                      "type": "string"
-                    },
-                    "public_key": {
-                      "type": "string"
-                    },
-                    "address": {
-                      "type": "string"
-                    }
-                  }
-                }
-              }
-            }
+            "description": "Optional human-readable reason for the decision"
           }
         }
       },
-      "ConnectedAppResponse": {
+      "ApprovalResponse": {
         "type": "object",
+        "required": [
+          "id",
+          "org_id",
+          "user_id",
+          "action",
+          "target_type",
+          "target_id",
+          "risk_tier",
+          "status",
+          "summary",
+          "created_at"
+        ],
         "properties": {
-          "connection_id": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "user_id": {
             "type": "string",
             "format": "uuid"
           },
-          "app_name": {
+          "agent_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          },
+          "action": {
             "type": "string"
           },
-          "app_slug": {
+          "target_type": {
             "type": "string"
           },
-          "status": {
+          "target_id": {
             "type": "string"
           },
-          "vault_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
+          "risk_tier": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 3
           },
-          "agent_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "approved",
+              "rejected",
+              "expired"
+            ]
+          },
+          "summary": {
+            "type": "object",
+            "description": "Structured summary of the action requiring approval"
+          },
+          "reason": {
+            "type": "string",
+            "nullable": true
+          },
+          "decision_reason": {
+            "type": "string",
+            "nullable": true
+          },
+          "decided_by": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          },
+          "decided_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
           },
           "created_at": {
             "type": "string",
@@ -13902,8 +15298,51 @@
           }
         }
       },
-      "ClaimPreviewResponse": {
+      "EmailOtpVerifyResponse": {
+        "type": "object",
+        "required": [
+          "token",
+          "user_id",
+          "org_id",
+          "is_new_user",
+          "email"
+        ],
+        "properties": {
+          "token": {
+            "type": "string",
+            "description": "JWT access token"
+          },
+          "user_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "is_new_user": {
+            "type": "boolean"
+          },
+          "email": {
+            "type": "string",
+            "format": "email"
+          },
+          "wallet_address": {
+            "type": "string",
+            "nullable": true,
+            "description": "Ethereum address if auto_provision_chains included an EVM chain"
+          }
+        }
+      },
+      "OAuthConsentResponse": {
         "type": "object",
+        "required": [
+          "app_name",
+          "app_slug",
+          "scopes",
+          "redirect_uri",
+          "already_consented"
+        ],
         "properties": {
           "app_name": {
             "type": "string"
@@ -13913,143 +15352,204 @@
           },
           "app_logo_url": {
             "type": "string",
+            "format": "uri",
             "nullable": true
           },
-          "auth_mode": {
-            "type": "string"
-          },
-          "vault_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
-          },
-          "agent_ids": {
+          "scopes": {
             "type": "array",
             "items": {
-              "type": "string",
-              "format": "uuid"
+              "type": "string"
             }
           },
-          "policy_count": {
-            "type": "integer"
-          },
-          "status": {
-            "type": "string"
-          },
-          "already_claimed": {
-            "type": "boolean"
+          "redirect_uri": {
+            "type": "string",
+            "format": "uri"
           },
-          "expired": {
+          "already_consented": {
             "type": "boolean"
-          },
-          "return_to": {
-            "type": "string",
-            "nullable": true
           }
         }
       },
-      "ClaimRedeemResponse": {
+      "OAuthTokenResponse": {
         "type": "object",
+        "required": [
+          "access_token",
+          "token_type",
+          "expires_in",
+          "scope"
+        ],
         "properties": {
-          "status": {
+          "access_token": {
             "type": "string"
           },
-          "connection_id": {
+          "token_type": {
             "type": "string",
-            "format": "uuid"
-          },
-          "vault_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
+            "enum": [
+              "Bearer"
+            ]
           },
-          "agent_ids": {
-            "type": "array",
-            "items": {
-              "type": "string",
-              "format": "uuid"
-            }
+          "expires_in": {
+            "type": "integer",
+            "description": "Token lifetime in seconds"
           },
-          "return_to": {
+          "id_token": {
             "type": "string",
-            "nullable": true
+            "nullable": true,
+            "description": "OIDC ID token (when openid scope was granted)"
           },
-          "dashboard_url": {
+          "scope": {
             "type": "string"
           }
         }
       },
-      "RegisterDeviceRequest": {
+      "OAuthUserInfoResponse": {
         "type": "object",
         "required": [
-          "name",
-          "platform",
-          "public_key_pem"
+          "sub",
+          "email"
         ],
         "properties": {
-          "name": {
+          "sub": {
             "type": "string",
-            "description": "Human-readable device name (e.g. \"Kevin's iPhone\")",
-            "example": "My iPhone"
+            "format": "uuid"
           },
-          "platform": {
+          "email": {
             "type": "string",
-            "enum": [
-              "ios",
-              "android"
-            ]
+            "format": "email"
           },
-          "public_key_pem": {
+          "name": {
             "type": "string",
-            "description": "PEM-encoded public key for step-up challenge signing"
+            "nullable": true
           },
-          "attestation_blob": {
+          "wallet_address": {
             "type": "string",
-            "description": "Optional platform attestation (Apple DeviceCheck / Android SafetyNet)"
+            "nullable": true
           }
         }
       },
-      "RegisterDeviceResponse": {
+      "CreateSpendPolicyRequest": {
         "type": "object",
-        "required": [
-          "device_id",
-          "attestation_verified"
-        ],
         "properties": {
-          "device_id": {
+          "user_id": {
             "type": "string",
-            "format": "uuid"
+            "format": "uuid",
+            "description": "Scope to a specific user (app-level policies only)"
           },
-          "attestation_verified": {
-            "type": "boolean"
+          "to_allowlist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Permitted destination addresses (empty = unrestricted)"
+          },
+          "to_denylist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Blocked destination addresses"
+          },
+          "max_value_per_tx_eth": {
+            "type": "string",
+            "description": "Maximum value per transaction in ETH (decimal string)"
+          },
+          "daily_limit_eth": {
+            "type": "string",
+            "description": "Rolling 24h spend cap in ETH (decimal string)"
+          },
+          "allowed_chains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Chains the user may transact on (empty = all enabled)"
+          },
+          "allowed_tokens": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Permitted ERC-20 token contract addresses"
+          },
+          "max_transactions_per_day": {
+            "type": "integer",
+            "description": "Maximum number of transactions per 24h window"
           }
         }
       },
-      "DeviceListResponse": {
+      "SpendPolicyResponse": {
         "type": "object",
         "required": [
-          "devices"
+          "id",
+          "platform_app_id",
+          "created_at"
         ],
         "properties": {
-          "devices": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "platform_app_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "user_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          },
+          "to_allowlist": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/DeviceResponse"
+              "type": "string"
+            }
+          },
+          "to_denylist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "max_value_per_tx_eth": {
+            "type": "string",
+            "nullable": true
+          },
+          "daily_limit_eth": {
+            "type": "string",
+            "nullable": true
+          },
+          "allowed_chains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "allowed_tokens": {
+            "type": "array",
+            "items": {
+              "type": "string"
             }
+          },
+          "max_transactions_per_day": {
+            "type": "integer",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "DeviceResponse": {
+      "RiskEvent": {
         "type": "object",
         "required": [
           "id",
-          "name",
-          "platform",
-          "attestation_verified",
+          "occurred_at",
+          "principal_type",
+          "principal_id",
+          "org_id",
+          "event_type",
+          "payload",
           "created_at"
         ],
         "properties": {
@@ -14057,221 +15557,260 @@
             "type": "string",
             "format": "uuid"
           },
-          "name": {
-            "type": "string"
+          "occurred_at": {
+            "type": "string",
+            "format": "date-time"
           },
-          "platform": {
-            "type": "string"
+          "principal_type": {
+            "type": "string",
+            "enum": [
+              "user",
+              "agent"
+            ]
           },
-          "attestation_verified": {
-            "type": "boolean"
+          "principal_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "last_used_at": {
+          "org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "event_type": {
+            "type": "string",
+            "description": "Risk event type (e.g. first_seen, geo_velocity, honeytoken_access)"
+          },
+          "ip": {
+            "type": "string",
+            "nullable": true
+          },
+          "asn": {
+            "type": "integer",
+            "nullable": true
+          },
+          "asn_org": {
+            "type": "string",
+            "nullable": true
+          },
+          "country_code": {
+            "type": "string",
+            "nullable": true
+          },
+          "region": {
+            "type": "string",
+            "nullable": true
+          },
+          "city": {
+            "type": "string",
+            "nullable": true
+          },
+          "latitude": {
+            "type": "number",
+            "nullable": true
+          },
+          "longitude": {
+            "type": "number",
+            "nullable": true
+          },
+          "user_agent": {
             "type": "string",
-            "format": "date-time",
             "nullable": true
           },
+          "payload": {
+            "type": "object",
+            "additionalProperties": true
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "CreateDeviceChallengeRequest": {
+      "RiskEventListResponse": {
         "type": "object",
         "required": [
-          "action",
-          "target_id"
+          "events"
         ],
         "properties": {
-          "action": {
-            "type": "string",
-            "description": "The action this challenge authorizes (e.g. \"approve_transaction\")"
-          },
-          "target_id": {
-            "type": "string",
-            "description": "ID of the resource the action targets"
+          "events": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RiskEvent"
+            }
           }
         }
       },
-      "DeviceChallengeResponse": {
+      "RiskVerdictReason": {
         "type": "object",
         "required": [
-          "challenge_nonce",
-          "expires_at",
-          "action_bound_hash"
+          "detector",
+          "severity",
+          "description"
         ],
         "properties": {
-          "challenge_nonce": {
+          "detector": {
             "type": "string"
           },
-          "expires_at": {
-            "type": "string",
-            "format": "date-time"
+          "severity": {
+            "type": "string"
           },
-          "action_bound_hash": {
-            "type": "string",
-            "description": "SHA-256 binding the challenge to the requested action and target"
-          }
-        }
-      },
-      "AttestDeviceChallengeRequest": {
-        "type": "object",
-        "required": [
-          "challenge_nonce",
-          "signature"
-        ],
-        "properties": {
-          "challenge_nonce": {
+          "description": {
             "type": "string"
           },
-          "signature": {
-            "type": "string",
-            "description": "Signature over the challenge nonce using the device's private key"
+          "metadata": {
+            "type": "object",
+            "additionalProperties": true
           }
         }
       },
-      "AttestDeviceChallengeResponse": {
+      "RiskVerdict": {
         "type": "object",
         "required": [
-          "step_up_token",
+          "principal_type",
+          "principal_id",
+          "org_id",
+          "score",
+          "severity",
+          "reasons",
+          "computed_at",
           "expires_at"
         ],
         "properties": {
-          "step_up_token": {
-            "type": "string",
-            "description": "Short-lived token authorizing the bound action"
+          "principal_type": {
+            "type": "string"
           },
-          "expires_at": {
+          "principal_id": {
             "type": "string",
-            "format": "date-time"
-          }
-        }
-      },
-      "RegisterPushTokenRequest": {
-        "type": "object",
-        "required": [
-          "token",
-          "platform"
-        ],
-        "properties": {
-          "token": {
+            "format": "uuid"
+          },
+          "org_id": {
             "type": "string",
-            "description": "Push notification token from APNs or FCM"
+            "format": "uuid"
           },
-          "platform": {
+          "score": {
+            "type": "number",
+            "description": "Composite risk score (0.0 – 100.0)"
+          },
+          "severity": {
             "type": "string",
             "enum": [
-              "apns",
-              "fcm"
+              "low",
+              "medium",
+              "high",
+              "critical"
             ]
+          },
+          "reasons": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RiskVerdictReason"
+            }
+          },
+          "computed_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "DecideApprovalRequest": {
+      "RiskVerdictListResponse": {
         "type": "object",
         "required": [
-          "decision"
+          "verdicts"
         ],
         "properties": {
-          "decision": {
-            "type": "string",
-            "enum": [
-              "approve",
-              "reject"
-            ]
-          },
-          "reason": {
-            "type": "string",
-            "description": "Optional human-readable reason for the decision"
+          "verdicts": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RiskVerdict"
+            }
           }
         }
       },
-      "ApprovalResponse": {
+      "Honeytoken": {
         "type": "object",
         "required": [
           "id",
+          "vault_id",
           "org_id",
-          "user_id",
-          "action",
-          "target_type",
-          "target_id",
-          "risk_tier",
-          "status",
-          "summary",
-          "created_at"
+          "secret_path",
+          "created_by",
+          "created_at",
+          "triggered_count"
         ],
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "org_id": {
+          "vault_id": {
             "type": "string",
             "format": "uuid"
           },
-          "user_id": {
+          "org_id": {
             "type": "string",
             "format": "uuid"
           },
-          "agent_id": {
-            "type": "string",
-            "format": "uuid",
-            "nullable": true
-          },
-          "action": {
-            "type": "string"
-          },
-          "target_type": {
-            "type": "string"
-          },
-          "target_id": {
+          "secret_path": {
             "type": "string"
           },
-          "risk_tier": {
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 3
-          },
-          "status": {
+          "created_by": {
             "type": "string",
-            "enum": [
-              "pending",
-              "approved",
-              "rejected",
-              "expired"
-            ]
-          },
-          "summary": {
-            "type": "object",
-            "description": "Structured summary of the action requiring approval"
+            "format": "uuid"
           },
-          "reason": {
+          "created_at": {
             "type": "string",
-            "nullable": true
+            "format": "date-time"
           },
-          "decision_reason": {
+          "notes": {
             "type": "string",
             "nullable": true
           },
-          "decided_by": {
-            "type": "string",
-            "format": "uuid",
-            "nullable": true
+          "triggered_count": {
+            "type": "integer"
           },
-          "decided_at": {
+          "last_triggered_at": {
             "type": "string",
             "format": "date-time",
             "nullable": true
+          }
+        }
+      },
+      "CreateHoneytokenRequest": {
+        "type": "object",
+        "required": [
+          "vault_id",
+          "secret_path"
+        ],
+        "properties": {
+          "vault_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "expires_at": {
+          "secret_path": {
             "type": "string",
-            "format": "date-time",
-            "nullable": true
+            "description": "Vault secret path to monitor as a canary"
           },
-          "created_at": {
+          "notes": {
             "type": "string",
-            "format": "date-time"
+            "description": "Optional human-readable notes about this honeytoken"
+          }
+        }
+      },
+      "HoneytokenListResponse": {
+        "type": "object",
+        "required": [
+          "honeytokens"
+        ],
+        "properties": {
+          "honeytokens": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Honeytoken"
+            }
           }
         }
       }