@1claw/openapi-spec 0.34.4 → 0.36.0

package/README.md

@@ -40,13 +40,16 @@ openapi-generator generate \
 import spec from "@1claw/openapi-spec/openapi.json";
 ```
 
-## What's in the spec (v0.34.1 — API `info.version` 2.19.0)
+## What's in the spec (v0.36.0 — API `info.version` 2.23.0)
+
+### Non-EVM transaction signing (2.23)
+- **Intents API** — `SubmitTransactionRequest` / `SignTransactionRequest` extended with non-EVM fields: `destination_tag` (XRP), `memo`, `fee_rate_sat_per_vbyte` (Bitcoin), `fee_limit_sun` (Tron), `token_mint` / `token_decimals` (Solana SPL + Tron TRC-20), `ttl` (Cardano). Native sign + broadcast for Bitcoin, Solana, XRP, Cardano, Tron.
 
 ### Risk Engine & DPoP (2.19)
 - **Risk events** — `GET /v1/risk/events` (list, filterable by severity/principal_type)
 - **Risk verdicts** — `GET /v1/risk/verdicts` (active verdicts), `GET /v1/risk/verdicts/{type}/{id}` (single principal verdict)
 - **Honeytokens** — `GET/POST/DELETE /v1/risk/honeytokens` (canary secret CRUD with trigger counts)
-- **DPoP** — RFC 9449 Demonstration of Proof-of-Possession token binding (planned spec addition)
+- **DPoP** — RFC 9449 Demonstration of Proof-of-Possession token binding (shipped)
 
 ### Webhooks (2.19)
 - **Webhook CRUD** — `POST/GET /v1/webhooks`, `GET/PATCH/DELETE /v1/webhooks/{id}`. Events: `wallet.transfer.*`, `proposal.*`, `agent.transaction.*`, `signing_key.rotated`, `policy.*`

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "2.21.0",
+    "version": "2.23.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -7674,6 +7674,144 @@
         }
       }
     },
+    "/v1/platform/connections/{connectionId}/grant": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Grant platform app access to vaults/agents",
+        "description": "User-authenticated. Grant the platform app access to selected vaults and agents.\nValidates user ownership of all requested resources. Creates platform_user_grants\nentries and merges resource IDs into the connection record.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/GrantResourcesRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Grants created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GrantResourcesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "No vault_ids or agent_ids provided"
+          },
+          "403": {
+            "description": "Resource not owned by caller"
+          },
+          "404": {
+            "description": "Connection not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/grants": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List active resource grants for a connection",
+        "description": "User-authenticated. Returns active (non-revoked) grants for the connection.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Grant list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GrantListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Connection not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/grants/{grantId}": {
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Revoke a resource grant",
+        "description": "User-authenticated. Revoke a specific resource grant by ID.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "grantId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Grant revoked"
+          },
+          "404": {
+            "description": "Grant not found or already revoked"
+          }
+        }
+      }
+    },
     "/v1/platform/claim/{token}": {
       "get": {
         "tags": [
@@ -11675,6 +11813,34 @@
             "type": "boolean",
             "description": "Whether to submit as a gasless (sponsored) transaction",
             "default": false
+          },
+          "destination_tag": {
+            "type": "integer",
+            "description": "Non-EVM (XRP): destination tag for exchange deposits"
+          },
+          "memo": {
+            "type": "string",
+            "description": "Non-EVM (XRP, Solana): optional memo"
+          },
+          "fee_rate_sat_per_vbyte": {
+            "type": "integer",
+            "description": "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+          },
+          "fee_limit_sun": {
+            "type": "integer",
+            "description": "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+          },
+          "token_mint": {
+            "type": "string",
+            "description": "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+          },
+          "token_decimals": {
+            "type": "integer",
+            "description": "Non-EVM (Solana, Tron): token decimals (default 6)"
+          },
+          "ttl": {
+            "type": "integer",
+            "description": "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
           }
         }
       },
@@ -11724,6 +11890,34 @@
           "simulate_first": {
             "type": "boolean",
             "default": false
+          },
+          "destination_tag": {
+            "type": "integer",
+            "description": "Non-EVM (XRP): destination tag for exchange deposits"
+          },
+          "memo": {
+            "type": "string",
+            "description": "Non-EVM (XRP, Solana): optional memo"
+          },
+          "fee_rate_sat_per_vbyte": {
+            "type": "integer",
+            "description": "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+          },
+          "fee_limit_sun": {
+            "type": "integer",
+            "description": "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+          },
+          "token_mint": {
+            "type": "string",
+            "description": "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+          },
+          "token_decimals": {
+            "type": "integer",
+            "description": "Non-EVM (Solana, Tron): token decimals (default 6)"
+          },
+          "ttl": {
+            "type": "integer",
+            "description": "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
           }
         }
       },
@@ -14996,6 +15190,126 @@
           }
         }
       },
+      "GrantResourcesRequest": {
+        "type": "object",
+        "properties": {
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "description": "Vault IDs to grant access to"
+          },
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "description": "Agent IDs to grant access to"
+          },
+          "allowed_paths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "**"
+            ],
+            "description": "Secret path patterns the app can access"
+          },
+          "permissions": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "read"
+            ],
+            "description": "Permissions granted (read, write, rotate)"
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "Optional grant expiration"
+          }
+        }
+      },
+      "GrantResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "vault_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "allowed_paths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "permissions": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "GrantResourcesResponse": {
+        "type": "object",
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "grants": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/GrantResponse"
+            }
+          },
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        }
+      },
+      "GrantListResponse": {
+        "type": "object",
+        "properties": {
+          "grants": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/GrantResponse"
+            }
+          }
+        }
+      },
       "ClaimPreviewResponse": {
         "type": "object",
         "properties": {

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: 2.21.0
+    version: 2.23.0
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -4957,6 +4957,93 @@ paths:
                 "404":
                     description: Connection not found
 
+    /v1/platform/connections/{connectionId}/grant:
+        post:
+            tags: [Platform]
+            summary: Grant platform app access to vaults/agents
+            description: |
+                User-authenticated. Grant the platform app access to selected vaults and agents.
+                Validates user ownership of all requested resources. Creates platform_user_grants
+                entries and merges resource IDs into the connection record.
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/GrantResourcesRequest"
+            responses:
+                "201":
+                    description: Grants created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/GrantResourcesResponse"
+                "400":
+                    description: No vault_ids or agent_ids provided
+                "403":
+                    description: Resource not owned by caller
+                "404":
+                    description: Connection not found
+
+    /v1/platform/connections/{connectionId}/grants:
+        get:
+            tags: [Platform]
+            summary: List active resource grants for a connection
+            description: User-authenticated. Returns active (non-revoked) grants for the connection.
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Grant list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/GrantListResponse"
+                "404":
+                    description: Connection not found
+
+    /v1/platform/connections/{connectionId}/grants/{grantId}:
+        delete:
+            tags: [Platform]
+            summary: Revoke a resource grant
+            description: User-authenticated. Revoke a specific resource grant by ID.
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: grantId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Grant revoked
+                "404":
+                    description: Grant not found or already revoked
+
     /v1/platform/claim/{token}:
         get:
             tags: [Platform]
@@ -7614,6 +7701,27 @@ components:
                     type: boolean
                     description: Whether to submit as a gasless (sponsored) transaction
                     default: false
+                destination_tag:
+                    type: integer
+                    description: "Non-EVM (XRP): destination tag for exchange deposits"
+                memo:
+                    type: string
+                    description: "Non-EVM (XRP, Solana): optional memo"
+                fee_rate_sat_per_vbyte:
+                    type: integer
+                    description: "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+                fee_limit_sun:
+                    type: integer
+                    description: "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+                token_mint:
+                    type: string
+                    description: "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+                token_decimals:
+                    type: integer
+                    description: "Non-EVM (Solana, Tron): token decimals (default 6)"
+                ttl:
+                    type: integer
+                    description: "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
 
         SignTransactionRequest:
             type: object
@@ -7647,6 +7755,27 @@ components:
                 simulate_first:
                     type: boolean
                     default: false
+                destination_tag:
+                    type: integer
+                    description: "Non-EVM (XRP): destination tag for exchange deposits"
+                memo:
+                    type: string
+                    description: "Non-EVM (XRP, Solana): optional memo"
+                fee_rate_sat_per_vbyte:
+                    type: integer
+                    description: "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+                fee_limit_sun:
+                    type: integer
+                    description: "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+                token_mint:
+                    type: string
+                    description: "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+                token_decimals:
+                    type: integer
+                    description: "Non-EVM (Solana, Tron): token decimals (default 6)"
+                ttl:
+                    type: integer
+                    description: "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
 
         SignTransactionResponse:
             type: object
@@ -9906,6 +10035,92 @@ components:
                     type: string
                     format: date-time
 
+        GrantResourcesRequest:
+            type: object
+            properties:
+                vault_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                    description: Vault IDs to grant access to
+                agent_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                    description: Agent IDs to grant access to
+                allowed_paths:
+                    type: array
+                    items:
+                        type: string
+                    default: ["**"]
+                    description: Secret path patterns the app can access
+                permissions:
+                    type: array
+                    items:
+                        type: string
+                    default: ["read"]
+                    description: Permissions granted (read, write, rotate)
+                expires_at:
+                    type: string
+                    format: date-time
+                    description: Optional grant expiration
+
+        GrantResponse:
+            type: object
+            properties:
+                id:
+                    type: string
+                    format: uuid
+                vault_id:
+                    type: string
+                    format: uuid
+                allowed_paths:
+                    type: array
+                    items:
+                        type: string
+                permissions:
+                    type: array
+                    items:
+                        type: string
+                expires_at:
+                    type: string
+                    format: date-time
+                    nullable: true
+                created_at:
+                    type: string
+                    format: date-time
+
+        GrantResourcesResponse:
+            type: object
+            properties:
+                connection_id:
+                    type: string
+                    format: uuid
+                grants:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/GrantResponse"
+                vault_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                agent_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+
+        GrantListResponse:
+            type: object
+            properties:
+                grants:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/GrantResponse"
+
         ClaimPreviewResponse:
             type: object
             properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.34.4",
+  "version": "0.36.0",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {