@1claw/openapi-spec 0.36.0 → 0.38.0

package/README.md

@@ -43,7 +43,8 @@ import spec from "@1claw/openapi-spec/openapi.json";
 ## What's in the spec (v0.36.0 — API `info.version` 2.23.0)
 
 ### Non-EVM transaction signing (2.23)
-- **Intents API** — `SubmitTransactionRequest` / `SignTransactionRequest` extended with non-EVM fields: `destination_tag` (XRP), `memo`, `fee_rate_sat_per_vbyte` (Bitcoin), `fee_limit_sun` (Tron), `token_mint` / `token_decimals` (Solana SPL + Tron TRC-20), `ttl` (Cardano). Native sign + broadcast for Bitcoin, Solana, XRP, Cardano, Tron.
+- **Intents API** — `SubmitTransactionRequest` / `SignTransactionRequest` / `SignIntentRequest` extended with non-EVM fields: `destination_tag` (XRP), `memo`, `fee_rate_sat_per_vbyte` (Bitcoin), `fee_limit_sun` (Tron), `token_mint` / `token_decimals` (Solana SPL + Tron TRC-20), `ttl` (Cardano). Native sign + broadcast for Bitcoin, Solana, XRP, Cardano, Tron.
+- **`xrpl_tx_json`** — Optional raw XRPL transaction JSON for 30+ transaction types beyond simple Payment. Supported types include TrustSet, OfferCreate, OfferCancel, AccountSet, AccountDelete, EscrowCreate/Finish/Cancel, PaymentChannelCreate/Fund/Claim, NFTokenMint/Burn/CreateOffer/AcceptOffer/CancelOffer, AMMCreate/Deposit/Withdraw/Bid/Delete/Vote, SetRegularKey, SignerListSet, DepositPreauth, CheckCreate/Cash/Cancel, TicketCreate, Clawback. Server auto-fills `Account`, `Sequence`, `Fee`, `Flags`, `LastLedgerSequence`, `SigningPubKey`. Legacy `to`/`value`/`destination_tag` Payment path preserved for backward compatibility.
 
 ### Risk Engine & DPoP (2.19)
 - **Risk events** — `GET /v1/risk/events` (list, filterable by severity/principal_type)

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "2.23.0",
+    "version": "2.24.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -122,6 +122,10 @@
     {
       "name": "Risk Engine",
       "description": "Risk events, verdicts, and honeytoken management"
+    },
+    {
+      "name": "Tokens",
+      "description": "Known token registry for guardrail enforcement"
     }
   ],
   "paths": {
@@ -9385,6 +9389,142 @@
           }
         }
       }
+    },
+    "/v1/tokens": {
+      "get": {
+        "tags": [
+          "Tokens"
+        ],
+        "summary": "List known tokens",
+        "operationId": "listKnownTokens",
+        "parameters": [
+          {
+            "name": "chain",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Filter by chain name"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Token list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KnownTokenListResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/chains/{chain_name}/tokens": {
+      "get": {
+        "tags": [
+          "Tokens"
+        ],
+        "summary": "List tokens for a specific chain",
+        "operationId": "listTokensByChain",
+        "parameters": [
+          {
+            "name": "chain_name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Token list for chain",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KnownTokenListResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/admin/tokens": {
+      "post": {
+        "tags": [
+          "Admin",
+          "Tokens"
+        ],
+        "summary": "Create a known token (admin only)",
+        "operationId": "createKnownToken",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateKnownTokenRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Token created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KnownToken"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/admin/tokens/{token_id}": {
+      "delete": {
+        "tags": [
+          "Admin",
+          "Tokens"
+        ],
+        "summary": "Delete a known token (admin only)",
+        "operationId": "deleteKnownToken",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "token_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Token deleted"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
     }
   },
   "components": {
@@ -10779,6 +10919,30 @@
           "shroud_config": {
             "$ref": "#/components/schemas/ShroudConfig"
           },
+          "tx_token_allowlist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Token contract/mint addresses this agent may interact with. Empty = unrestricted."
+          },
+          "tx_known_tokens_only": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, only tokens in the known_tokens registry may be used."
+          },
+          "xrpl_allowed_tx_types": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Allowed XRP Ledger transaction types (Payment, TrustSet, etc.). Empty = all allowed."
+          },
+          "per_chain_guardrails": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Per-chain guardrail overrides. Keys are chain family names (ethereum, bitcoin, solana, etc.).\nEach value can contain: max_value, daily_limit, to_allowlist, token_allowlist.\nExample: { \"ethereum\": { \"max_value\": \"0.5\", \"to_allowlist\": [\"0x...\"] } }\n"
+          },
           "api_key_expires_at": {
             "type": "string",
             "format": "date-time",
@@ -10864,6 +11028,30 @@
             "nullable": true,
             "description": "Per-agent TTL override for federation tokens (seconds). NULL falls\nback to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).\nHard-capped at 3600 seconds.\n"
           },
+          "tx_token_allowlist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Token contract/mint addresses this agent may interact with. Empty = unrestricted."
+          },
+          "tx_known_tokens_only": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, only tokens in the known_tokens registry may be used."
+          },
+          "xrpl_allowed_tx_types": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Allowed XRP Ledger transaction types (Payment, TrustSet, etc.). Empty = all allowed."
+          },
+          "per_chain_guardrails": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Per-chain guardrail overrides. Keys are chain family names (ethereum, bitcoin, solana, etc.).\nEach value can contain: max_value, daily_limit, to_allowlist, token_allowlist.\nExample: { \"ethereum\": { \"max_value\": \"0.5\", \"to_allowlist\": [\"0x...\"] } }\n"
+          },
           "api_key_expires_at": {
             "type": "string",
             "format": "date-time",
@@ -11021,6 +11209,36 @@
             "type": "boolean",
             "description": "Whether the raw/precomputed-digest signing intent (eip712_digest) is enabled. Blind signing — bypasses transaction guardrails; OFF by default and human-set. Required for ERC-1271/ERC-7739 flows (e.g. Polymarket).\n"
           },
+          "tx_token_allowlist": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Token contract/mint addresses this agent may interact with."
+          },
+          "tx_known_tokens_only": {
+            "type": "boolean",
+            "description": "When true, only tokens in the known_tokens registry may be used."
+          },
+          "xrpl_allowed_tx_types": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Allowed XRP Ledger transaction types."
+          },
+          "per_chain_guardrails": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Per-chain guardrail overrides."
+          },
+          "tx_spent_today_by_chain": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Per-chain-family daily spend in major units (e.g. {\"ethereum\": \"0.5\", \"solana\": \"2.1\"})."
+          },
           "api_key_expires_at": {
             "type": "string",
             "format": "date-time",
@@ -11053,6 +11271,111 @@
           }
         }
       },
+      "KnownToken": {
+        "type": "object",
+        "required": [
+          "id",
+          "chain",
+          "symbol",
+          "name",
+          "contract_address",
+          "decimals",
+          "is_testnet",
+          "is_verified"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "symbol": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "contract_address": {
+            "type": "string"
+          },
+          "decimals": {
+            "type": "integer"
+          },
+          "is_testnet": {
+            "type": "boolean"
+          },
+          "is_verified": {
+            "type": "boolean"
+          },
+          "logo_url": {
+            "type": "string",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "KnownTokenListResponse": {
+        "type": "object",
+        "required": [
+          "tokens"
+        ],
+        "properties": {
+          "tokens": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/KnownToken"
+            }
+          }
+        }
+      },
+      "CreateKnownTokenRequest": {
+        "type": "object",
+        "required": [
+          "chain",
+          "symbol",
+          "name",
+          "contract_address",
+          "decimals"
+        ],
+        "properties": {
+          "chain": {
+            "type": "string"
+          },
+          "symbol": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "contract_address": {
+            "type": "string"
+          },
+          "decimals": {
+            "type": "integer"
+          },
+          "is_testnet": {
+            "type": "boolean",
+            "default": false
+          },
+          "is_verified": {
+            "type": "boolean",
+            "default": true
+          },
+          "logo_url": {
+            "type": "string",
+            "nullable": true
+          }
+        }
+      },
       "AgentSmartAccountResponse": {
         "type": "object",
         "description": "One Safe smart account per chain for an agent",
@@ -11841,6 +12164,11 @@
           "ttl": {
             "type": "integer",
             "description": "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+          },
+          "xrpl_tx_json": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Raw XRPL transaction JSON for full transaction type coverage. When present (and chain is XRP), the handler uses the xrpl-rust binary codec to encode and sign the transaction as-is. Supports all XRPL transaction types: Payment, TrustSet, OfferCreate, OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate, and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and SigningPubKey are auto-filled when absent.\n"
           }
         }
       },
@@ -11918,6 +12246,11 @@
           "ttl": {
             "type": "integer",
             "description": "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+          },
+          "xrpl_tx_json": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Raw XRPL transaction JSON for full transaction type coverage. When present (and chain is XRP), the handler uses the xrpl-rust binary codec to encode and sign the transaction as-is. Supports all XRPL transaction types: Payment, TrustSet, OfferCreate, OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate, and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and SigningPubKey are auto-filled when absent.\n"
           }
         }
       },
@@ -12259,6 +12592,43 @@
             "items": {
               "type": "object"
             }
+          },
+          "sign_only": {
+            "type": "boolean",
+            "description": "When true, sign only (do not broadcast). Non-EVM transaction intents only."
+          },
+          "destination_tag": {
+            "type": "integer",
+            "description": "Non-EVM (XRP): destination tag for exchange deposits"
+          },
+          "memo": {
+            "type": "string",
+            "description": "Non-EVM (XRP, Solana): optional memo"
+          },
+          "fee_rate_sat_per_vbyte": {
+            "type": "integer",
+            "description": "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+          },
+          "fee_limit_sun": {
+            "type": "integer",
+            "description": "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+          },
+          "token_mint": {
+            "type": "string",
+            "description": "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+          },
+          "token_decimals": {
+            "type": "integer",
+            "description": "Non-EVM (Solana, Tron): token decimals (default 6)"
+          },
+          "ttl": {
+            "type": "integer",
+            "description": "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+          },
+          "xrpl_tx_json": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Raw XRPL transaction JSON for full transaction type coverage. When present (and chain is XRP), the handler uses the xrpl-rust binary codec to encode and sign the transaction as-is. Supports all XRPL transaction types: Payment, TrustSet, OfferCreate, OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate, and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and SigningPubKey are auto-filled when absent.\n"
           }
         }
       },
@@ -14320,6 +14690,29 @@
           },
           "balance_display": {
             "type": "string"
+          },
+          "tokens": {
+            "type": "array",
+            "description": "Token balances when ?tokens= query param is provided",
+            "items": {
+              "type": "object",
+              "properties": {
+                "contract_address": {
+                  "type": "string"
+                },
+                "symbol": {
+                  "type": "string",
+                  "nullable": true
+                },
+                "balance": {
+                  "type": "string"
+                },
+                "decimals": {
+                  "type": "integer",
+                  "nullable": true
+                }
+              }
+            }
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: 2.23.0
+    version: 2.24.0
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -74,6 +74,8 @@ tags:
       description: OAuth 2.0 authorization server (PKCE, consent, token exchange, OIDC UserInfo)
     - name: Risk Engine
       description: Risk events, verdicts, and honeytoken management
+    - name: Tokens
+      description: Known token registry for guardrail enforcement
 
 # =============================================================================
 # PATHS
@@ -5986,6 +5988,87 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/tokens:
+        get:
+            tags: [Tokens]
+            summary: List known tokens
+            operationId: listKnownTokens
+            parameters:
+                - name: chain
+                  in: query
+                  schema:
+                      type: string
+                  description: Filter by chain name
+            responses:
+                "200":
+                    description: Token list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/KnownTokenListResponse"
+
+    /v1/chains/{chain_name}/tokens:
+        get:
+            tags: [Tokens]
+            summary: List tokens for a specific chain
+            operationId: listTokensByChain
+            parameters:
+                - name: chain_name
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+            responses:
+                "200":
+                    description: Token list for chain
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/KnownTokenListResponse"
+
+    /v1/admin/tokens:
+        post:
+            tags: [Admin, Tokens]
+            summary: Create a known token (admin only)
+            operationId: createKnownToken
+            security:
+                - BearerAuth: []
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/CreateKnownTokenRequest"
+            responses:
+                "201":
+                    description: Token created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/KnownToken"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+
+    /v1/admin/tokens/{token_id}:
+        delete:
+            tags: [Admin, Tokens]
+            summary: Delete a known token (admin only)
+            operationId: deleteKnownToken
+            security:
+                - BearerAuth: []
+            parameters:
+                - name: token_id
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Token deleted
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+
 # =============================================================================
 # COMPONENTS
 # =============================================================================
@@ -6969,6 +7052,27 @@ components:
                     description: Enable Shroud LLM Proxy for this agent
                 shroud_config:
                     $ref: "#/components/schemas/ShroudConfig"
+                tx_token_allowlist:
+                    type: array
+                    items:
+                        type: string
+                    description: Token contract/mint addresses this agent may interact with. Empty = unrestricted.
+                tx_known_tokens_only:
+                    type: boolean
+                    default: false
+                    description: When true, only tokens in the known_tokens registry may be used.
+                xrpl_allowed_tx_types:
+                    type: array
+                    items:
+                        type: string
+                    description: Allowed XRP Ledger transaction types (Payment, TrustSet, etc.). Empty = all allowed.
+                per_chain_guardrails:
+                    type: object
+                    additionalProperties: true
+                    description: |
+                        Per-chain guardrail overrides. Keys are chain family names (ethereum, bitcoin, solana, etc.).
+                        Each value can contain: max_value, daily_limit, to_allowlist, token_allowlist.
+                        Example: { "ethereum": { "max_value": "0.5", "to_allowlist": ["0x..."] } }
                 api_key_expires_at:
                     type: string
                     format: date-time
@@ -7040,6 +7144,27 @@ components:
                         Per-agent TTL override for federation tokens (seconds). NULL falls
                         back to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).
                         Hard-capped at 3600 seconds.
+                tx_token_allowlist:
+                    type: array
+                    items:
+                        type: string
+                    description: Token contract/mint addresses this agent may interact with. Empty = unrestricted.
+                tx_known_tokens_only:
+                    type: boolean
+                    default: false
+                    description: When true, only tokens in the known_tokens registry may be used.
+                xrpl_allowed_tx_types:
+                    type: array
+                    items:
+                        type: string
+                    description: Allowed XRP Ledger transaction types (Payment, TrustSet, etc.). Empty = all allowed.
+                per_chain_guardrails:
+                    type: object
+                    additionalProperties: true
+                    description: |
+                        Per-chain guardrail overrides. Keys are chain family names (ethereum, bitcoin, solana, etc.).
+                        Each value can contain: max_value, daily_limit, to_allowlist, token_allowlist.
+                        Example: { "ethereum": { "max_value": "0.5", "to_allowlist": ["0x..."] } }
                 api_key_expires_at:
                     type: string
                     format: date-time
@@ -7158,6 +7283,28 @@ components:
                         Whether the raw/precomputed-digest signing intent (eip712_digest) is
                         enabled. Blind signing — bypasses transaction guardrails; OFF by default
                         and human-set. Required for ERC-1271/ERC-7739 flows (e.g. Polymarket).
+                tx_token_allowlist:
+                    type: array
+                    items:
+                        type: string
+                    description: Token contract/mint addresses this agent may interact with.
+                tx_known_tokens_only:
+                    type: boolean
+                    description: When true, only tokens in the known_tokens registry may be used.
+                xrpl_allowed_tx_types:
+                    type: array
+                    items:
+                        type: string
+                    description: Allowed XRP Ledger transaction types.
+                per_chain_guardrails:
+                    type: object
+                    additionalProperties: true
+                    description: Per-chain guardrail overrides.
+                tx_spent_today_by_chain:
+                    type: object
+                    additionalProperties:
+                        type: string
+                    description: 'Per-chain-family daily spend in major units (e.g. {"ethereum": "0.5", "solana": "2.1"}).'
                 api_key_expires_at:
                     type: string
                     format: date-time
@@ -7182,6 +7329,70 @@ components:
                     items:
                         $ref: "#/components/schemas/AgentSmartAccountResponse"
 
+        KnownToken:
+            type: object
+            required: [id, chain, symbol, name, contract_address, decimals, is_testnet, is_verified]
+            properties:
+                id:
+                    type: string
+                    format: uuid
+                chain:
+                    type: string
+                symbol:
+                    type: string
+                name:
+                    type: string
+                contract_address:
+                    type: string
+                decimals:
+                    type: integer
+                is_testnet:
+                    type: boolean
+                is_verified:
+                    type: boolean
+                logo_url:
+                    type: string
+                    nullable: true
+                created_at:
+                    type: string
+                    format: date-time
+                updated_at:
+                    type: string
+                    format: date-time
+
+        KnownTokenListResponse:
+            type: object
+            required: [tokens]
+            properties:
+                tokens:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/KnownToken"
+
+        CreateKnownTokenRequest:
+            type: object
+            required: [chain, symbol, name, contract_address, decimals]
+            properties:
+                chain:
+                    type: string
+                symbol:
+                    type: string
+                name:
+                    type: string
+                contract_address:
+                    type: string
+                decimals:
+                    type: integer
+                is_testnet:
+                    type: boolean
+                    default: false
+                is_verified:
+                    type: boolean
+                    default: true
+                logo_url:
+                    type: string
+                    nullable: true
+
         AgentSmartAccountResponse:
             type: object
             description: One Safe smart account per chain for an agent
@@ -7722,6 +7933,17 @@ components:
                 ttl:
                     type: integer
                     description: "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+                xrpl_tx_json:
+                    type: object
+                    additionalProperties: true
+                    description: >
+                        Raw XRPL transaction JSON for full transaction type coverage.
+                        When present (and chain is XRP), the handler uses the xrpl-rust
+                        binary codec to encode and sign the transaction as-is. Supports
+                        all XRPL transaction types: Payment, TrustSet, OfferCreate,
+                        OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate,
+                        and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and
+                        SigningPubKey are auto-filled when absent.
 
         SignTransactionRequest:
             type: object
@@ -7776,6 +7998,17 @@ components:
                 ttl:
                     type: integer
                     description: "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+                xrpl_tx_json:
+                    type: object
+                    additionalProperties: true
+                    description: >
+                        Raw XRPL transaction JSON for full transaction type coverage.
+                        When present (and chain is XRP), the handler uses the xrpl-rust
+                        binary codec to encode and sign the transaction as-is. Supports
+                        all XRPL transaction types: Payment, TrustSet, OfferCreate,
+                        OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate,
+                        and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and
+                        SigningPubKey are auto-filled when absent.
 
         SignTransactionResponse:
             type: object
@@ -8013,6 +8246,41 @@ components:
                     type: array
                     items:
                         type: object
+                sign_only:
+                    type: boolean
+                    description: "When true, sign only (do not broadcast). Non-EVM transaction intents only."
+                destination_tag:
+                    type: integer
+                    description: "Non-EVM (XRP): destination tag for exchange deposits"
+                memo:
+                    type: string
+                    description: "Non-EVM (XRP, Solana): optional memo"
+                fee_rate_sat_per_vbyte:
+                    type: integer
+                    description: "Non-EVM (Bitcoin): override the fetched fee rate (sat/vByte)"
+                fee_limit_sun:
+                    type: integer
+                    description: "Non-EVM (Tron): TRC-20 energy fee limit in sun"
+                token_mint:
+                    type: string
+                    description: "Non-EVM (Solana SPL / Tron TRC-20): token mint or contract address; omit for native transfer"
+                token_decimals:
+                    type: integer
+                    description: "Non-EVM (Solana, Tron): token decimals (default 6)"
+                ttl:
+                    type: integer
+                    description: "Non-EVM (Cardano): transaction time-to-live (absolute slot)"
+                xrpl_tx_json:
+                    type: object
+                    additionalProperties: true
+                    description: >
+                        Raw XRPL transaction JSON for full transaction type coverage.
+                        When present (and chain is XRP), the handler uses the xrpl-rust
+                        binary codec to encode and sign the transaction as-is. Supports
+                        all XRPL transaction types: Payment, TrustSet, OfferCreate,
+                        OfferCancel, AccountSet, EscrowCreate, NFTokenMint, AMMCreate,
+                        and 20+ more. Account, Sequence, Fee, LastLedgerSequence, and
+                        SigningPubKey are auto-filled when absent.
 
         SignIntentResponse:
             type: object
@@ -9416,6 +9684,22 @@ components:
                     type: string
                 balance_display:
                     type: string
+                tokens:
+                    type: array
+                    description: Token balances when ?tokens= query param is provided
+                    items:
+                        type: object
+                        properties:
+                            contract_address:
+                                type: string
+                            symbol:
+                                type: string
+                                nullable: true
+                            balance:
+                                type: string
+                            decimals:
+                                type: integer
+                                nullable: true
 
         # --- x402 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {