@1claw/openapi-spec 0.44.0 → 0.44.1

package/README.md

@@ -40,11 +40,19 @@ openapi-generator generate \
 import spec from "@1claw/openapi-spec/openapi.json";
 ```
 
-## What's in the spec (v0.36.0 — API `info.version` 2.23.0)
+## What's in the spec (v0.44.0 — API `info.version` 2.33.0)
+
+### Automations v2 & Channels (2.33)
+- **Automations v2** — Workflow engine with multi-step pipelines, 14 step types, `{{...}}` template variables, conditional logic (`skip_if`/`run_if`), 10 marketing presets, webhook/event/cron/manual triggers. Enriched list API with `last_run_status`, `total_runs`, `success_rate`, `agent_name`. Run detail with `context` JSONB. Assist NL→workflow drafting.
+- **Agent Channels** — Telegram, WhatsApp, Discord messaging channels for agents. CRUD, send, message history, test connectivity.
+- **Agent Memory** — Three-tier memory (scratch, durable, semantic) with encryption at rest. CRUD, semantic search, namespace management.
+- **Cloud Runtimes** — Managed containers with lifecycle management, hosting, interactive shell. Presets from small to large-cc (confidential compute).
+- **Platform delegation** — Platform apps can perform delegated CRUD on connected user resources via `X-Platform-Connection` header. Delegation log for audit.
+- **Discovery** — Public agent directory and platform marketplace.
 
 ### Non-EVM transaction signing (2.23)
 - **Intents API** — `SubmitTransactionRequest` / `SignTransactionRequest` / `SignIntentRequest` extended with non-EVM fields: `destination_tag` (XRP), `memo`, `fee_rate_sat_per_vbyte` (Bitcoin), `fee_limit_sun` (Tron), `token_mint` / `token_decimals` (Solana SPL + Tron TRC-20), `ttl` (Cardano). Native sign + broadcast for Bitcoin, Solana, XRP, Cardano, Tron.
-- **`xrpl_tx_json`** — Optional raw XRPL transaction JSON for 30+ transaction types beyond simple Payment. Supported types include TrustSet, OfferCreate, OfferCancel, AccountSet, AccountDelete, EscrowCreate/Finish/Cancel, PaymentChannelCreate/Fund/Claim, NFTokenMint/Burn/CreateOffer/AcceptOffer/CancelOffer, AMMCreate/Deposit/Withdraw/Bid/Delete/Vote, SetRegularKey, SignerListSet, DepositPreauth, CheckCreate/Cash/Cancel, TicketCreate, Clawback. Server auto-fills `Account`, `Sequence`, `Fee`, `Flags`, `LastLedgerSequence`, `SigningPubKey`. Legacy `to`/`value`/`destination_tag` Payment path preserved for backward compatibility.
+- **`xrpl_tx_json`** — Optional raw XRPL transaction JSON for 30+ transaction types beyond simple Payment.
 
 ### Risk Engine & DPoP (2.19)
 - **Risk events** — `GET /v1/risk/events` (list, filterable by severity/principal_type)

package/openapi.json

@@ -158,6 +158,10 @@
     {
       "name": "Agent Channels",
       "description": "External messaging channels (Telegram, WhatsApp, Discord)"
+    },
+    {
+      "name": "OAuth Connect",
+      "description": "OAuth connected accounts for agents (provider registry, connect flows, app credentials)"
     }
   ],
   "paths": {
@@ -12818,6 +12822,291 @@
           }
         }
       }
+    },
+    "/v1/oauth/providers": {
+      "get": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "List OAuth providers",
+        "description": "Returns the list of supported OAuth providers with their metadata,\navailable scopes, and authorization URLs. No authentication required.\n",
+        "operationId": "listOAuthProviders",
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Provider list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthProviderListResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/oauth/connect": {
+      "post": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "Initiate OAuth connection",
+        "description": "Start an OAuth authorization flow for the specified agent and provider.\nReturns the authorization URL to redirect the user to. Human-only.\n",
+        "operationId": "connectOAuth",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConnectOAuthRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorization URL generated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectOAuthResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/oauth/connections": {
+      "get": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "List OAuth connections",
+        "description": "List all active OAuth connections for the specified agent.",
+        "operationId": "listOAuthConnections",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connection list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthConnectionListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/oauth/disconnect/{binding_id}": {
+      "post": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "Disconnect OAuth connection",
+        "description": "Disconnect an OAuth connection by revoking tokens and removing the binding.\nHuman-only.\n",
+        "operationId": "disconnectOAuth",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          },
+          {
+            "name": "binding_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Connection disconnected"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/oauth/app-credentials": {
+      "post": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "Save OAuth app credentials",
+        "description": "Store custom OAuth app credentials (client ID/secret) for a provider.\nAllows the agent to use a BYOA (Bring Your Own App) OAuth application\ninstead of 1Claw's shared credentials. Human-only.\n",
+        "operationId": "saveOAuthAppCredentials",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SaveOAuthAppCredentialsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Credentials saved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthAppCredentialResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "List OAuth app credentials",
+        "description": "List stored OAuth app credentials for the agent. Client secrets\nare never returned in the response.\n",
+        "operationId": "listOAuthAppCredentials",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Credential list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthAppCredentialListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/oauth/app-credentials/{provider_slug}": {
+      "delete": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "Delete OAuth app credentials",
+        "description": "Remove stored OAuth app credentials for a specific provider. Human-only.\n",
+        "operationId": "deleteOAuthAppCredentials",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          },
+          {
+            "name": "provider_slug",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Provider identifier (e.g. \"github\", \"google\", \"slack\")"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Credentials deleted"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/oauth/callback": {
+      "get": {
+        "tags": [
+          "OAuth Connect"
+        ],
+        "summary": "OAuth callback",
+        "description": "Public callback URL that OAuth providers redirect to after user authorization.\nExchanges the authorization code for tokens and redirects to the dashboard.\n",
+        "operationId": "oauthConnectCallback",
+        "security": [],
+        "parameters": [
+          {
+            "name": "code",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Authorization code from the OAuth provider"
+          },
+          {
+            "name": "state",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Opaque state parameter for CSRF protection and session binding"
+          },
+          {
+            "name": "error",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Error code if the authorization was denied or failed"
+          }
+        ],
+        "responses": {
+          "302": {
+            "description": "Redirect to dashboard with success or error status"
+          }
+        }
+      }
     }
   },
   "components": {
@@ -22085,6 +22374,231 @@
             }
           }
         }
+      },
+      "OAuthProviderScope": {
+        "type": "object",
+        "properties": {
+          "scope": {
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "default": {
+            "type": "boolean"
+          }
+        }
+      },
+      "OAuthProvider": {
+        "type": "object",
+        "properties": {
+          "slug": {
+            "type": "string",
+            "description": "Unique provider identifier (e.g. \"github\", \"google\", \"slack\")"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "icon_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "authorization_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "token_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "scopes_available": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/OAuthProviderScope"
+            }
+          },
+          "default_scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "extra_auth_params": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            },
+            "nullable": true
+          },
+          "requires_app_credentials": {
+            "type": "boolean",
+            "description": "Whether custom app credentials are required (vs. shared 1Claw app)"
+          },
+          "documentation_url": {
+            "type": "string",
+            "format": "uri",
+            "nullable": true
+          }
+        }
+      },
+      "OAuthProviderListResponse": {
+        "type": "object",
+        "properties": {
+          "providers": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/OAuthProvider"
+            }
+          }
+        }
+      },
+      "ConnectOAuthRequest": {
+        "type": "object",
+        "required": [
+          "provider_slug"
+        ],
+        "properties": {
+          "provider_slug": {
+            "type": "string",
+            "description": "Provider to connect (e.g. \"github\", \"google\", \"slack\")"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Override default scopes for this connection"
+          },
+          "redirect_after": {
+            "type": "string",
+            "description": "URL to redirect to after the OAuth flow completes"
+          }
+        }
+      },
+      "ConnectOAuthResponse": {
+        "type": "object",
+        "properties": {
+          "authorization_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Redirect the user to this URL to authorize the connection"
+          }
+        }
+      },
+      "OAuthConnectionResponse": {
+        "type": "object",
+        "properties": {
+          "binding_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "provider_slug": {
+            "type": "string"
+          },
+          "provider_name": {
+            "type": "string"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "active",
+              "expired",
+              "revoked"
+            ]
+          },
+          "needs_reauth": {
+            "type": "boolean"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "OAuthConnectionListResponse": {
+        "type": "object",
+        "properties": {
+          "connections": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/OAuthConnectionResponse"
+            }
+          }
+        }
+      },
+      "SaveOAuthAppCredentialsRequest": {
+        "type": "object",
+        "required": [
+          "provider_slug",
+          "client_id",
+          "client_secret"
+        ],
+        "properties": {
+          "provider_slug": {
+            "type": "string",
+            "description": "Provider this credential is for"
+          },
+          "client_id": {
+            "type": "string"
+          },
+          "client_secret": {
+            "type": "string",
+            "description": "Write-only; never returned in responses"
+          },
+          "redirect_uri": {
+            "type": "string",
+            "format": "uri",
+            "description": "Custom redirect URI override"
+          }
+        }
+      },
+      "OAuthAppCredentialResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "provider_slug": {
+            "type": "string"
+          },
+          "client_id": {
+            "type": "string"
+          },
+          "redirect_uri": {
+            "type": "string",
+            "format": "uri",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "OAuthAppCredentialListResponse": {
+        "type": "object",
+        "properties": {
+          "credentials": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/OAuthAppCredentialResponse"
+            }
+          }
+        }
       }
     }
   }

package/openapi.yaml

@@ -94,6 +94,8 @@ tags:
       description: Chat with agents via Shroud LLM proxy
     - name: Agent Channels
       description: External messaging channels (Telegram, WhatsApp, Discord)
+    - name: OAuth Connect
+      description: OAuth connected accounts for agents (provider registry, connect flows, app credentials)
 
 # =============================================================================
 # PATHS
@@ -8173,6 +8175,200 @@ paths:
                 "200":
                     description: Webhook processed
 
+    # ---------------------------------------------------------------------------
+    # OAuth Connect
+    # ---------------------------------------------------------------------------
+
+    /v1/oauth/providers:
+        get:
+            tags: [OAuth Connect]
+            summary: List OAuth providers
+            description: |
+                Returns the list of supported OAuth providers with their metadata,
+                available scopes, and authorization URLs. No authentication required.
+            operationId: listOAuthProviders
+            security: []
+            responses:
+                "200":
+                    description: Provider list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OAuthProviderListResponse"
+
+    /v1/agents/{agent_id}/oauth/connect:
+        post:
+            tags: [OAuth Connect]
+            summary: Initiate OAuth connection
+            description: |
+                Start an OAuth authorization flow for the specified agent and provider.
+                Returns the authorization URL to redirect the user to. Human-only.
+            operationId: connectOAuth
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/ConnectOAuthRequest"
+            responses:
+                "200":
+                    description: Authorization URL generated
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ConnectOAuthResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/agents/{agent_id}/oauth/connections:
+        get:
+            tags: [OAuth Connect]
+            summary: List OAuth connections
+            description: List all active OAuth connections for the specified agent.
+            operationId: listOAuthConnections
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+            responses:
+                "200":
+                    description: Connection list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OAuthConnectionListResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/agents/{agent_id}/oauth/disconnect/{binding_id}:
+        post:
+            tags: [OAuth Connect]
+            summary: Disconnect OAuth connection
+            description: |
+                Disconnect an OAuth connection by revoking tokens and removing the binding.
+                Human-only.
+            operationId: disconnectOAuth
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+                - name: binding_id
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Connection disconnected
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/agents/{agent_id}/oauth/app-credentials:
+        post:
+            tags: [OAuth Connect]
+            summary: Save OAuth app credentials
+            description: |
+                Store custom OAuth app credentials (client ID/secret) for a provider.
+                Allows the agent to use a BYOA (Bring Your Own App) OAuth application
+                instead of 1Claw's shared credentials. Human-only.
+            operationId: saveOAuthAppCredentials
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/SaveOAuthAppCredentialsRequest"
+            responses:
+                "201":
+                    description: Credentials saved
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OAuthAppCredentialResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        get:
+            tags: [OAuth Connect]
+            summary: List OAuth app credentials
+            description: |
+                List stored OAuth app credentials for the agent. Client secrets
+                are never returned in the response.
+            operationId: listOAuthAppCredentials
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+            responses:
+                "200":
+                    description: Credential list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OAuthAppCredentialListResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/agents/{agent_id}/oauth/app-credentials/{provider_slug}:
+        delete:
+            tags: [OAuth Connect]
+            summary: Delete OAuth app credentials
+            description: |
+                Remove stored OAuth app credentials for a specific provider. Human-only.
+            operationId: deleteOAuthAppCredentials
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+                - name: provider_slug
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                  description: Provider identifier (e.g. "github", "google", "slack")
+            responses:
+                "204":
+                    description: Credentials deleted
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/oauth/callback:
+        get:
+            tags: [OAuth Connect]
+            summary: OAuth callback
+            description: |
+                Public callback URL that OAuth providers redirect to after user authorization.
+                Exchanges the authorization code for tokens and redirects to the dashboard.
+            operationId: oauthConnectCallback
+            security: []
+            parameters:
+                - name: code
+                  in: query
+                  schema:
+                      type: string
+                  description: Authorization code from the OAuth provider
+                - name: state
+                  in: query
+                  schema:
+                      type: string
+                  description: Opaque state parameter for CSRF protection and session binding
+                - name: error
+                  in: query
+                  schema:
+                      type: string
+                  description: Error code if the authorization was denied or failed
+            responses:
+                "302":
+                    description: Redirect to dashboard with success or error status
+
 # =============================================================================
 # COMPONENTS
 # =============================================================================
@@ -14544,3 +14740,164 @@ components:
                     type: array
                     items:
                         $ref: "#/components/schemas/ChannelMessageResponse"
+
+        # ── OAuth Connect ──────────────────────────────────────────────
+
+        OAuthProviderScope:
+            type: object
+            properties:
+                scope:
+                    type: string
+                label:
+                    type: string
+                description:
+                    type: string
+                default:
+                    type: boolean
+
+        OAuthProvider:
+            type: object
+            properties:
+                slug:
+                    type: string
+                    description: Unique provider identifier (e.g. "github", "google", "slack")
+                display_name:
+                    type: string
+                icon_url:
+                    type: string
+                    format: uri
+                authorization_url:
+                    type: string
+                    format: uri
+                token_url:
+                    type: string
+                    format: uri
+                scopes_available:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/OAuthProviderScope"
+                default_scopes:
+                    type: array
+                    items:
+                        type: string
+                extra_auth_params:
+                    type: object
+                    additionalProperties:
+                        type: string
+                    nullable: true
+                requires_app_credentials:
+                    type: boolean
+                    description: Whether custom app credentials are required (vs. shared 1Claw app)
+                documentation_url:
+                    type: string
+                    format: uri
+                    nullable: true
+
+        OAuthProviderListResponse:
+            type: object
+            properties:
+                providers:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/OAuthProvider"
+
+        ConnectOAuthRequest:
+            type: object
+            required: [provider_slug]
+            properties:
+                provider_slug:
+                    type: string
+                    description: Provider to connect (e.g. "github", "google", "slack")
+                scopes:
+                    type: array
+                    items:
+                        type: string
+                    description: Override default scopes for this connection
+                redirect_after:
+                    type: string
+                    description: URL to redirect to after the OAuth flow completes
+
+        ConnectOAuthResponse:
+            type: object
+            properties:
+                authorization_url:
+                    type: string
+                    format: uri
+                    description: Redirect the user to this URL to authorize the connection
+
+        OAuthConnectionResponse:
+            type: object
+            properties:
+                binding_id:
+                    type: string
+                    format: uuid
+                provider_slug:
+                    type: string
+                provider_name:
+                    type: string
+                scopes:
+                    type: array
+                    items:
+                        type: string
+                status:
+                    type: string
+                    enum: [active, expired, revoked]
+                needs_reauth:
+                    type: boolean
+                created_at:
+                    type: string
+                    format: date-time
+
+        OAuthConnectionListResponse:
+            type: object
+            properties:
+                connections:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/OAuthConnectionResponse"
+
+        SaveOAuthAppCredentialsRequest:
+            type: object
+            required: [provider_slug, client_id, client_secret]
+            properties:
+                provider_slug:
+                    type: string
+                    description: Provider this credential is for
+                client_id:
+                    type: string
+                client_secret:
+                    type: string
+                    description: Write-only; never returned in responses
+                redirect_uri:
+                    type: string
+                    format: uri
+                    description: Custom redirect URI override
+
+        OAuthAppCredentialResponse:
+            type: object
+            properties:
+                id:
+                    type: string
+                    format: uuid
+                provider_slug:
+                    type: string
+                client_id:
+                    type: string
+                redirect_uri:
+                    type: string
+                    format: uri
+                    nullable: true
+                created_at:
+                    type: string
+                    format: date-time
+                updated_at:
+                    type: string
+                    format: date-time
+
+        OAuthAppCredentialListResponse:
+            type: object
+            properties:
+                credentials:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/OAuthAppCredentialResponse"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {