@1claw/openapi-spec 0.47.1 → 0.48.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +17 -1
  2. package/openapi.json +8289 -6953
  3. package/openapi.yaml +989 -147
  4. package/package.json +1 -1
package/openapi.yaml CHANGED
@@ -102,6 +102,10 @@ tags:
102
102
  description: Cedar policy engine (Team+ tier)
103
103
  - name: OPA Policies
104
104
  description: OPA policy engine (Business+ tier)
105
+ - name: Contract ABIs
106
+ description: Org-scoped contract ABI registry for transaction decoding
107
+ - name: Pending Approvals
108
+ description: Consensus-based multi-party approval workflow for signing
105
109
  - name: Sub-Organizations
106
110
  description: Sub-organization management
107
111
  - name: Portfolio
@@ -4229,8 +4233,8 @@ paths:
4229
4233
  description: |
4230
4234
  Generates keypairs for the requested chains (or all supported chains if omitted).
4231
4235
  Private keys are stored in a per-org `__treasury-keys` vault with tier-appropriate
4232
- MPC custody. Skips chains where the user already has an active wallet. Requires
4233
- Pro or higher billing tier. Human users only — agents get 403.
4236
+ MPC custody. Skips chains where the user already has an active wallet. Available
4237
+ on all tiers (counts toward wallet quota). Human users only — agents get 403.
4234
4238
  operationId: generateTreasuryWallets
4235
4239
  security:
4236
4240
  - BearerAuth: []
@@ -4366,7 +4370,7 @@ paths:
4366
4370
  description: |
4367
4371
  Generates a new keypair, deactivates the old wallet, and creates a
4368
4372
  new active wallet. The old private key version is retained in the
4369
- vault for audit. Requires Pro or higher.
4373
+ vault for audit. Counts toward wallet quota (does not require a paid plan).
4370
4374
  operationId: rotateTreasuryWallet
4371
4375
  security:
4372
4376
  - BearerAuth: []
@@ -9042,15 +9046,91 @@ paths:
9042
9046
  $ref: "#/components/responses/Unauthorized"
9043
9047
 
9044
9048
  # ---------------------------------------------------------------------------
9045
- # Sub-Organizations
9049
+ # Policy Backend Settings (Cedar/OPA enforcement)
9046
9050
  # ---------------------------------------------------------------------------
9047
9051
 
9048
- /v1/org/sub-orgs:
9052
+ /v1/org/settings/policy-backend:
9053
+ get:
9054
+ tags: [Organization]
9055
+ summary: Get policy backend settings
9056
+ description: |
9057
+ Returns the org's Cedar/OPA enforcement configuration. Default mode is shadow.
9058
+ Owner/admin only.
9059
+ operationId: getPolicyBackendSettings
9060
+ security:
9061
+ - BearerAuth: []
9062
+ responses:
9063
+ "200":
9064
+ description: Policy backend settings
9065
+ content:
9066
+ application/json:
9067
+ schema:
9068
+ $ref: "#/components/schemas/PolicyBackendSettingsResponse"
9069
+ "401":
9070
+ $ref: "#/components/responses/Unauthorized"
9071
+ "403":
9072
+ $ref: "#/components/responses/Forbidden"
9073
+ patch:
9074
+ tags: [Organization]
9075
+ summary: Update policy backend settings
9076
+ description: |
9077
+ Configure backend (builtin, cedar, opa, builtin+cedar, builtin+opa), mode (shadow/enforce),
9078
+ scope actions, and circuit breaker behavior. Owner/admin only.
9079
+ operationId: updatePolicyBackendSettings
9080
+ security:
9081
+ - BearerAuth: []
9082
+ requestBody:
9083
+ required: true
9084
+ content:
9085
+ application/json:
9086
+ schema:
9087
+ $ref: "#/components/schemas/UpdatePolicyBackendSettingsRequest"
9088
+ responses:
9089
+ "200":
9090
+ description: Updated settings
9091
+ content:
9092
+ application/json:
9093
+ schema:
9094
+ $ref: "#/components/schemas/PolicyBackendSettingsResponse"
9095
+ "400":
9096
+ $ref: "#/components/responses/BadRequest"
9097
+ "401":
9098
+ $ref: "#/components/responses/Unauthorized"
9099
+ "403":
9100
+ $ref: "#/components/responses/Forbidden"
9101
+
9102
+ /v1/org/policy-shadow-report:
9103
+ get:
9104
+ tags: [Organization]
9105
+ summary: Get policy shadow divergence report
9106
+ description: |
9107
+ Returns divergence statistics when running Cedar/OPA in shadow mode.
9108
+ Owner/admin only.
9109
+ operationId: getPolicyShadowReport
9110
+ security:
9111
+ - BearerAuth: []
9112
+ responses:
9113
+ "200":
9114
+ description: Shadow divergence report
9115
+ content:
9116
+ application/json:
9117
+ schema:
9118
+ $ref: "#/components/schemas/PolicyShadowReportResponse"
9119
+ "401":
9120
+ $ref: "#/components/responses/Unauthorized"
9121
+ "403":
9122
+ $ref: "#/components/responses/Forbidden"
9123
+
9124
+ # ---------------------------------------------------------------------------
9125
+ # Contract ABI Registry
9126
+ # ---------------------------------------------------------------------------
9127
+
9128
+ /v1/org/contract-abis:
9049
9129
  post:
9050
- tags: [Sub-Organizations]
9051
- summary: Create a sub-organization
9052
- description: Create a new sub-organization under the current org.
9053
- operationId: createSubOrg
9130
+ tags: [Contract ABIs]
9131
+ summary: Register a contract ABI
9132
+ description: Upload an org-scoped ABI for transaction decoding. Owner/admin only.
9133
+ operationId: createContractAbi
9054
9134
  security:
9055
9135
  - BearerAuth: []
9056
9136
  requestBody:
@@ -9058,47 +9138,56 @@ paths:
9058
9138
  content:
9059
9139
  application/json:
9060
9140
  schema:
9061
- $ref: "#/components/schemas/CreateSubOrgRequest"
9141
+ $ref: "#/components/schemas/CreateContractAbiRequest"
9062
9142
  responses:
9063
9143
  "201":
9064
- description: Sub-organization created
9144
+ description: ABI registered
9065
9145
  content:
9066
9146
  application/json:
9067
9147
  schema:
9068
- $ref: "#/components/schemas/SubOrgResponse"
9148
+ $ref: "#/components/schemas/ContractAbiResponse"
9069
9149
  "400":
9070
9150
  $ref: "#/components/responses/BadRequest"
9071
9151
  "401":
9072
9152
  $ref: "#/components/responses/Unauthorized"
9073
9153
  "403":
9074
9154
  $ref: "#/components/responses/Forbidden"
9155
+ "409":
9156
+ $ref: "#/components/responses/Conflict"
9075
9157
  get:
9076
- tags: [Sub-Organizations]
9077
- summary: List sub-organizations
9078
- description: List all sub-organizations under the current org.
9079
- operationId: listSubOrgs
9158
+ tags: [Contract ABIs]
9159
+ summary: List contract ABIs
9160
+ description: List org contract ABIs, optionally filtered by chain. Owner/admin only.
9161
+ operationId: listContractAbis
9080
9162
  security:
9081
9163
  - BearerAuth: []
9164
+ parameters:
9165
+ - name: chain
9166
+ in: query
9167
+ schema:
9168
+ type: string
9169
+ description: Filter by chain name
9082
9170
  responses:
9083
9171
  "200":
9084
- description: Sub-organizations list
9172
+ description: ABI list
9085
9173
  content:
9086
9174
  application/json:
9087
9175
  schema:
9088
- $ref: "#/components/schemas/SubOrgListResponse"
9176
+ $ref: "#/components/schemas/ContractAbiListResponse"
9089
9177
  "401":
9090
9178
  $ref: "#/components/responses/Unauthorized"
9179
+ "403":
9180
+ $ref: "#/components/responses/Forbidden"
9091
9181
 
9092
- /v1/org/sub-orgs/{sub_org_id}:
9182
+ /v1/org/contract-abis/{id}:
9093
9183
  get:
9094
- tags: [Sub-Organizations]
9095
- summary: Get a sub-organization
9096
- description: Retrieve a specific sub-organization by ID.
9097
- operationId: getSubOrg
9184
+ tags: [Contract ABIs]
9185
+ summary: Get a contract ABI
9186
+ operationId: getContractAbi
9098
9187
  security:
9099
9188
  - BearerAuth: []
9100
9189
  parameters:
9101
- - name: sub_org_id
9190
+ - name: id
9102
9191
  in: path
9103
9192
  required: true
9104
9193
  schema:
@@ -9106,109 +9195,143 @@ paths:
9106
9195
  format: uuid
9107
9196
  responses:
9108
9197
  "200":
9109
- description: Sub-organization details
9198
+ description: ABI details
9110
9199
  content:
9111
9200
  application/json:
9112
9201
  schema:
9113
- $ref: "#/components/schemas/SubOrgResponse"
9202
+ $ref: "#/components/schemas/ContractAbiResponse"
9114
9203
  "401":
9115
9204
  $ref: "#/components/responses/Unauthorized"
9205
+ "403":
9206
+ $ref: "#/components/responses/Forbidden"
9116
9207
  "404":
9117
9208
  $ref: "#/components/responses/NotFound"
9118
- patch:
9119
- tags: [Sub-Organizations]
9120
- summary: Update a sub-organization
9121
- description: Update sub-organization name, description, or billing model.
9122
- operationId: updateSubOrg
9209
+ delete:
9210
+ tags: [Contract ABIs]
9211
+ summary: Delete a contract ABI
9212
+ operationId: deleteContractAbi
9123
9213
  security:
9124
9214
  - BearerAuth: []
9125
9215
  parameters:
9126
- - name: sub_org_id
9216
+ - name: id
9127
9217
  in: path
9128
9218
  required: true
9129
9219
  schema:
9130
9220
  type: string
9131
9221
  format: uuid
9222
+ responses:
9223
+ "204":
9224
+ description: ABI deleted
9225
+ "401":
9226
+ $ref: "#/components/responses/Unauthorized"
9227
+ "403":
9228
+ $ref: "#/components/responses/Forbidden"
9229
+ "404":
9230
+ $ref: "#/components/responses/NotFound"
9231
+
9232
+ # ---------------------------------------------------------------------------
9233
+ # Pending Approvals (consensus policies)
9234
+ # ---------------------------------------------------------------------------
9235
+
9236
+ /v1/pending-approvals:
9237
+ post:
9238
+ tags: [Pending Approvals]
9239
+ summary: Submit action for approval
9240
+ description: Submit a signing or transaction action that matches a consensus policy trigger.
9241
+ operationId: submitPendingApproval
9242
+ security:
9243
+ - BearerAuth: []
9132
9244
  requestBody:
9133
9245
  required: true
9134
9246
  content:
9135
9247
  application/json:
9136
9248
  schema:
9137
- $ref: "#/components/schemas/CreateSubOrgRequest"
9249
+ $ref: "#/components/schemas/SubmitPendingApprovalRequest"
9138
9250
  responses:
9139
- "200":
9140
- description: Sub-organization updated
9251
+ "202":
9252
+ description: Approval required
9141
9253
  content:
9142
9254
  application/json:
9143
9255
  schema:
9144
- $ref: "#/components/schemas/SubOrgResponse"
9256
+ $ref: "#/components/schemas/SubmitPendingApprovalResponse"
9257
+ "400":
9258
+ $ref: "#/components/responses/BadRequest"
9145
9259
  "401":
9146
9260
  $ref: "#/components/responses/Unauthorized"
9147
9261
  "404":
9148
9262
  $ref: "#/components/responses/NotFound"
9149
- delete:
9150
- tags: [Sub-Organizations]
9151
- summary: Archive a sub-organization
9152
- description: Archive (soft-delete) a sub-organization.
9153
- operationId: deleteSubOrg
9263
+ get:
9264
+ tags: [Pending Approvals]
9265
+ summary: List pending approvals
9266
+ operationId: listPendingApprovals
9154
9267
  security:
9155
9268
  - BearerAuth: []
9156
9269
  parameters:
9157
- - name: sub_org_id
9158
- in: path
9159
- required: true
9270
+ - name: status
9271
+ in: query
9272
+ schema:
9273
+ type: string
9274
+ - name: agent_id
9275
+ in: query
9160
9276
  schema:
9161
9277
  type: string
9162
9278
  format: uuid
9279
+ - name: limit
9280
+ in: query
9281
+ schema:
9282
+ type: integer
9283
+ maximum: 100
9284
+ - name: offset
9285
+ in: query
9286
+ schema:
9287
+ type: integer
9163
9288
  responses:
9164
- "204":
9165
- description: Sub-organization archived
9289
+ "200":
9290
+ description: Pending approvals list
9291
+ content:
9292
+ application/json:
9293
+ schema:
9294
+ $ref: "#/components/schemas/PendingApprovalListResponse"
9166
9295
  "401":
9167
9296
  $ref: "#/components/responses/Unauthorized"
9168
- "404":
9169
- $ref: "#/components/responses/NotFound"
9170
9297
 
9171
- /v1/org/sub-orgs/{sub_org_id}/users:
9172
- post:
9173
- tags: [Sub-Organizations]
9174
- summary: Add a user to a sub-organization
9175
- description: Add a user to a sub-organization with a specified role.
9176
- operationId: addSubOrgUser
9298
+ /v1/pending-approvals/{id}:
9299
+ get:
9300
+ tags: [Pending Approvals]
9301
+ summary: Get pending approval details
9302
+ operationId: getPendingApproval
9177
9303
  security:
9178
9304
  - BearerAuth: []
9179
9305
  parameters:
9180
- - name: sub_org_id
9306
+ - name: id
9181
9307
  in: path
9182
9308
  required: true
9183
9309
  schema:
9184
9310
  type: string
9185
9311
  format: uuid
9186
- requestBody:
9187
- required: true
9188
- content:
9189
- application/json:
9190
- schema:
9191
- $ref: "#/components/schemas/SubOrgAddUserRequest"
9192
9312
  responses:
9193
- "201":
9194
- description: User added to sub-organization
9195
- "400":
9196
- $ref: "#/components/responses/BadRequest"
9313
+ "200":
9314
+ description: Pending approval with signatures
9315
+ content:
9316
+ application/json:
9317
+ schema:
9318
+ $ref: "#/components/schemas/PendingApprovalResponse"
9197
9319
  "401":
9198
9320
  $ref: "#/components/responses/Unauthorized"
9321
+ "403":
9322
+ $ref: "#/components/responses/Forbidden"
9199
9323
  "404":
9200
9324
  $ref: "#/components/responses/NotFound"
9201
9325
 
9202
- /v1/org/sub-orgs/{sub_org_id}/permissions:
9326
+ /v1/pending-approvals/{id}/approve:
9203
9327
  post:
9204
- tags: [Sub-Organizations]
9205
- summary: Grant permissions to a sub-organization
9206
- description: Grant a permission scope to the sub-organization.
9207
- operationId: grantSubOrgPermission
9328
+ tags: [Pending Approvals]
9329
+ summary: Approve or reject a pending approval
9330
+ operationId: approvePendingApproval
9208
9331
  security:
9209
9332
  - BearerAuth: []
9210
9333
  parameters:
9211
- - name: sub_org_id
9334
+ - name: id
9212
9335
  in: path
9213
9336
  required: true
9214
9337
  schema:
@@ -9219,70 +9342,79 @@ paths:
9219
9342
  content:
9220
9343
  application/json:
9221
9344
  schema:
9222
- $ref: "#/components/schemas/SubOrgPermissionRequest"
9345
+ $ref: "#/components/schemas/ApprovePendingApprovalRequest"
9223
9346
  responses:
9224
- "201":
9225
- description: Permission granted
9347
+ "200":
9348
+ description: Updated pending approval
9349
+ content:
9350
+ application/json:
9351
+ schema:
9352
+ $ref: "#/components/schemas/PendingApprovalResponse"
9226
9353
  "400":
9227
9354
  $ref: "#/components/responses/BadRequest"
9228
9355
  "401":
9229
9356
  $ref: "#/components/responses/Unauthorized"
9357
+ "403":
9358
+ $ref: "#/components/responses/Forbidden"
9230
9359
  "404":
9231
9360
  $ref: "#/components/responses/NotFound"
9361
+ "409":
9362
+ $ref: "#/components/responses/Conflict"
9232
9363
 
9233
- /v1/org/sub-orgs/{sub_org_id}/permissions/{permission}:
9234
- delete:
9235
- tags: [Sub-Organizations]
9236
- summary: Revoke a sub-organization permission
9237
- description: Revoke a specific permission scope from the sub-organization.
9238
- operationId: revokeSubOrgPermission
9364
+ /v1/pending-approvals/{id}/execute:
9365
+ post:
9366
+ tags: [Pending Approvals]
9367
+ summary: Execute an approved action
9368
+ description: Human-only. Marks the approval as executed after verifying signatures.
9369
+ operationId: executePendingApproval
9239
9370
  security:
9240
9371
  - BearerAuth: []
9241
9372
  parameters:
9242
- - name: sub_org_id
9373
+ - name: id
9243
9374
  in: path
9244
9375
  required: true
9245
9376
  schema:
9246
9377
  type: string
9247
9378
  format: uuid
9248
- - name: permission
9249
- in: path
9250
- required: true
9251
- schema:
9252
- type: string
9253
- description: The permission scope to revoke
9254
9379
  responses:
9255
- "204":
9256
- description: Permission revoked
9380
+ "200":
9381
+ description: Action executed
9382
+ content:
9383
+ application/json:
9384
+ schema:
9385
+ $ref: "#/components/schemas/ExecutePendingApprovalResponse"
9386
+ "400":
9387
+ $ref: "#/components/responses/BadRequest"
9257
9388
  "401":
9258
9389
  $ref: "#/components/responses/Unauthorized"
9390
+ "403":
9391
+ $ref: "#/components/responses/Forbidden"
9259
9392
  "404":
9260
9393
  $ref: "#/components/responses/NotFound"
9261
9394
 
9262
- /v1/org/sub-orgs/{sub_org_id}/wallets/generate:
9395
+ /v1/pending-approvals/{id}/cancel:
9263
9396
  post:
9264
- tags: [Sub-Organizations]
9265
- summary: Generate wallets for a sub-organization
9266
- description: Generate treasury wallets for specified chains within the sub-org.
9267
- operationId: generateSubOrgWallets
9397
+ tags: [Pending Approvals]
9398
+ summary: Cancel a pending approval
9399
+ operationId: cancelPendingApproval
9268
9400
  security:
9269
9401
  - BearerAuth: []
9270
9402
  parameters:
9271
- - name: sub_org_id
9403
+ - name: id
9272
9404
  in: path
9273
9405
  required: true
9274
9406
  schema:
9275
9407
  type: string
9276
9408
  format: uuid
9277
- requestBody:
9278
- required: false
9279
- content:
9280
- application/json:
9281
- schema:
9282
- $ref: "#/components/schemas/SubOrgGenerateWalletsRequest"
9283
9409
  responses:
9284
- "201":
9285
- description: Wallets generated
9410
+ "200":
9411
+ description: Cancelled pending approval
9412
+ content:
9413
+ application/json:
9414
+ schema:
9415
+ $ref: "#/components/schemas/PendingApprovalResponse"
9416
+ "400":
9417
+ $ref: "#/components/responses/BadRequest"
9286
9418
  "401":
9287
9419
  $ref: "#/components/responses/Unauthorized"
9288
9420
  "403":
@@ -9291,17 +9423,266 @@ paths:
9291
9423
  $ref: "#/components/responses/NotFound"
9292
9424
 
9293
9425
  # ---------------------------------------------------------------------------
9294
- # Portfolio
9426
+ # Sub-Organizations
9295
9427
  # ---------------------------------------------------------------------------
9296
9428
 
9297
- /v1/portfolio:
9298
- get:
9299
- tags: [Portfolio]
9300
- summary: Get unified portfolio
9301
- description: |
9302
- Returns an aggregated view of all wallet balances (treasury wallets,
9303
- signing keys, smart accounts) with USD estimates.
9304
- operationId: getPortfolio
9429
+ /v1/org/sub-orgs:
9430
+ post:
9431
+ tags: [Sub-Organizations]
9432
+ summary: Create a sub-organization
9433
+ description: Create a new sub-organization under the current org.
9434
+ operationId: createSubOrg
9435
+ security:
9436
+ - BearerAuth: []
9437
+ requestBody:
9438
+ required: true
9439
+ content:
9440
+ application/json:
9441
+ schema:
9442
+ $ref: "#/components/schemas/CreateSubOrgRequest"
9443
+ responses:
9444
+ "201":
9445
+ description: Sub-organization created
9446
+ content:
9447
+ application/json:
9448
+ schema:
9449
+ $ref: "#/components/schemas/SubOrgResponse"
9450
+ "400":
9451
+ $ref: "#/components/responses/BadRequest"
9452
+ "401":
9453
+ $ref: "#/components/responses/Unauthorized"
9454
+ "403":
9455
+ $ref: "#/components/responses/Forbidden"
9456
+ get:
9457
+ tags: [Sub-Organizations]
9458
+ summary: List sub-organizations
9459
+ description: List all sub-organizations under the current org.
9460
+ operationId: listSubOrgs
9461
+ security:
9462
+ - BearerAuth: []
9463
+ responses:
9464
+ "200":
9465
+ description: Sub-organizations list
9466
+ content:
9467
+ application/json:
9468
+ schema:
9469
+ $ref: "#/components/schemas/SubOrgListResponse"
9470
+ "401":
9471
+ $ref: "#/components/responses/Unauthorized"
9472
+
9473
+ /v1/org/sub-orgs/{sub_org_id}:
9474
+ get:
9475
+ tags: [Sub-Organizations]
9476
+ summary: Get a sub-organization
9477
+ description: Retrieve a specific sub-organization by ID.
9478
+ operationId: getSubOrg
9479
+ security:
9480
+ - BearerAuth: []
9481
+ parameters:
9482
+ - name: sub_org_id
9483
+ in: path
9484
+ required: true
9485
+ schema:
9486
+ type: string
9487
+ format: uuid
9488
+ responses:
9489
+ "200":
9490
+ description: Sub-organization details
9491
+ content:
9492
+ application/json:
9493
+ schema:
9494
+ $ref: "#/components/schemas/SubOrgResponse"
9495
+ "401":
9496
+ $ref: "#/components/responses/Unauthorized"
9497
+ "404":
9498
+ $ref: "#/components/responses/NotFound"
9499
+ patch:
9500
+ tags: [Sub-Organizations]
9501
+ summary: Update a sub-organization
9502
+ description: Update sub-organization name, description, or billing model.
9503
+ operationId: updateSubOrg
9504
+ security:
9505
+ - BearerAuth: []
9506
+ parameters:
9507
+ - name: sub_org_id
9508
+ in: path
9509
+ required: true
9510
+ schema:
9511
+ type: string
9512
+ format: uuid
9513
+ requestBody:
9514
+ required: true
9515
+ content:
9516
+ application/json:
9517
+ schema:
9518
+ $ref: "#/components/schemas/CreateSubOrgRequest"
9519
+ responses:
9520
+ "200":
9521
+ description: Sub-organization updated
9522
+ content:
9523
+ application/json:
9524
+ schema:
9525
+ $ref: "#/components/schemas/SubOrgResponse"
9526
+ "401":
9527
+ $ref: "#/components/responses/Unauthorized"
9528
+ "404":
9529
+ $ref: "#/components/responses/NotFound"
9530
+ delete:
9531
+ tags: [Sub-Organizations]
9532
+ summary: Archive a sub-organization
9533
+ description: Archive (soft-delete) a sub-organization.
9534
+ operationId: deleteSubOrg
9535
+ security:
9536
+ - BearerAuth: []
9537
+ parameters:
9538
+ - name: sub_org_id
9539
+ in: path
9540
+ required: true
9541
+ schema:
9542
+ type: string
9543
+ format: uuid
9544
+ responses:
9545
+ "204":
9546
+ description: Sub-organization archived
9547
+ "401":
9548
+ $ref: "#/components/responses/Unauthorized"
9549
+ "404":
9550
+ $ref: "#/components/responses/NotFound"
9551
+
9552
+ /v1/org/sub-orgs/{sub_org_id}/users:
9553
+ post:
9554
+ tags: [Sub-Organizations]
9555
+ summary: Add a user to a sub-organization
9556
+ description: Add a user to a sub-organization with a specified role.
9557
+ operationId: addSubOrgUser
9558
+ security:
9559
+ - BearerAuth: []
9560
+ parameters:
9561
+ - name: sub_org_id
9562
+ in: path
9563
+ required: true
9564
+ schema:
9565
+ type: string
9566
+ format: uuid
9567
+ requestBody:
9568
+ required: true
9569
+ content:
9570
+ application/json:
9571
+ schema:
9572
+ $ref: "#/components/schemas/SubOrgAddUserRequest"
9573
+ responses:
9574
+ "201":
9575
+ description: User added to sub-organization
9576
+ "400":
9577
+ $ref: "#/components/responses/BadRequest"
9578
+ "401":
9579
+ $ref: "#/components/responses/Unauthorized"
9580
+ "404":
9581
+ $ref: "#/components/responses/NotFound"
9582
+
9583
+ /v1/org/sub-orgs/{sub_org_id}/permissions:
9584
+ post:
9585
+ tags: [Sub-Organizations]
9586
+ summary: Grant permissions to a sub-organization
9587
+ description: Grant a permission scope to the sub-organization.
9588
+ operationId: grantSubOrgPermission
9589
+ security:
9590
+ - BearerAuth: []
9591
+ parameters:
9592
+ - name: sub_org_id
9593
+ in: path
9594
+ required: true
9595
+ schema:
9596
+ type: string
9597
+ format: uuid
9598
+ requestBody:
9599
+ required: true
9600
+ content:
9601
+ application/json:
9602
+ schema:
9603
+ $ref: "#/components/schemas/SubOrgPermissionRequest"
9604
+ responses:
9605
+ "201":
9606
+ description: Permission granted
9607
+ "400":
9608
+ $ref: "#/components/responses/BadRequest"
9609
+ "401":
9610
+ $ref: "#/components/responses/Unauthorized"
9611
+ "404":
9612
+ $ref: "#/components/responses/NotFound"
9613
+
9614
+ /v1/org/sub-orgs/{sub_org_id}/permissions/{permission}:
9615
+ delete:
9616
+ tags: [Sub-Organizations]
9617
+ summary: Revoke a sub-organization permission
9618
+ description: Revoke a specific permission scope from the sub-organization.
9619
+ operationId: revokeSubOrgPermission
9620
+ security:
9621
+ - BearerAuth: []
9622
+ parameters:
9623
+ - name: sub_org_id
9624
+ in: path
9625
+ required: true
9626
+ schema:
9627
+ type: string
9628
+ format: uuid
9629
+ - name: permission
9630
+ in: path
9631
+ required: true
9632
+ schema:
9633
+ type: string
9634
+ description: The permission scope to revoke
9635
+ responses:
9636
+ "204":
9637
+ description: Permission revoked
9638
+ "401":
9639
+ $ref: "#/components/responses/Unauthorized"
9640
+ "404":
9641
+ $ref: "#/components/responses/NotFound"
9642
+
9643
+ /v1/org/sub-orgs/{sub_org_id}/wallets/generate:
9644
+ post:
9645
+ tags: [Sub-Organizations]
9646
+ summary: Generate wallets for a sub-organization
9647
+ description: Generate treasury wallets for specified chains within the sub-org.
9648
+ operationId: generateSubOrgWallets
9649
+ security:
9650
+ - BearerAuth: []
9651
+ parameters:
9652
+ - name: sub_org_id
9653
+ in: path
9654
+ required: true
9655
+ schema:
9656
+ type: string
9657
+ format: uuid
9658
+ requestBody:
9659
+ required: false
9660
+ content:
9661
+ application/json:
9662
+ schema:
9663
+ $ref: "#/components/schemas/SubOrgGenerateWalletsRequest"
9664
+ responses:
9665
+ "201":
9666
+ description: Wallets generated
9667
+ "401":
9668
+ $ref: "#/components/responses/Unauthorized"
9669
+ "403":
9670
+ $ref: "#/components/responses/Forbidden"
9671
+ "404":
9672
+ $ref: "#/components/responses/NotFound"
9673
+
9674
+ # ---------------------------------------------------------------------------
9675
+ # Portfolio
9676
+ # ---------------------------------------------------------------------------
9677
+
9678
+ /v1/portfolio:
9679
+ get:
9680
+ tags: [Portfolio]
9681
+ summary: Get unified portfolio
9682
+ description: |
9683
+ Returns an aggregated view of all wallet balances (treasury wallets,
9684
+ signing keys, smart accounts) with USD estimates.
9685
+ operationId: getPortfolio
9305
9686
  security:
9306
9687
  - BearerAuth: []
9307
9688
  parameters:
@@ -10347,6 +10728,8 @@ components:
10347
10728
  attribute_conditions:
10348
10729
  type: object
10349
10730
  additionalProperties: true
10731
+ consensus_trigger:
10732
+ $ref: "#/components/schemas/ConsensusTrigger"
10350
10733
 
10351
10734
  UpdatePolicyRequest:
10352
10735
  type: object
@@ -10372,6 +10755,8 @@ components:
10372
10755
  attribute_conditions:
10373
10756
  type: object
10374
10757
  additionalProperties: true
10758
+ consensus_trigger:
10759
+ $ref: "#/components/schemas/ConsensusTrigger"
10375
10760
 
10376
10761
  PolicyResponse:
10377
10762
  type: object
@@ -10426,6 +10811,8 @@ components:
10426
10811
  attribute_conditions:
10427
10812
  type: object
10428
10813
  additionalProperties: true
10814
+ consensus_trigger:
10815
+ $ref: "#/components/schemas/ConsensusTrigger"
10429
10816
 
10430
10817
  PolicyListResponse:
10431
10818
  type: object
@@ -12628,6 +13015,8 @@ components:
12628
13015
  $ref: "#/components/schemas/UsageMeter"
12629
13016
  intent_transactions:
12630
13017
  $ref: "#/components/schemas/UsageMeter"
13018
+ wallets:
13019
+ $ref: "#/components/schemas/UsageMeter"
12631
13020
  shares:
12632
13021
  $ref: "#/components/schemas/UsageMeter"
12633
13022
 
@@ -16314,13 +16703,13 @@ components:
16314
16703
 
16315
16704
  CreateCedarPolicyRequest:
16316
16705
  type: object
16317
- required: [policy_text]
16706
+ required: [name, cedar_text]
16318
16707
  properties:
16319
- policy_text:
16708
+ name:
16320
16709
  type: string
16321
- description: Cedar policy text
16322
- description:
16710
+ cedar_text:
16323
16711
  type: string
16712
+ description: Cedar policy text
16324
16713
 
16325
16714
  CedarPolicyResponse:
16326
16715
  type: object
@@ -16328,16 +16717,28 @@ components:
16328
16717
  id:
16329
16718
  type: string
16330
16719
  format: uuid
16331
- policy_text:
16720
+ org_id:
16332
16721
  type: string
16333
- description:
16722
+ format: uuid
16723
+ name:
16334
16724
  type: string
16335
- created_at:
16725
+ cedar_text:
16336
16726
  type: string
16337
- format: date-time
16727
+ is_active:
16728
+ type: boolean
16729
+ enforcement_status:
16730
+ type: string
16731
+ enum: [shadow, enforce, inactive]
16732
+ description: Dynamic status from org policy backend config
16338
16733
  created_by:
16339
16734
  type: string
16340
16735
  format: uuid
16736
+ created_at:
16737
+ type: string
16738
+ format: date-time
16739
+ updated_at:
16740
+ type: string
16741
+ format: date-time
16341
16742
 
16342
16743
  CedarPolicyListResponse:
16343
16744
  type: object
@@ -16349,14 +16750,23 @@ components:
16349
16750
 
16350
16751
  CedarPolicyTestRequest:
16351
16752
  type: object
16352
- required: [principal, action, resource]
16753
+ required: [principal_type, principal_id, action, resource_path, vault_id]
16353
16754
  properties:
16354
- principal:
16755
+ cedar_text:
16756
+ type: string
16757
+ description: Optional inline Cedar text to test
16758
+ principal_type:
16355
16759
  type: string
16760
+ principal_id:
16761
+ type: string
16762
+ format: uuid
16356
16763
  action:
16357
16764
  type: string
16358
- resource:
16765
+ resource_path:
16766
+ type: string
16767
+ vault_id:
16359
16768
  type: string
16769
+ format: uuid
16360
16770
  context:
16361
16771
  type: object
16362
16772
 
@@ -16366,10 +16776,13 @@ components:
16366
16776
  decision:
16367
16777
  type: string
16368
16778
  enum: [allow, deny]
16369
- reasons:
16370
- type: array
16371
- items:
16372
- type: string
16779
+ backend:
16780
+ type: string
16781
+ enforcement_status:
16782
+ type: string
16783
+ enum: [shadow, enforce, inactive]
16784
+ note:
16785
+ type: string
16373
16786
 
16374
16787
  # -------------------------------------------------------------------
16375
16788
  # OPA Policies
@@ -16377,16 +16790,19 @@ components:
16377
16790
 
16378
16791
  CreateOpaPolicyRequest:
16379
16792
  type: object
16380
- required: [rego_module]
16793
+ required: [name]
16381
16794
  properties:
16382
- rego_module:
16795
+ name:
16796
+ type: string
16797
+ rego_source:
16383
16798
  type: string
16384
16799
  description: OPA Rego module source
16385
- description:
16800
+ wasm_bundle_base64:
16386
16801
  type: string
16387
- data:
16388
- type: object
16389
- description: Static data document for the policy
16802
+ description: Optional WASM bundle (base64)
16803
+ entrypoint:
16804
+ type: string
16805
+ default: oneclaw/allow
16390
16806
 
16391
16807
  OpaPolicyResponse:
16392
16808
  type: object
@@ -16394,18 +16810,31 @@ components:
16394
16810
  id:
16395
16811
  type: string
16396
16812
  format: uuid
16397
- rego_module:
16813
+ org_id:
16398
16814
  type: string
16399
- description:
16815
+ format: uuid
16816
+ name:
16400
16817
  type: string
16401
- data:
16402
- type: object
16403
- created_at:
16818
+ rego_source:
16404
16819
  type: string
16405
- format: date-time
16820
+ has_wasm_bundle:
16821
+ type: boolean
16822
+ entrypoint:
16823
+ type: string
16824
+ is_active:
16825
+ type: boolean
16826
+ enforcement_status:
16827
+ type: string
16828
+ enum: [shadow, enforce, inactive]
16406
16829
  created_by:
16407
16830
  type: string
16408
16831
  format: uuid
16832
+ created_at:
16833
+ type: string
16834
+ format: date-time
16835
+ updated_at:
16836
+ type: string
16837
+ format: date-time
16409
16838
 
16410
16839
  OpaPolicyListResponse:
16411
16840
  type: object
@@ -16417,23 +16846,436 @@ components:
16417
16846
 
16418
16847
  OpaPolicyTestRequest:
16419
16848
  type: object
16420
- required: [input]
16849
+ required: [principal_type, principal_id, action, resource_path, vault_id]
16421
16850
  properties:
16422
- input:
16423
- type: object
16424
- description: Input document for policy evaluation
16425
- data:
16851
+ principal_type:
16852
+ type: string
16853
+ principal_id:
16854
+ type: string
16855
+ format: uuid
16856
+ action:
16857
+ type: string
16858
+ resource_path:
16859
+ type: string
16860
+ vault_id:
16861
+ type: string
16862
+ format: uuid
16863
+ context:
16426
16864
  type: object
16427
- description: Optional data override
16428
16865
 
16429
16866
  OpaPolicyTestResponse:
16430
16867
  type: object
16431
16868
  properties:
16432
- result:
16433
- type: object
16434
16869
  decision:
16435
16870
  type: string
16436
16871
  enum: [allow, deny]
16872
+ backend:
16873
+ type: string
16874
+ enforcement_status:
16875
+ type: string
16876
+ enum: [shadow, enforce, inactive]
16877
+ note:
16878
+ type: string
16879
+
16880
+ # -------------------------------------------------------------------
16881
+ # Policy Backend Settings
16882
+ # -------------------------------------------------------------------
16883
+
16884
+ PolicyBackendSettingsResponse:
16885
+ type: object
16886
+ properties:
16887
+ backend:
16888
+ type: string
16889
+ enum: [builtin, cedar, opa, builtin+cedar, builtin+opa]
16890
+ mode:
16891
+ type: string
16892
+ enum: [shadow, enforce]
16893
+ scope:
16894
+ type: array
16895
+ items:
16896
+ type: string
16897
+ breaker_behavior:
16898
+ type: string
16899
+ enum: [fail_closed, fail_open_builtin]
16900
+ policy_version:
16901
+ type: integer
16902
+ format: int64
16903
+
16904
+ UpdatePolicyBackendSettingsRequest:
16905
+ type: object
16906
+ properties:
16907
+ backend:
16908
+ type: string
16909
+ enum: [builtin, cedar, opa, builtin+cedar, builtin+opa]
16910
+ mode:
16911
+ type: string
16912
+ enum: [shadow, enforce]
16913
+ scope:
16914
+ type: array
16915
+ items:
16916
+ type: string
16917
+ breaker_behavior:
16918
+ type: string
16919
+ enum: [fail_closed, fail_open_builtin]
16920
+
16921
+ PolicyShadowReportResponse:
16922
+ type: object
16923
+ properties:
16924
+ total_evaluated:
16925
+ type: integer
16926
+ format: int64
16927
+ total_divergences:
16928
+ type: integer
16929
+ format: int64
16930
+ total_errors:
16931
+ type: integer
16932
+ format: int64
16933
+ concordance_rate:
16934
+ type: number
16935
+ format: double
16936
+ sample_events:
16937
+ type: array
16938
+ items:
16939
+ $ref: "#/components/schemas/PolicyShadowEvent"
16940
+ period_start:
16941
+ type: string
16942
+ format: date-time
16943
+ period_end:
16944
+ type: string
16945
+ format: date-time
16946
+
16947
+ PolicyShadowEvent:
16948
+ type: object
16949
+ properties:
16950
+ id:
16951
+ type: string
16952
+ format: uuid
16953
+ org_id:
16954
+ type: string
16955
+ format: uuid
16956
+ backend:
16957
+ type: string
16958
+ action:
16959
+ type: string
16960
+ builtin_decision:
16961
+ type: string
16962
+ backend_decision:
16963
+ type: string
16964
+ divergent:
16965
+ type: boolean
16966
+ sampled:
16967
+ type: boolean
16968
+ eval_duration_ms:
16969
+ type: integer
16970
+ error_text:
16971
+ type: string
16972
+ caller_id:
16973
+ type: string
16974
+ format: uuid
16975
+ resource_path:
16976
+ type: string
16977
+ created_at:
16978
+ type: string
16979
+ format: date-time
16980
+
16981
+ # -------------------------------------------------------------------
16982
+ # Contract ABIs
16983
+ # -------------------------------------------------------------------
16984
+
16985
+ CreateContractAbiRequest:
16986
+ type: object
16987
+ required: [chain, contract_address, abi_json]
16988
+ properties:
16989
+ chain:
16990
+ type: string
16991
+ contract_address:
16992
+ type: string
16993
+ abi_json:
16994
+ type: array
16995
+ items:
16996
+ type: object
16997
+ name:
16998
+ type: string
16999
+ description:
17000
+ type: string
17001
+ token_decimals:
17002
+ type: integer
17003
+
17004
+ ContractAbiResponse:
17005
+ type: object
17006
+ properties:
17007
+ id:
17008
+ type: string
17009
+ format: uuid
17010
+ org_id:
17011
+ type: string
17012
+ format: uuid
17013
+ chain:
17014
+ type: string
17015
+ contract_address:
17016
+ type: string
17017
+ abi_json:
17018
+ type: array
17019
+ items:
17020
+ type: object
17021
+ name:
17022
+ type: string
17023
+ description:
17024
+ type: string
17025
+ token_decimals:
17026
+ type: integer
17027
+ created_by:
17028
+ type: string
17029
+ format: uuid
17030
+ created_at:
17031
+ type: string
17032
+ format: date-time
17033
+ updated_at:
17034
+ type: string
17035
+ format: date-time
17036
+
17037
+ ContractAbiListResponse:
17038
+ type: object
17039
+ properties:
17040
+ abis:
17041
+ type: array
17042
+ items:
17043
+ $ref: "#/components/schemas/ContractAbiResponse"
17044
+
17045
+ # -------------------------------------------------------------------
17046
+ # Consensus / Pending Approvals
17047
+ # -------------------------------------------------------------------
17048
+
17049
+ ConsensusTrigger:
17050
+ type: object
17051
+ required: [conditions, approval]
17052
+ properties:
17053
+ conditions:
17054
+ type: array
17055
+ items:
17056
+ $ref: "#/components/schemas/ConsensusCondition"
17057
+ approval:
17058
+ $ref: "#/components/schemas/ApprovalRequirement"
17059
+ expiry_secs:
17060
+ type: integer
17061
+ format: int64
17062
+ default: 86400
17063
+ self_approval_allowed:
17064
+ type: boolean
17065
+ default: false
17066
+
17067
+ ConsensusCondition:
17068
+ oneOf:
17069
+ - type: object
17070
+ required: [type, threshold_gwei]
17071
+ properties:
17072
+ type:
17073
+ type: string
17074
+ enum: [value_above]
17075
+ threshold_gwei:
17076
+ type: integer
17077
+ format: int64
17078
+ - type: object
17079
+ required: [type, chains]
17080
+ properties:
17081
+ type:
17082
+ type: string
17083
+ enum: [chain_in]
17084
+ chains:
17085
+ type: array
17086
+ items:
17087
+ type: string
17088
+ - type: object
17089
+ required: [type, addresses]
17090
+ properties:
17091
+ type:
17092
+ type: string
17093
+ enum: [to_address_in]
17094
+ addresses:
17095
+ type: array
17096
+ items:
17097
+ type: string
17098
+ - type: object
17099
+ required: [type, selectors]
17100
+ properties:
17101
+ type:
17102
+ type: string
17103
+ enum: [function_selector_in]
17104
+ selectors:
17105
+ type: array
17106
+ items:
17107
+ type: string
17108
+ - type: object
17109
+ required: [type, threshold_raw]
17110
+ properties:
17111
+ type:
17112
+ type: string
17113
+ enum: [erc20_amount_above]
17114
+ threshold_raw:
17115
+ type: string
17116
+ - type: object
17117
+ required: [type, intent_types]
17118
+ properties:
17119
+ type:
17120
+ type: string
17121
+ enum: [intent_type_in]
17122
+ intent_types:
17123
+ type: array
17124
+ items:
17125
+ type: string
17126
+ - type: object
17127
+ required: [type]
17128
+ properties:
17129
+ type:
17130
+ type: string
17131
+ enum: [always]
17132
+
17133
+ ApprovalRequirement:
17134
+ type: object
17135
+ required: [min_approvals]
17136
+ properties:
17137
+ min_approvals:
17138
+ type: integer
17139
+ required_roles:
17140
+ type: array
17141
+ items:
17142
+ type: string
17143
+ per_role_minimums:
17144
+ type: object
17145
+ additionalProperties:
17146
+ type: integer
17147
+
17148
+ SubmitPendingApprovalRequest:
17149
+ type: object
17150
+ required: [policy_id, action, action_payload]
17151
+ properties:
17152
+ policy_id:
17153
+ type: string
17154
+ format: uuid
17155
+ action:
17156
+ type: string
17157
+ action_payload:
17158
+ type: object
17159
+
17160
+ SubmitPendingApprovalResponse:
17161
+ type: object
17162
+ properties:
17163
+ pending_approval_id:
17164
+ type: string
17165
+ format: uuid
17166
+ required_approvals:
17167
+ type: integer
17168
+ current_approvals:
17169
+ type: integer
17170
+ expires_at:
17171
+ type: string
17172
+ format: date-time
17173
+ status:
17174
+ type: string
17175
+ message:
17176
+ type: string
17177
+
17178
+ ApprovePendingApprovalRequest:
17179
+ type: object
17180
+ required: [decision, payload_hash]
17181
+ properties:
17182
+ decision:
17183
+ type: string
17184
+ enum: [approve, reject]
17185
+ payload_hash:
17186
+ type: string
17187
+ reason:
17188
+ type: string
17189
+
17190
+ PendingApprovalResponse:
17191
+ type: object
17192
+ properties:
17193
+ id:
17194
+ type: string
17195
+ format: uuid
17196
+ org_id:
17197
+ type: string
17198
+ format: uuid
17199
+ policy_id:
17200
+ type: string
17201
+ format: uuid
17202
+ action:
17203
+ type: string
17204
+ action_payload:
17205
+ type: object
17206
+ payload_hash:
17207
+ type: string
17208
+ submitted_by:
17209
+ type: string
17210
+ format: uuid
17211
+ submitted_by_type:
17212
+ type: string
17213
+ status:
17214
+ type: string
17215
+ required_approvals:
17216
+ type: integer
17217
+ current_approvals:
17218
+ type: integer
17219
+ expires_at:
17220
+ type: string
17221
+ format: date-time
17222
+ executed_at:
17223
+ type: string
17224
+ format: date-time
17225
+ created_at:
17226
+ type: string
17227
+ format: date-time
17228
+ updated_at:
17229
+ type: string
17230
+ format: date-time
17231
+ signatures:
17232
+ type: array
17233
+ items:
17234
+ $ref: "#/components/schemas/ApprovalSignatureResponse"
17235
+
17236
+ ApprovalSignatureResponse:
17237
+ type: object
17238
+ properties:
17239
+ id:
17240
+ type: string
17241
+ format: uuid
17242
+ approver_id:
17243
+ type: string
17244
+ format: uuid
17245
+ approver_type:
17246
+ type: string
17247
+ decision:
17248
+ type: string
17249
+ reason:
17250
+ type: string
17251
+ created_at:
17252
+ type: string
17253
+ format: date-time
17254
+
17255
+ PendingApprovalListResponse:
17256
+ type: object
17257
+ properties:
17258
+ pending_approvals:
17259
+ type: array
17260
+ items:
17261
+ $ref: "#/components/schemas/PendingApprovalResponse"
17262
+ total:
17263
+ type: integer
17264
+ format: int64
17265
+
17266
+ ExecutePendingApprovalResponse:
17267
+ type: object
17268
+ properties:
17269
+ pending_approval_id:
17270
+ type: string
17271
+ format: uuid
17272
+ status:
17273
+ type: string
17274
+ executed_at:
17275
+ type: string
17276
+ format: date-time
17277
+ result:
17278
+ type: object
16437
17279
 
16438
17280
  # -------------------------------------------------------------------
16439
17281
  # Sub-Organizations