@1claw/openapi-spec 0.49.0 → 0.51.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "2.36.0",
+    "version": "0.51.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -190,6 +190,10 @@
     {
       "name": "Portfolio",
       "description": "Unified balance aggregator"
+    },
+    {
+      "name": "Environment Variables",
+      "description": "Per-vault and org-shared environment variable management"
     }
   ],
   "paths": {
@@ -921,7 +925,19 @@
           "Authentication"
         ],
         "summary": "Complete passkey registration",
+        "description": "When the account already has a password, passkey, or TOTP,\n`X-Auth-Confirm` is required (purpose `security.passkey.register`).\n",
         "operationId": "passkeyRegisterComplete",
+        "parameters": [
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": false,
+            "description": "Re-auth token (`rat_`) or account password",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -1154,6 +1170,7 @@
           "Authentication"
         ],
         "summary": "Delete a passkey",
+        "description": "Removes a registered passkey. Requires recent re-authentication\n(`X-Auth-Confirm` with a `rat_` token from `POST /v1/auth/reauth`\nusing purpose `security.passkey.delete`). Passkey or TOTP is\nrequired when either is enrolled. Deleting the last passkey is\nrefused while vault passkey unlock is enabled.\n",
         "operationId": "deletePasskey",
         "parameters": [
           {
@@ -1164,11 +1181,23 @@
               "type": "string",
               "format": "uuid"
             }
+          },
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": true,
+            "description": "Re-auth token (`rat_`) or account password",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
           "200": {
             "description": "Passkey deleted"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         }
       }
@@ -1305,6 +1334,17 @@
         ],
         "summary": "Delete current user account",
         "operationId": "deleteMe",
+        "parameters": [
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": true,
+            "description": "Re-auth token (`rat_`, purpose `account.delete`) or password",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -1334,6 +1374,76 @@
         }
       }
     },
+    "/v1/auth/settings": {
+      "get": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Get user security settings",
+        "operationId": "getSecuritySettings",
+        "responses": {
+          "200": {
+            "description": "Security settings",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "require_passkey_for_vaults": {
+                      "type": "boolean"
+                    },
+                    "passkey_count": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Update user security settings",
+        "description": "Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`\n(purpose `security.vault_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n",
+        "operationId": "updateSecuritySettings",
+        "parameters": [
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "require_passkey_for_vaults": {
+                    "type": "boolean"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Updated settings"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
     "/v1/auth/mfa/status": {
       "get": {
         "tags": [
@@ -1451,7 +1561,19 @@
           "Authentication"
         ],
         "summary": "Disable MFA",
+        "description": "Requires a valid TOTP or recovery code in the body, or a passkey\nre-auth token in `X-Auth-Confirm` (purpose `security.mfa.disable`).\nAccount password alone is not accepted while TOTP is enabled.\n",
         "operationId": "mfaDisable",
+        "parameters": [
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": false,
+            "description": "Passkey or TOTP re-auth token (`rat_`)",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -1699,8 +1821,18 @@
           "Authentication"
         ],
         "summary": "Export user data (GDPR)",
-        "description": "Returns a full export of the authenticated user's data including\nprofile, vaults, agents, secrets metadata, and policies. Intended\nfor GDPR data-portability requests. Only available to human users\n(not agents).\n",
+        "description": "Returns a full export of the authenticated user's data including\nprofile, vaults, agents, secrets metadata, and policies. Intended\nfor GDPR data-portability requests. Only available to human users\n(not agents). Requires `X-Auth-Confirm` (purpose `account.export`);\npasskey or TOTP when either is enrolled.\n",
         "operationId": "exportUserData",
+        "parameters": [
+          {
+            "name": "X-Auth-Confirm",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "User data export",
@@ -2889,65 +3021,76 @@
         }
       }
     },
-    "/v1/agents/enroll": {
-      "post": {
+    "/v1/vaults/{vault_id}/env-vars": {
+      "get": {
         "tags": [
-          "Agents"
+          "Environment Variables"
         ],
-        "summary": "Self-enroll an agent",
-        "operationId": "enrollAgent",
-        "description": "Public endpoint (no auth required).\n\n**With `human_email`:** Creates a pending enrollment for that account's org,\nemails Allow/Deny links, and returns `approval_url` in the JSON body (use if email\nis delayed). The API key is NOT returned until the human approves.\n\n**Name only (omit `human_email`):** Creates a link-only pending enrollment.\nThe response includes `approval_url`; the human opens it while signed in to\napprove the agent into their org.\n\nAnti-spam: IP rate limiting, per-email cooldown, caps on pending rows.\n",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/EnrollAgentRequest"
-              }
-            }
+        "summary": "List environment variables",
+        "description": "List all environment variables for a vault, optionally filtered by environment.",
+        "operationId": "listEnvVars",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Filter by environment (production, preview, development, or custom)"
           }
-        },
+        ],
         "responses": {
-          "201": {
-            "description": "Enrollment processed (uniform response to prevent email enumeration)",
+          "200": {
+            "description": "Environment variable list",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/EnrollAgentResponse"
+                  "type": "object",
+                  "properties": {
+                    "env_vars": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/EnvVar"
+                      }
+                    }
+                  }
                 }
               }
             }
-          },
-          "429": {
-            "description": "Rate limit exceeded"
           }
         }
-      }
-    },
-    "/v1/agents": {
+      },
       "post": {
         "tags": [
-          "Agents"
+          "Environment Variables"
+        ],
+        "summary": "Create environment variable",
+        "operationId": "createEnvVar",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          }
         ],
-        "summary": "Register a new agent",
-        "operationId": "createAgent",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateAgentRequest"
+                "$ref": "#/components/schemas/CreateEnvVarRequest"
               }
             }
           }
         },
         "responses": {
           "201": {
-            "description": "Agent created with one-time API key",
+            "description": "Environment variable created",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AgentCreatedResponse"
+                  "$ref": "#/components/schemas/EnvVar"
                 }
               }
             }
@@ -2956,70 +3099,84 @@
             "$ref": "#/components/responses/BadRequest"
           }
         }
-      },
+      }
+    },
+    "/v1/vaults/{vault_id}/env-vars/resolve": {
       "get": {
         "tags": [
-          "Agents"
+          "Environment Variables"
         ],
-        "summary": "List agents",
-        "operationId": "listAgents",
-        "responses": {
-          "200": {
-            "description": "Agent list",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AgentListResponse"
-                }
-              }
+        "summary": "Resolve environment variables",
+        "description": "Resolve the final KEY=VALUE set for an environment with full precedence (shared < vault < branch override).",
+        "operationId": "resolveEnvVars",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "git_branch",
+            "in": "query",
+            "schema": {
+              "type": "string"
             }
           }
-        }
-      }
-    },
-    "/v1/agents/me": {
-      "get": {
-        "tags": [
-          "Agents"
         ],
-        "summary": "Get the calling agent's own profile",
-        "operationId": "getAgentSelf",
         "responses": {
           "200": {
-            "description": "Agent self profile",
+            "description": "Resolved environment variables",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AgentSelfResponse"
+                  "$ref": "#/components/schemas/ResolveEnvVarsResponse"
                 }
               }
             }
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
           }
         }
       }
     },
-    "/v1/agents/{agent_id}": {
+    "/v1/vaults/{vault_id}/env-vars/{key}": {
       "get": {
         "tags": [
-          "Agents"
+          "Environment Variables"
         ],
-        "summary": "Get agent details",
-        "operationId": "getAgent",
+        "summary": "Get environment variable",
+        "operationId": "getEnvVar",
         "parameters": [
           {
-            "$ref": "#/components/parameters/AgentId"
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
           "200": {
-            "description": "Agent details",
+            "description": "Environment variable",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AgentResponse"
+                  "$ref": "#/components/schemas/EnvVar"
                 }
               }
             }
@@ -3031,32 +3188,354 @@
       },
       "patch": {
         "tags": [
-          "Agents"
+          "Environment Variables"
         ],
-        "summary": "Update an agent",
-        "operationId": "updateAgent",
+        "summary": "Update environment variable",
+        "operationId": "updateEnvVar",
         "parameters": [
           {
-            "$ref": "#/components/parameters/AgentId"
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
-          "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/UpdateAgentRequest"
+                "$ref": "#/components/schemas/UpdateEnvVarRequest"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Agent updated",
+            "description": "Environment variable updated",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AgentResponse"
+                  "$ref": "#/components/schemas/EnvVar"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Environment Variables"
+        ],
+        "summary": "Delete environment variable",
+        "operationId": "deleteEnvVar",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deleted"
+          }
+        }
+      }
+    },
+    "/v1/vaults/{vault_id}/environments": {
+      "get": {
+        "tags": [
+          "Environment Variables"
+        ],
+        "summary": "List vault environments",
+        "operationId": "listVaultEnvironments",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Vault environment list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "environments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/VaultEnvironment"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Environment Variables"
+        ],
+        "summary": "Create custom environment",
+        "operationId": "createVaultEnvironment",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateEnvironmentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Environment created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/VaultEnvironment"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      }
+    },
+    "/v1/vaults/{vault_id}/environments/{slug}": {
+      "delete": {
+        "tags": [
+          "Environment Variables"
+        ],
+        "summary": "Delete custom environment",
+        "operationId": "deleteVaultEnvironment",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/VaultId"
+          },
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deleted"
+          }
+        }
+      }
+    },
+    "/v1/agents/enroll": {
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Self-enroll an agent",
+        "operationId": "enrollAgent",
+        "description": "Public endpoint (no auth required).\n\n**With `human_email`:** Creates a pending enrollment for that account's org,\nemails Allow/Deny links, and returns `approval_url` in the JSON body (use if email\nis delayed). The API key is NOT returned until the human approves.\n\n**Name only (omit `human_email`):** Creates a link-only pending enrollment.\nThe response includes `approval_url`; the human opens it while signed in to\napprove the agent into their org.\n\nAnti-spam: IP rate limiting, per-email cooldown, caps on pending rows.\n",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnrollAgentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Enrollment processed (uniform response to prevent email enumeration)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EnrollAgentResponse"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        }
+      }
+    },
+    "/v1/agents": {
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Register a new agent",
+        "operationId": "createAgent",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateAgentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Agent created with one-time API key",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AgentCreatedResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "List agents",
+        "operationId": "listAgents",
+        "responses": {
+          "200": {
+            "description": "Agent list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AgentListResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/agents/me": {
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Get the calling agent's own profile",
+        "operationId": "getAgentSelf",
+        "responses": {
+          "200": {
+            "description": "Agent self profile",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AgentSelfResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}": {
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Get agent details",
+        "operationId": "getAgent",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Agent details",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AgentResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Update an agent",
+        "operationId": "updateAgent",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateAgentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Agent updated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AgentResponse"
                 }
               }
             }
@@ -5228,6 +5707,213 @@
         }
       }
     },
+    "/v1/org/env-vars": {
+      "get": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "List org shared environment variables",
+        "operationId": "listOrgEnvVars",
+        "responses": {
+          "200": {
+            "description": "Org shared environment variable list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "env_vars": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/OrgEnvVar"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Create org shared environment variable",
+        "operationId": "createOrgEnvVar",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateOrgEnvVarRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Org shared env var created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgEnvVar"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      }
+    },
+    "/v1/org/env-vars/{key}": {
+      "patch": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Update org shared environment variable",
+        "operationId": "updateOrgEnvVar",
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateOrgEnvVarRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Org shared env var updated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgEnvVar"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/org/env-vars/{id}": {
+      "delete": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Delete org shared environment variable",
+        "operationId": "deleteOrgEnvVar",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deleted"
+          }
+        }
+      }
+    },
+    "/v1/org/env-vars/{id}/link": {
+      "post": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Link org shared env var to a vault",
+        "operationId": "linkOrgEnvVar",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "vault_id"
+                ],
+                "properties": {
+                  "vault_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Linked"
+          }
+        }
+      }
+    },
+    "/v1/org/env-vars/{id}/links/{vault_id}": {
+      "delete": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Unlink org shared env var from a vault",
+        "operationId": "unlinkOrgEnvVar",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "vault_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Unlinked"
+          }
+        }
+      }
+    },
     "/v1/billing/usage": {
       "get": {
         "tags": [
@@ -16066,10 +16752,13 @@
         "type": "object",
         "properties": {
           "code": {
-            "type": "string"
+            "type": "string",
+            "description": "TOTP or recovery code"
           },
           "password": {
-            "type": "string"
+            "type": "string",
+            "description": "Deprecated. Password is no longer sufficient to disable MFA.",
+            "deprecated": true
           }
         }
       },
@@ -24097,6 +24786,10 @@
           "image": {
             "type": "string"
           },
+          "environment": {
+            "type": "string",
+            "description": "Vault environment to resolve env vars from (e.g. production, preview, development)"
+          },
           "env_public": {
             "type": "object",
             "additionalProperties": {
@@ -24152,6 +24845,10 @@
           "image": {
             "type": "string"
           },
+          "environment": {
+            "type": "string",
+            "description": "Vault environment to resolve env vars from"
+          },
           "env_public": {
             "type": "object",
             "additionalProperties": {
@@ -24238,6 +24935,11 @@
             "type": "string",
             "nullable": true
           },
+          "environment": {
+            "type": "string",
+            "nullable": true,
+            "description": "Vault environment for env var resolution"
+          },
           "env_public": {
             "type": "object",
             "additionalProperties": {
@@ -25967,7 +26669,43 @@
           },
           "value_above": {
             "type": "string",
-            "description": "Native value threshold in gwei"
+            "description": "Native value threshold in wei (arbitrary-precision string)"
+          },
+          "eip712_primary_type_in": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Match EIP-712 typed_data primaryType (case-sensitive)"
+          },
+          "eip712_verifying_contract_in": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Match EIP-712 domain.verifyingContract (case-insensitive)"
+          },
+          "eip712_domain_name_in": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Match EIP-712 domain.name"
+          },
+          "eip712_domain_chain_id_in": {
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int64"
+            },
+            "description": "Match EIP-712 domain.chainId"
+          },
+          "eip7702_authorized_addresses_in": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Match EIP-7702 authorization_list delegate addresses (case-insensitive)"
           },
           "to_address_in": {
             "type": "array",
@@ -26130,8 +26868,7 @@
           {
             "type": "object",
             "required": [
-              "type",
-              "threshold_gwei"
+              "type"
             ],
             "properties": {
               "type": {
@@ -26140,9 +26877,15 @@
                   "value_above"
                 ]
               },
+              "threshold_wei": {
+                "type": "string",
+                "description": "Value threshold in wei (arbitrary-precision string). Preferred over threshold_gwei."
+              },
               "threshold_gwei": {
                 "type": "integer",
-                "format": "int64"
+                "format": "int64",
+                "deprecated": true,
+                "description": "Deprecated — use threshold_wei for arbitrary precision"
               }
             }
           },
@@ -26251,14 +26994,36 @@
           {
             "type": "object",
             "required": [
-              "type"
+              "type"
+            ],
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "always"
+                ]
+              }
+            }
+          },
+          {
+            "type": "object",
+            "required": [
+              "type",
+              "actions"
             ],
             "properties": {
               "type": {
                 "type": "string",
                 "enum": [
-                  "always"
+                  "action_in"
                 ]
+              },
+              "actions": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Control-plane actions to match, e.g. policy.create, policy.update,\npolicy.delete, signing_key.export, member.role_change, member.remove\n"
               }
             }
           }
@@ -26284,6 +27049,20 @@
             "additionalProperties": {
               "type": "integer"
             }
+          },
+          "require_credential_types": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "password",
+                "passkey",
+                "totp",
+                "biometric",
+                "api_key"
+              ]
+            },
+            "description": "At least one approval must use one of these credential types"
           }
         }
       },
@@ -26351,6 +27130,17 @@
           },
           "reason": {
             "type": "string"
+          },
+          "credential_type": {
+            "type": "string",
+            "enum": [
+              "password",
+              "passkey",
+              "totp",
+              "biometric",
+              "api_key"
+            ],
+            "description": "Authentication method used for this approval vote"
           }
         }
       },
@@ -26718,6 +27508,292 @@
             "format": "date-time"
           }
         }
+      },
+      "EnvVar": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "key": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "git_branch": {
+            "type": "string",
+            "nullable": true
+          },
+          "sensitive": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string",
+            "nullable": true
+          },
+          "value": {
+            "type": "string",
+            "nullable": true,
+            "description": "Null for sensitive vars in list responses"
+          },
+          "version": {
+            "type": "integer"
+          },
+          "created_by": {
+            "type": "string",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateEnvVarRequest": {
+        "type": "object",
+        "required": [
+          "key",
+          "value"
+        ],
+        "properties": {
+          "key": {
+            "type": "string",
+            "description": "Uppercase alphanumeric + underscore, 1-256 chars"
+          },
+          "value": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "production",
+              "preview",
+              "development"
+            ]
+          },
+          "git_branch": {
+            "type": "string",
+            "description": "Branch override (preview only)"
+          },
+          "sensitive": {
+            "type": "boolean",
+            "default": false
+          },
+          "comment": {
+            "type": "string"
+          }
+        }
+      },
+      "UpdateEnvVarRequest": {
+        "type": "object",
+        "properties": {
+          "value": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "sensitive": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          }
+        }
+      },
+      "ResolveEnvVarsResponse": {
+        "type": "object",
+        "properties": {
+          "vars": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "sources": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string",
+              "enum": [
+                "shared",
+                "vault",
+                "branch_override"
+              ]
+            }
+          },
+          "environment": {
+            "type": "string"
+          },
+          "git_branch": {
+            "type": "string",
+            "nullable": true
+          },
+          "resolved_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "VaultEnvironment": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "slug": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string",
+            "nullable": true
+          },
+          "is_builtin": {
+            "type": "boolean"
+          },
+          "copied_from": {
+            "type": "string",
+            "nullable": true
+          },
+          "is_detached": {
+            "type": "boolean"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateEnvironmentRequest": {
+        "type": "object",
+        "required": [
+          "slug"
+        ],
+        "properties": {
+          "slug": {
+            "type": "string",
+            "description": "Lowercase alphanumeric + hyphens, 2-30 chars"
+          },
+          "description": {
+            "type": "string"
+          },
+          "copy_from": {
+            "type": "string",
+            "description": "Copy env vars from this environment"
+          }
+        }
+      },
+      "OrgEnvVar": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "key": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "sensitive": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string",
+            "nullable": true
+          },
+          "value": {
+            "type": "string",
+            "nullable": true
+          },
+          "version": {
+            "type": "integer"
+          },
+          "linked_vaults": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateOrgEnvVarRequest": {
+        "type": "object",
+        "required": [
+          "key",
+          "value"
+        ],
+        "properties": {
+          "key": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "production",
+              "preview",
+              "development"
+            ]
+          },
+          "sensitive": {
+            "type": "boolean",
+            "default": false
+          },
+          "comment": {
+            "type": "string"
+          }
+        }
+      },
+      "UpdateOrgEnvVarRequest": {
+        "type": "object",
+        "properties": {
+          "value": {
+            "type": "string"
+          },
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "comment": {
+            "type": "string"
+          }
+        }
       }
     }
   }