@1claw/openapi-spec 0.53.0 → 0.53.1

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.53.0",
+    "version": "0.53.1",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -194,6 +194,18 @@
     {
       "name": "Environment Variables",
       "description": "Per-vault and org-shared environment variable management"
+    },
+    {
+      "name": "Wallet Access",
+      "description": "Role-based wallet access policies for agents and users"
+    },
+    {
+      "name": "Credential Recovery",
+      "description": "MFA/passkey/password recovery escape hatch with admin approval"
+    },
+    {
+      "name": "Shamir KEK",
+      "description": "Shamir secret-sharing for org-level Key Encryption Keys"
     }
   ],
   "paths": {
@@ -16032,187 +16044,816 @@
           }
         }
       }
-    }
-  },
-  "components": {
-    "securitySchemes": {
-      "BearerAuth": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "JWT"
-      },
-      "ApiKeyAuth": {
-        "type": "http",
-        "scheme": "bearer",
-        "description": "1ck_ prefixed API key used as Bearer token"
-      }
-    },
-    "parameters": {
-      "VaultId": {
-        "name": "vault_id",
-        "in": "path",
-        "required": true,
-        "schema": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "SecretPath": {
-        "name": "path",
-        "in": "path",
-        "required": true,
-        "schema": {
-          "type": "string"
-        },
-        "description": "Secret path (e.g. \"db/credentials\")"
-      },
-      "AgentId": {
-        "name": "agent_id",
-        "in": "path",
-        "required": true,
-        "schema": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "PolicyId": {
-        "name": "policy_id",
-        "in": "path",
-        "required": true,
-        "schema": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "CardId": {
-        "name": "card_id",
-        "in": "path",
-        "required": true,
-        "schema": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "IncludeSignedTx": {
-        "name": "include_signed_tx",
-        "in": "query",
-        "required": false,
-        "description": "Set to `true` or `1` to include the raw signed transaction hex in the response. Omitted by default to reduce key exfiltration risk. Only the literal values \"true\" or \"1\" enable inclusion; any other value or omission returns responses without signed_tx. Applies to GET /v1/agents/{agent_id}/transactions and GET /v1/agents/{agent_id}/transactions/{tx_id}.\n",
-        "schema": {
-          "type": "boolean",
-          "default": false,
-          "example": false
-        }
-      }
     },
-    "responses": {
-      "BadRequest": {
-        "description": "Invalid request",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ProblemDetails"
-            }
+    "/v1/wallets/access-policies": {
+      "post": {
+        "tags": [
+          "Wallet Access"
+        ],
+        "summary": "Create a wallet access policy",
+        "description": "Create a role-based wallet access policy granting an agent or user\nspecific permissions (send, swap, receive) on a treasury wallet chain.\n",
+        "operationId": "createWalletAccessPolicy",
+        "security": [
+          {
+            "BearerAuth": []
           }
-        }
-      },
-      "Unauthorized": {
-        "description": "Authentication required or invalid",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ProblemDetails"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateWalletAccessPolicyRequest"
+              }
             }
           }
-        }
-      },
-      "Forbidden": {
-        "description": "Insufficient permissions",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ProblemDetails"
+        },
+        "responses": {
+          "201": {
+            "description": "Policy created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WalletAccessPolicyResponse"
+                }
+              }
             }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         }
       },
-      "NotFound": {
-        "description": "Resource not found",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ProblemDetails"
-            }
+      "get": {
+        "tags": [
+          "Wallet Access"
+        ],
+        "summary": "List wallet access policies for the org",
+        "operationId": "listWalletAccessPolicies",
+        "security": [
+          {
+            "BearerAuth": []
           }
-        }
-      },
-      "PaymentRequired": {
-        "description": "x402 payment required",
-        "content": {
-          "application/json": {
+        ],
+        "parameters": [
+          {
+            "name": "wallet_chain",
+            "in": "query",
             "schema": {
-              "$ref": "#/components/schemas/PaymentRequirement"
-            }
-          }
-        }
-      },
-      "Conflict": {
-        "description": "Resource already exists or conflict",
-        "content": {
-          "application/json": {
+              "type": "string"
+            },
+            "description": "Filter by chain (e.g. ethereum, solana)"
+          },
+          {
+            "name": "target_agent_id",
+            "in": "query",
             "schema": {
-              "$ref": "#/components/schemas/ProblemDetails"
+              "type": "string",
+              "format": "uuid"
+            },
+            "description": "Filter by target agent"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Policy list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WalletAccessPolicyListResponse"
+                }
+              }
             }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
           }
         }
       }
     },
-    "schemas": {
-      "OrderCardRequest": {
-        "type": "object",
-        "required": [
-          "kind",
-          "amount_usd"
+    "/v1/wallets/access-policies/{id}": {
+      "delete": {
+        "tags": [
+          "Wallet Access"
         ],
-        "properties": {
-          "kind": {
-            "type": "string",
-            "enum": [
-              "prepaid",
-              "gift_card"
-            ]
+        "summary": "Delete a wallet access policy",
+        "operationId": "deleteWalletAccessPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Policy deleted"
           },
-          "amount_usd": {
-            "type": "string",
-            "description": "USD amount to load onto the card.",
-            "example": "25.00"
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
           },
-          "laso_server_id": {
-            "type": "string",
-            "description": "Optional Laso gift-card server/brand id (gift cards only)."
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           },
-          "country": {
-            "type": "string",
-            "description": "Optional country (prepaid cards; defaults to US)."
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         }
-      },
-      "CardResponse": {
-        "type": "object",
-        "description": "Masked card view — never contains PAN/CVV.",
-        "required": [
-          "id",
-          "issuer",
-          "kind",
-          "currency",
-          "status",
-          "storage_mode",
-          "reveal_policy",
-          "created_at",
-          "updated_at"
+      }
+    },
+    "/v1/auth/credential-recovery/request": {
+      "post": {
+        "tags": [
+          "Credential Recovery"
         ],
-        "properties": {
-          "id": {
+        "summary": "Initiate credential recovery",
+        "description": "Start a credential recovery request for MFA reset, passkey reset,\nor password reset. Requires admin approval per org policy.\n",
+        "operationId": "requestCredentialRecovery",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CredentialRecoveryRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Recovery request created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/auth/credential-recovery/requests": {
+      "get": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "List recovery requests for the org",
+        "description": "Admin/owner only. Returns pending, approved, and rejected recovery requests.",
+        "operationId": "listCredentialRecoveryRequests",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "pending_approval",
+                "approved",
+                "rejected",
+                "expired"
+              ]
+            },
+            "description": "Filter by status"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Recovery request list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/auth/credential-recovery/requests/{id}/approve": {
+      "post": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "Approve a recovery request",
+        "description": "Admin/owner approves a pending recovery request. May return a one-time recovery code.",
+        "operationId": "approveCredentialRecovery",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Request approved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryApproveResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/auth/credential-recovery/requests/{id}/execute": {
+      "post": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "Execute an approved credential recovery request",
+        "description": "Execute an approved credential recovery request after the delay window has elapsed. Only org owners or admins can execute.",
+        "operationId": "executeCredentialRecovery",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Recovery executed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryExecuteResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/auth/credential-recovery/requests/{id}": {
+      "delete": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "Cancel or reject a recovery request",
+        "operationId": "cancelCredentialRecovery",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Request cancelled"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/org/credential-recovery-policy": {
+      "get": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "Get org credential recovery policy",
+        "operationId": "getCredentialRecoveryPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Recovery policy",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryPolicyResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Credential Recovery"
+        ],
+        "summary": "Update org credential recovery policy",
+        "operationId": "updateCredentialRecoveryPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CredentialRecoveryPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Policy updated",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CredentialRecoveryPolicyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/org/shamir-kek/setup": {
+      "post": {
+        "tags": [
+          "Shamir KEK"
+        ],
+        "summary": "Set up Shamir KEK for the org",
+        "description": "Initialize a Shamir secret-sharing KEK for the org. Splits the master\nkey into shares distributed to custodians. Shares are returned one-time\nonly and must be stored securely by each custodian.\n",
+        "operationId": "setupShamirKek",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ShamirKekSetupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Shamir KEK configured (shares returned one-time)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShamirKekSetupResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/org/shamir-kek": {
+      "get": {
+        "tags": [
+          "Shamir KEK"
+        ],
+        "summary": "Get Shamir KEK status",
+        "description": "Returns the current Shamir KEK configuration status for the org.",
+        "operationId": "getShamirKekStatus",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Shamir KEK status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShamirKekStatusResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/org/shamir-kek/reconstruct": {
+      "post": {
+        "tags": [
+          "Shamir KEK"
+        ],
+        "summary": "Reconstruct KEK from shares",
+        "description": "Submit Shamir shares to reconstruct the org KEK. Requires at least\n`threshold` valid shares. Used during disaster recovery.\n",
+        "operationId": "reconstructShamirKek",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ShamirKekReconstructRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Reconstruction result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShamirKekReconstructResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/org/shamir-kek/recovery-codes": {
+      "get": {
+        "tags": [
+          "Shamir KEK"
+        ],
+        "summary": "Get Shamir recovery codes (one-time)",
+        "description": "Returns the one-time recovery codes for the Shamir KEK. These codes\ncan be used as an emergency fallback if custodian shares are lost.\nCodes are only returned once — subsequent calls return 410.\n",
+        "operationId": "getShamirKekRecoveryCodes",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Recovery codes (one-time)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShamirKekRecoveryCodesResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "410": {
+            "description": "Codes already retrieved"
+          }
+        }
+      }
+    },
+    "/v1/org/shamir-kek/verify-recovery-code": {
+      "post": {
+        "tags": [
+          "Shamir KEK"
+        ],
+        "summary": "Verify a Shamir recovery code",
+        "description": "Check whether a recovery code is valid without consuming it.",
+        "operationId": "verifyShamirKekRecoveryCode",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ShamirKekVerifyCodeRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Verification result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShamirKekVerifyCodeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "BearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "JWT"
+      },
+      "ApiKeyAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "1ck_ prefixed API key used as Bearer token"
+      }
+    },
+    "parameters": {
+      "VaultId": {
+        "name": "vault_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "format": "uuid"
+        }
+      },
+      "SecretPath": {
+        "name": "path",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        },
+        "description": "Secret path (e.g. \"db/credentials\")"
+      },
+      "AgentId": {
+        "name": "agent_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "format": "uuid"
+        }
+      },
+      "PolicyId": {
+        "name": "policy_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "format": "uuid"
+        }
+      },
+      "CardId": {
+        "name": "card_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "format": "uuid"
+        }
+      },
+      "IncludeSignedTx": {
+        "name": "include_signed_tx",
+        "in": "query",
+        "required": false,
+        "description": "Set to `true` or `1` to include the raw signed transaction hex in the response. Omitted by default to reduce key exfiltration risk. Only the literal values \"true\" or \"1\" enable inclusion; any other value or omission returns responses without signed_tx. Applies to GET /v1/agents/{agent_id}/transactions and GET /v1/agents/{agent_id}/transactions/{tx_id}.\n",
+        "schema": {
+          "type": "boolean",
+          "default": false,
+          "example": false
+        }
+      }
+    },
+    "responses": {
+      "BadRequest": {
+        "description": "Invalid request",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ProblemDetails"
+            }
+          }
+        }
+      },
+      "Unauthorized": {
+        "description": "Authentication required or invalid",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ProblemDetails"
+            }
+          }
+        }
+      },
+      "Forbidden": {
+        "description": "Insufficient permissions",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ProblemDetails"
+            }
+          }
+        }
+      },
+      "NotFound": {
+        "description": "Resource not found",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ProblemDetails"
+            }
+          }
+        }
+      },
+      "PaymentRequired": {
+        "description": "x402 payment required",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/PaymentRequirement"
+            }
+          }
+        }
+      },
+      "Conflict": {
+        "description": "Resource already exists or conflict",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ProblemDetails"
+            }
+          }
+        }
+      }
+    },
+    "schemas": {
+      "OrderCardRequest": {
+        "type": "object",
+        "required": [
+          "kind",
+          "amount_usd"
+        ],
+        "properties": {
+          "kind": {
+            "type": "string",
+            "enum": [
+              "prepaid",
+              "gift_card"
+            ]
+          },
+          "amount_usd": {
+            "type": "string",
+            "description": "USD amount to load onto the card.",
+            "example": "25.00"
+          },
+          "laso_server_id": {
+            "type": "string",
+            "description": "Optional Laso gift-card server/brand id (gift cards only)."
+          },
+          "country": {
+            "type": "string",
+            "description": "Optional country (prepaid cards; defaults to US)."
+          }
+        }
+      },
+      "CardResponse": {
+        "type": "object",
+        "description": "Masked card view — never contains PAN/CVV.",
+        "required": [
+          "id",
+          "issuer",
+          "kind",
+          "currency",
+          "status",
+          "storage_mode",
+          "reveal_policy",
+          "created_at",
+          "updated_at"
+        ],
+        "properties": {
+          "id": {
             "type": "string",
             "format": "uuid"
           },
@@ -19338,6 +19979,15 @@
             "type": "string",
             "format": "uuid",
             "description": "Optional pending approval ID. When consensus policies match, clients resubmit with this field set to bypass the 202 gate after the approval has been executed.\n"
+          },
+          "raw_transaction": {
+            "type": "string",
+            "description": "Pre-built raw transaction as a base64-encoded byte string. When provided, the handler decodes and deep-inspects the transaction for policy evaluation before signing. Supported for non-EVM chains where the client constructs the transaction payload.\n"
+          },
+          "tron_transaction": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Pre-built Tron transaction JSON object. When provided, the handler signs the transaction as-is using the Tron protobuf format. Enables full Tron transaction type coverage beyond simple TRX/TRC-20 transfers.\n"
           }
         }
       },
@@ -19992,6 +20642,15 @@
             "type": "string",
             "format": "uuid",
             "description": "Optional pending approval ID. When consensus policies match, clients resubmit with this field set to bypass the 202 gate after the approval has been executed.\n"
+          },
+          "raw_transaction": {
+            "type": "string",
+            "description": "Pre-built raw transaction as a base64-encoded byte string. When provided, the handler decodes and deep-inspects the transaction for policy evaluation before signing. Supported for non-EVM chains where the client constructs the transaction payload.\n"
+          },
+          "tron_transaction": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Pre-built Tron transaction JSON object. When provided, the handler signs the transaction as-is using the Tron protobuf format. Enables full Tron transaction type coverage beyond simple TRX/TRC-20 transfers.\n"
           }
         }
       },
@@ -27353,734 +28012,1228 @@
           }
         }
       },
-      "SubmitPendingApprovalRequest": {
+      "SubmitPendingApprovalRequest": {
+        "type": "object",
+        "required": [
+          "policy_id",
+          "action",
+          "action_payload"
+        ],
+        "properties": {
+          "policy_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "action": {
+            "type": "string"
+          },
+          "action_payload": {
+            "type": "object"
+          }
+        }
+      },
+      "SubmitPendingApprovalResponse": {
+        "type": "object",
+        "properties": {
+          "pending_approval_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "required_approvals": {
+            "type": "integer"
+          },
+          "current_approvals": {
+            "type": "integer"
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "status": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          }
+        }
+      },
+      "ApprovePendingApprovalRequest": {
+        "type": "object",
+        "required": [
+          "decision",
+          "payload_hash"
+        ],
+        "properties": {
+          "decision": {
+            "type": "string",
+            "enum": [
+              "approve",
+              "reject"
+            ]
+          },
+          "payload_hash": {
+            "type": "string"
+          },
+          "reason": {
+            "type": "string"
+          },
+          "credential_type": {
+            "type": "string",
+            "enum": [
+              "password",
+              "passkey",
+              "totp",
+              "biometric",
+              "api_key"
+            ],
+            "description": "Authentication method used for this approval vote"
+          }
+        }
+      },
+      "PendingApprovalResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "policy_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "action": {
+            "type": "string"
+          },
+          "action_payload": {
+            "type": "object"
+          },
+          "payload_hash": {
+            "type": "string"
+          },
+          "submitted_by": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "submitted_by_type": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "required_approvals": {
+            "type": "integer"
+          },
+          "current_approvals": {
+            "type": "integer"
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "executed_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "signatures": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ApprovalSignatureResponse"
+            }
+          }
+        }
+      },
+      "ApprovalSignatureResponse": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "approver_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "approver_type": {
+            "type": "string"
+          },
+          "decision": {
+            "type": "string"
+          },
+          "reason": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "PendingApprovalListResponse": {
         "type": "object",
-        "required": [
-          "policy_id",
-          "action",
-          "action_payload"
-        ],
         "properties": {
-          "policy_id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "action": {
-            "type": "string"
+          "pending_approvals": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/PendingApprovalResponse"
+            }
           },
-          "action_payload": {
-            "type": "object"
+          "total": {
+            "type": "integer",
+            "format": "int64"
           }
         }
       },
-      "SubmitPendingApprovalResponse": {
+      "ExecutePendingApprovalResponse": {
         "type": "object",
         "properties": {
           "pending_approval_id": {
             "type": "string",
             "format": "uuid"
           },
-          "required_approvals": {
-            "type": "integer"
-          },
-          "current_approvals": {
-            "type": "integer"
+          "status": {
+            "type": "string"
           },
-          "expires_at": {
+          "executed_at": {
             "type": "string",
             "format": "date-time"
           },
-          "status": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
+          "result": {
+            "type": "object"
           }
         }
       },
-      "ApprovePendingApprovalRequest": {
+      "CreateSubOrgRequest": {
         "type": "object",
         "required": [
-          "decision",
-          "payload_hash"
+          "name"
         ],
         "properties": {
-          "decision": {
+          "name": {
             "type": "string",
-            "enum": [
-              "approve",
-              "reject"
-            ]
-          },
-          "payload_hash": {
-            "type": "string"
+            "minLength": 1,
+            "maxLength": 128
           },
-          "reason": {
+          "description": {
             "type": "string"
           },
-          "credential_type": {
+          "billing_model": {
             "type": "string",
             "enum": [
-              "password",
-              "passkey",
-              "totp",
-              "biometric",
-              "api_key"
+              "inherit",
+              "independent"
             ],
-            "description": "Authentication method used for this approval vote"
+            "default": "inherit"
           }
         }
       },
-      "PendingApprovalResponse": {
+      "SubOrgResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "org_id": {
+          "parent_org_id": {
             "type": "string",
             "format": "uuid"
           },
-          "policy_id": {
+          "name": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "billing_model": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "active",
+              "archived"
+            ]
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "SubOrgListResponse": {
+        "type": "object",
+        "properties": {
+          "sub_orgs": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/SubOrgResponse"
+            }
+          }
+        }
+      },
+      "SubOrgPermissionRequest": {
+        "type": "object",
+        "required": [
+          "permission"
+        ],
+        "properties": {
+          "permission": {
+            "type": "string",
+            "description": "Permission to grant (e.g. vaults:read, agents:write)"
+          },
+          "resource_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        }
+      },
+      "SubOrgAddUserRequest": {
+        "type": "object",
+        "required": [
+          "user_id"
+        ],
+        "properties": {
+          "user_id": {
             "type": "string",
             "format": "uuid"
           },
-          "action": {
+          "role": {
+            "type": "string",
+            "enum": [
+              "admin",
+              "member",
+              "viewer"
+            ],
+            "default": "member"
+          }
+        }
+      },
+      "SubOrgGenerateWalletsRequest": {
+        "type": "object",
+        "properties": {
+          "chains": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "PortfolioResponse": {
+        "type": "object",
+        "properties": {
+          "wallets": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/PortfolioWalletEntry"
+            }
+          },
+          "total_usd_estimate": {
             "type": "string"
+          }
+        }
+      },
+      "PortfolioWalletEntry": {
+        "type": "object",
+        "properties": {
+          "wallet_type": {
+            "type": "string",
+            "enum": [
+              "treasury",
+              "signing_key",
+              "smart_account"
+            ]
           },
-          "action_payload": {
-            "type": "object"
+          "chain": {
+            "type": "string"
           },
-          "payload_hash": {
+          "address": {
             "type": "string"
           },
-          "submitted_by": {
-            "type": "string",
-            "format": "uuid"
+          "native_balance": {
+            "type": "string"
           },
-          "submitted_by_type": {
+          "native_balance_usd": {
             "type": "string"
           },
-          "status": {
+          "tokens": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/PortfolioTokenBalance"
+            }
+          }
+        }
+      },
+      "PortfolioTokenBalance": {
+        "type": "object",
+        "properties": {
+          "contract_address": {
             "type": "string"
           },
-          "required_approvals": {
-            "type": "integer"
+          "symbol": {
+            "type": "string"
           },
-          "current_approvals": {
-            "type": "integer"
+          "name": {
+            "type": "string"
           },
-          "expires_at": {
-            "type": "string",
-            "format": "date-time"
+          "balance": {
+            "type": "string"
           },
-          "executed_at": {
-            "type": "string",
-            "format": "date-time"
+          "balance_usd": {
+            "type": "string"
           },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
+          "decimals": {
+            "type": "integer"
+          }
+        }
+      },
+      "ImportSmartAccountRequest": {
+        "type": "object",
+        "required": [
+          "chain",
+          "chain_id",
+          "safe_address"
+        ],
+        "properties": {
+          "chain": {
+            "type": "string"
           },
-          "updated_at": {
-            "type": "string",
-            "format": "date-time"
+          "chain_id": {
+            "type": "integer"
           },
-          "signatures": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ApprovalSignatureResponse"
-            }
+          "safe_address": {
+            "type": "string"
+          },
+          "verify": {
+            "type": "boolean",
+            "default": true,
+            "description": "Verify on-chain Safe ownership"
           }
         }
       },
-      "ApprovalSignatureResponse": {
+      "ImportSmartAccountResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "approver_id": {
+          "agent_id": {
             "type": "string",
             "format": "uuid"
           },
-          "approver_type": {
+          "chain": {
             "type": "string"
           },
-          "decision": {
-            "type": "string"
+          "chain_id": {
+            "type": "integer"
           },
-          "reason": {
+          "safe_address": {
             "type": "string"
           },
+          "nonce": {
+            "type": "integer",
+            "nullable": true
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "PendingApprovalListResponse": {
+      "EnvVar": {
         "type": "object",
         "properties": {
-          "pending_approvals": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "key": {
+            "type": "string"
+          },
+          "environments": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/PendingApprovalResponse"
+              "type": "string"
             }
           },
-          "total": {
-            "type": "integer",
-            "format": "int64"
-          }
-        }
-      },
-      "ExecutePendingApprovalResponse": {
-        "type": "object",
-        "properties": {
-          "pending_approval_id": {
+          "git_branch": {
             "type": "string",
-            "format": "uuid"
+            "nullable": true
           },
-          "status": {
-            "type": "string"
+          "sensitive": {
+            "type": "boolean"
           },
-          "executed_at": {
+          "comment": {
+            "type": "string",
+            "nullable": true
+          },
+          "value": {
+            "type": "string",
+            "nullable": true,
+            "description": "Null for sensitive vars in list responses"
+          },
+          "version": {
+            "type": "integer"
+          },
+          "created_by": {
+            "type": "string",
+            "nullable": true
+          },
+          "created_at": {
             "type": "string",
             "format": "date-time"
           },
-          "result": {
-            "type": "object"
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "CreateSubOrgRequest": {
+      "CreateEnvVarRequest": {
         "type": "object",
         "required": [
-          "name"
+          "key",
+          "value"
         ],
         "properties": {
-          "name": {
+          "key": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 128
+            "description": "Uppercase alphanumeric + underscore, 1-256 chars"
           },
-          "description": {
+          "value": {
             "type": "string"
           },
-          "billing_model": {
-            "type": "string",
-            "enum": [
-              "inherit",
-              "independent"
-            ],
-            "default": "inherit"
-          }
-        }
-      },
-      "SubOrgResponse": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "format": "uuid"
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "production",
+              "preview",
+              "development"
+            ]
           },
-          "parent_org_id": {
+          "git_branch": {
             "type": "string",
-            "format": "uuid"
-          },
-          "name": {
-            "type": "string"
+            "description": "Branch override (preview only)"
           },
-          "description": {
-            "type": "string"
+          "sensitive": {
+            "type": "boolean",
+            "default": false
           },
-          "billing_model": {
+          "comment": {
             "type": "string"
-          },
-          "status": {
-            "type": "string",
-            "enum": [
-              "active",
-              "archived"
-            ]
-          },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
           }
         }
       },
-      "SubOrgListResponse": {
+      "UpdateEnvVarRequest": {
         "type": "object",
         "properties": {
-          "sub_orgs": {
+          "value": {
+            "type": "string"
+          },
+          "environments": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/SubOrgResponse"
+              "type": "string"
             }
+          },
+          "sensitive": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
           }
         }
       },
-      "SubOrgPermissionRequest": {
+      "ResolveEnvVarsResponse": {
         "type": "object",
-        "required": [
-          "permission"
-        ],
         "properties": {
-          "permission": {
-            "type": "string",
-            "description": "Permission to grant (e.g. vaults:read, agents:write)"
+          "vars": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           },
-          "resource_ids": {
-            "type": "array",
-            "items": {
+          "sources": {
+            "type": "object",
+            "additionalProperties": {
               "type": "string",
-              "format": "uuid"
+              "enum": [
+                "shared",
+                "vault",
+                "branch_override"
+              ]
             }
+          },
+          "environment": {
+            "type": "string"
+          },
+          "git_branch": {
+            "type": "string",
+            "nullable": true
+          },
+          "resolved_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "SubOrgAddUserRequest": {
+      "VaultEnvironment": {
         "type": "object",
-        "required": [
-          "user_id"
-        ],
         "properties": {
-          "user_id": {
+          "id": {
             "type": "string",
             "format": "uuid"
           },
-          "role": {
+          "slug": {
+            "type": "string"
+          },
+          "description": {
             "type": "string",
-            "enum": [
-              "admin",
-              "member",
-              "viewer"
-            ],
-            "default": "member"
-          }
-        }
-      },
-      "SubOrgGenerateWalletsRequest": {
-        "type": "object",
-        "properties": {
-          "chains": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+            "nullable": true
+          },
+          "is_builtin": {
+            "type": "boolean"
+          },
+          "copied_from": {
+            "type": "string",
+            "nullable": true
+          },
+          "is_detached": {
+            "type": "boolean"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "PortfolioResponse": {
+      "CreateEnvironmentRequest": {
         "type": "object",
+        "required": [
+          "slug"
+        ],
         "properties": {
-          "wallets": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/PortfolioWalletEntry"
-            }
+          "slug": {
+            "type": "string",
+            "description": "Lowercase alphanumeric + hyphens, 2-30 chars"
           },
-          "total_usd_estimate": {
+          "description": {
             "type": "string"
+          },
+          "copy_from": {
+            "type": "string",
+            "description": "Copy env vars from this environment"
           }
         }
       },
-      "PortfolioWalletEntry": {
+      "OrgEnvVar": {
         "type": "object",
         "properties": {
-          "wallet_type": {
+          "id": {
             "type": "string",
-            "enum": [
-              "treasury",
-              "signing_key",
-              "smart_account"
-            ]
+            "format": "uuid"
           },
-          "chain": {
+          "key": {
             "type": "string"
           },
-          "address": {
-            "type": "string"
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           },
-          "native_balance": {
-            "type": "string"
+          "sensitive": {
+            "type": "boolean"
           },
-          "native_balance_usd": {
-            "type": "string"
+          "comment": {
+            "type": "string",
+            "nullable": true
           },
-          "tokens": {
+          "value": {
+            "type": "string",
+            "nullable": true
+          },
+          "version": {
+            "type": "integer"
+          },
+          "linked_vaults": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/PortfolioTokenBalance"
+              "type": "string",
+              "format": "uuid"
             }
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "PortfolioTokenBalance": {
+      "CreateOrgEnvVarRequest": {
         "type": "object",
+        "required": [
+          "key",
+          "value"
+        ],
         "properties": {
-          "contract_address": {
+          "key": {
             "type": "string"
           },
-          "symbol": {
+          "value": {
             "type": "string"
           },
-          "name": {
-            "type": "string"
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": [
+              "production",
+              "preview",
+              "development"
+            ]
           },
-          "balance": {
-            "type": "string"
+          "sensitive": {
+            "type": "boolean",
+            "default": false
           },
-          "balance_usd": {
+          "comment": {
             "type": "string"
-          },
-          "decimals": {
-            "type": "integer"
           }
         }
       },
-      "ImportSmartAccountRequest": {
+      "UpdateOrgEnvVarRequest": {
         "type": "object",
-        "required": [
-          "chain",
-          "chain_id",
-          "safe_address"
-        ],
         "properties": {
-          "chain": {
+          "value": {
             "type": "string"
           },
-          "chain_id": {
-            "type": "integer"
+          "environments": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           },
-          "safe_address": {
+          "comment": {
             "type": "string"
-          },
-          "verify": {
-            "type": "boolean",
-            "default": true,
-            "description": "Verify on-chain Safe ownership"
           }
         }
       },
-      "ImportSmartAccountResponse": {
+      "CreateWalletAccessPolicyRequest": {
         "type": "object",
+        "required": [
+          "wallet_chain",
+          "permissions"
+        ],
         "properties": {
-          "id": {
+          "wallet_chain": {
             "type": "string",
-            "format": "uuid"
+            "description": "Chain for which the policy applies (e.g. ethereum, solana)"
           },
-          "agent_id": {
+          "target_agent_id": {
             "type": "string",
-            "format": "uuid"
-          },
-          "chain": {
-            "type": "string"
+            "format": "uuid",
+            "description": "Agent granted access (mutually exclusive with target_user_id)"
           },
-          "chain_id": {
-            "type": "integer"
+          "target_user_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "User granted access (mutually exclusive with target_agent_id)"
           },
-          "safe_address": {
-            "type": "string"
+          "permissions": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "send",
+                "swap",
+                "receive"
+              ]
+            }
           },
-          "nonce": {
-            "type": "integer",
-            "nullable": true
+          "conditions": {
+            "type": "object",
+            "properties": {
+              "max_value_per_tx_eth": {
+                "type": "string",
+                "description": "Max value per transaction in ETH"
+              },
+              "daily_limit_eth": {
+                "type": "string",
+                "description": "Daily spend limit in ETH"
+              },
+              "allowed_chains": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "allowed_tokens": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
           },
-          "created_at": {
+          "expires_at": {
             "type": "string",
             "format": "date-time"
           }
         }
       },
-      "EnvVar": {
+      "WalletAccessPolicyResponse": {
         "type": "object",
         "properties": {
           "id": {
             "type": "string",
             "format": "uuid"
           },
-          "key": {
-            "type": "string"
+          "org_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "environments": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "wallet_chain": {
+            "type": "string"
           },
-          "git_branch": {
+          "target_agent_id": {
             "type": "string",
+            "format": "uuid",
             "nullable": true
           },
-          "sensitive": {
-            "type": "boolean"
-          },
-          "comment": {
+          "target_user_id": {
             "type": "string",
+            "format": "uuid",
             "nullable": true
           },
-          "value": {
-            "type": "string",
-            "nullable": true,
-            "description": "Null for sensitive vars in list responses"
+          "permissions": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "send",
+                "swap",
+                "receive"
+              ]
+            }
           },
-          "version": {
-            "type": "integer"
+          "conditions": {
+            "type": "object",
+            "nullable": true,
+            "properties": {
+              "max_value_per_tx_eth": {
+                "type": "string",
+                "nullable": true
+              },
+              "daily_limit_eth": {
+                "type": "string",
+                "nullable": true
+              },
+              "allowed_chains": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "nullable": true
+              },
+              "allowed_tokens": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "nullable": true
+              }
+            }
           },
-          "created_by": {
+          "expires_at": {
             "type": "string",
+            "format": "date-time",
             "nullable": true
           },
           "created_at": {
             "type": "string",
             "format": "date-time"
-          },
-          "updated_at": {
-            "type": "string",
-            "format": "date-time"
           }
         }
       },
-      "CreateEnvVarRequest": {
+      "WalletAccessPolicyListResponse": {
+        "type": "object",
+        "properties": {
+          "policies": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/WalletAccessPolicyResponse"
+            }
+          }
+        }
+      },
+      "CredentialRecoveryRequest": {
         "type": "object",
         "required": [
-          "key",
-          "value"
+          "recovery_type"
         ],
         "properties": {
-          "key": {
+          "recovery_type": {
             "type": "string",
-            "description": "Uppercase alphanumeric + underscore, 1-256 chars"
+            "enum": [
+              "mfa_reset",
+              "passkey_reset",
+              "password_reset"
+            ]
           },
-          "value": {
-            "type": "string"
+          "reason": {
+            "type": "string",
+            "description": "Optional justification for the recovery request"
+          }
+        }
+      },
+      "CredentialRecoveryResponse": {
+        "type": "object",
+        "properties": {
+          "request_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "environments": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "default": [
-              "production",
-              "preview",
-              "development"
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending_approval",
+              "approved",
+              "rejected",
+              "expired"
             ]
           },
-          "git_branch": {
+          "recovery_type": {
             "type": "string",
-            "description": "Branch override (preview only)"
-          },
-          "sensitive": {
-            "type": "boolean",
-            "default": false
+            "enum": [
+              "mfa_reset",
+              "passkey_reset",
+              "password_reset"
+            ]
           },
-          "comment": {
-            "type": "string"
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       },
-      "UpdateEnvVarRequest": {
+      "CredentialRecoveryListResponse": {
         "type": "object",
         "properties": {
-          "value": {
-            "type": "string"
-          },
-          "environments": {
+          "requests": {
             "type": "array",
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/CredentialRecoveryResponse"
             }
-          },
-          "sensitive": {
-            "type": "boolean"
-          },
-          "comment": {
-            "type": "string"
           }
         }
       },
-      "ResolveEnvVarsResponse": {
+      "CredentialRecoveryApproveResponse": {
         "type": "object",
         "properties": {
-          "vars": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
-          "sources": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string",
-              "enum": [
-                "shared",
-                "vault",
-                "branch_override"
-              ]
-            }
-          },
-          "environment": {
-            "type": "string"
+          "request_id": {
+            "type": "string",
+            "format": "uuid"
           },
-          "git_branch": {
+          "status": {
             "type": "string",
-            "nullable": true
+            "enum": [
+              "approved"
+            ]
           },
-          "resolved_at": {
+          "recovery_code": {
             "type": "string",
-            "format": "date-time"
+            "nullable": true,
+            "description": "One-time recovery code (only present for certain recovery types)"
           }
         }
       },
-      "VaultEnvironment": {
+      "CredentialRecoveryExecuteResponse": {
         "type": "object",
         "properties": {
-          "id": {
+          "request_id": {
             "type": "string",
             "format": "uuid"
           },
-          "slug": {
+          "status": {
+            "type": "string",
+            "enum": [
+              "executed"
+            ]
+          },
+          "recovery_type": {
             "type": "string"
           },
-          "description": {
+          "executed_at": {
             "type": "string",
-            "nullable": true
+            "format": "date-time"
+          }
+        }
+      },
+      "CredentialRecoveryPolicyResponse": {
+        "type": "object",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
           },
-          "is_builtin": {
+          "require_admin_approval": {
             "type": "boolean"
           },
-          "copied_from": {
-            "type": "string",
-            "nullable": true
+          "delay_hours": {
+            "type": "integer",
+            "description": "Waiting period before recovery takes effect"
           },
-          "is_detached": {
+          "allowed_types": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "mfa_reset",
+                "passkey_reset",
+                "password_reset"
+              ]
+            }
+          }
+        }
+      },
+      "CredentialRecoveryPolicyRequest": {
+        "type": "object",
+        "properties": {
+          "enabled": {
             "type": "boolean"
           },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
+          "require_admin_approval": {
+            "type": "boolean"
+          },
+          "delay_hours": {
+            "type": "integer"
+          },
+          "allowed_types": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "mfa_reset",
+                "passkey_reset",
+                "password_reset"
+              ]
+            }
           }
         }
       },
-      "CreateEnvironmentRequest": {
+      "ShamirKekSetupRequest": {
         "type": "object",
         "required": [
-          "slug"
+          "threshold",
+          "total_shares",
+          "custodian_emails"
         ],
         "properties": {
-          "slug": {
-            "type": "string",
-            "description": "Lowercase alphanumeric + hyphens, 2-30 chars"
+          "threshold": {
+            "type": "integer",
+            "enum": [
+              2,
+              3
+            ],
+            "description": "Minimum shares required to reconstruct the KEK"
           },
-          "description": {
-            "type": "string"
+          "total_shares": {
+            "type": "integer",
+            "enum": [
+              3,
+              5
+            ],
+            "description": "Total number of shares to generate"
           },
-          "copy_from": {
-            "type": "string",
-            "description": "Copy env vars from this environment"
+          "custodian_emails": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "email"
+            },
+            "description": "Email addresses of share custodians"
           }
         }
       },
-      "OrgEnvVar": {
+      "ShamirKekSetupResponse": {
         "type": "object",
         "properties": {
-          "id": {
-            "type": "string",
-            "format": "uuid"
-          },
-          "key": {
+          "kek_id": {
             "type": "string"
           },
-          "environments": {
+          "threshold": {
+            "type": "integer"
+          },
+          "total_shares": {
+            "type": "integer"
+          },
+          "shares": {
             "type": "array",
+            "description": "One-time share distribution (never returned again)",
             "items": {
-              "type": "string"
+              "type": "object",
+              "properties": {
+                "index": {
+                  "type": "integer"
+                },
+                "custodian_email": {
+                  "type": "string",
+                  "format": "email"
+                },
+                "share_b64": {
+                  "type": "string",
+                  "description": "Base64-encoded share"
+                }
+              }
             }
           },
-          "sensitive": {
+          "custody_mode": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "ShamirKekStatusResponse": {
+        "type": "object",
+        "properties": {
+          "configured": {
             "type": "boolean"
           },
-          "comment": {
+          "kek_id": {
             "type": "string",
             "nullable": true
           },
-          "value": {
-            "type": "string",
+          "threshold": {
+            "type": "integer",
             "nullable": true
           },
-          "version": {
-            "type": "integer"
+          "total_shares": {
+            "type": "integer",
+            "nullable": true
           },
-          "linked_vaults": {
+          "custody_mode": {
+            "type": "string",
+            "nullable": true
+          },
+          "custodians": {
             "type": "array",
+            "nullable": true,
             "items": {
-              "type": "string",
-              "format": "uuid"
+              "type": "object",
+              "properties": {
+                "email": {
+                  "type": "string",
+                  "format": "email"
+                },
+                "share_provided": {
+                  "type": "boolean"
+                }
+              }
             }
           },
           "created_at": {
             "type": "string",
-            "format": "date-time"
-          },
-          "updated_at": {
-            "type": "string",
-            "format": "date-time"
+            "format": "date-time",
+            "nullable": true
           }
         }
       },
-      "CreateOrgEnvVarRequest": {
+      "ShamirKekReconstructRequest": {
         "type": "object",
         "required": [
-          "key",
-          "value"
+          "shares"
         ],
         "properties": {
-          "key": {
-            "type": "string"
-          },
-          "value": {
-            "type": "string"
-          },
-          "environments": {
+          "shares": {
             "type": "array",
             "items": {
-              "type": "string"
-            },
-            "default": [
-              "production",
-              "preview",
-              "development"
+              "type": "object",
+              "required": [
+                "index",
+                "share_b64"
+              ],
+              "properties": {
+                "index": {
+                  "type": "integer"
+                },
+                "share_b64": {
+                  "type": "string",
+                  "description": "Base64-encoded share"
+                }
+              }
+            }
+          }
+        }
+      },
+      "ShamirKekReconstructResponse": {
+        "type": "object",
+        "properties": {
+          "status": {
+            "type": "string",
+            "enum": [
+              "accepted",
+              "reconstructed"
             ]
           },
-          "sensitive": {
-            "type": "boolean",
-            "default": false
-          },
-          "comment": {
+          "message": {
             "type": "string"
           }
         }
       },
-      "UpdateOrgEnvVarRequest": {
+      "ShamirKekRecoveryCodesResponse": {
         "type": "object",
         "properties": {
-          "value": {
-            "type": "string"
-          },
-          "environments": {
+          "codes": {
             "type": "array",
             "items": {
               "type": "string"
             }
-          },
-          "comment": {
+          }
+        }
+      },
+      "ShamirKekVerifyCodeRequest": {
+        "type": "object",
+        "required": [
+          "code"
+        ],
+        "properties": {
+          "code": {
             "type": "string"
           }
         }
+      },
+      "ShamirKekVerifyCodeResponse": {
+        "type": "object",
+        "properties": {
+          "valid": {
+            "type": "boolean"
+          }
+        }
       }
     }
   }