@1claw/openapi-spec 0.56.3 → 0.57.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.56.3",
+    "version": "0.57.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -1404,6 +1404,9 @@
                     "require_passkey_for_vaults": {
                       "type": "boolean"
                     },
+                    "require_passkey_for_mfa": {
+                      "type": "boolean"
+                    },
                     "passkey_count": {
                       "type": "integer"
                     }
@@ -1419,7 +1422,7 @@
           "Authentication"
         ],
         "summary": "Update user security settings",
-        "description": "Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`\n(purpose `security.vault_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n",
+        "description": "Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`\n(purpose `security.vault_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n\nDisabling `require_passkey_for_mfa` requires `X-Auth-Confirm`\n(purpose `security.mfa_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n",
         "operationId": "updateSecuritySettings",
         "parameters": [
           {
@@ -1440,6 +1443,9 @@
                 "properties": {
                   "require_passkey_for_vaults": {
                     "type": "boolean"
+                  },
+                  "require_passkey_for_mfa": {
+                    "type": "boolean"
                   }
                 }
               }
@@ -1624,6 +1630,84 @@
         }
       }
     },
+    "/v1/auth/mfa/passkey/begin": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Begin passkey MFA verification during login",
+        "operationId": "mfaPasskeyBegin",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "mfa_token"
+                ],
+                "properties": {
+                  "mfa_token": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "WebAuthn challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeyAssertBeginResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      }
+    },
+    "/v1/auth/mfa/passkey/complete": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Complete passkey MFA verification during login",
+        "operationId": "mfaPasskeyComplete",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MfaPasskeyCompleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "MFA verified, JWT issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TokenResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
     "/v1/auth/mfa": {
       "delete": {
         "tags": [
@@ -8557,6 +8641,43 @@
         }
       }
     },
+    "/v1/treasury/wallets/inference-budget": {
+      "get": {
+        "tags": [
+          "Treasury Wallets"
+        ],
+        "summary": "Get inference budget for current user",
+        "description": "Returns the user's remaining LLM inference allowance when connected via a platform app.\nIncludes allowance, spent, remaining USD, per-request cap, and billing period end.\n",
+        "operationId": "getUserInferenceBudget",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Inference budget (or unconfigured message)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/InferenceBudgetResponse"
+                    },
+                    {
+                      "$ref": "#/components/schemas/InferenceBudgetUnconfiguredResponse"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
     "/v1/webhooks": {
       "post": {
         "tags": [
@@ -9907,6 +10028,65 @@
         }
       }
     },
+    "/v1/platform/apps/{appId}/templates/{template_id}/preview": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Preview resolved template spec",
+        "description": "Resolves `{{params.*}}` and `{{subject.*}}` placeholders in a template spec\nwithout provisioning resources. Useful for validating parameterized bootstrap templates.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "template_id",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TemplatePreviewRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Resolved template spec",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TemplatePreviewResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/users/upsert": {
       "post": {
         "tags": [
@@ -9963,6 +10143,45 @@
         }
       }
     },
+    "/v1/platform/siwe/challenge": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Issue SIWE nonce",
+        "description": "Creates a one-time nonce for Sign-In With Ethereum user provisioning.\nRequires platform (`plt_`) authentication. The nonce expires in 5 minutes.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SiweChallengeRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Nonce issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SiweChallengeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "SIWE domain not configured"
+          }
+        }
+      }
+    },
     "/v1/platform/apps/{appId}/users": {
       "get": {
         "tags": [
@@ -10125,13 +10344,13 @@
         }
       }
     },
-    "/v1/platform/apps/{appId}/audit": {
+    "/v1/platform/connections/{connectionId}": {
       "get": {
         "tags": [
           "Platform"
         ],
-        "summary": "Platform audit log",
-        "description": "Returns audit events related to this platform app.",
+        "summary": "Get connection details",
+        "description": "Returns connection status, claim state, wallet address, and provisioned resource IDs.\nUse for polling the claim loop after bootstrap.\n",
         "security": [
           {
             "BearerAuth": []
@@ -10140,94 +10359,247 @@
         "parameters": [
           {
             "in": "path",
-            "name": "appId",
+            "name": "connectionId",
             "required": true,
             "schema": {
               "type": "string",
               "format": "uuid"
             }
-          },
-          {
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "type": "integer",
-              "default": 50
-            }
-          },
-          {
-            "in": "query",
-            "name": "offset",
-            "schema": {
-              "type": "integer",
-              "default": 0
-            }
           }
         ],
         "responses": {
           "200": {
-            "description": "Audit events",
+            "description": "Connection details",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "events": {
-                      "type": "array",
-                      "items": {
-                        "type": "object"
-                      }
-                    }
-                  }
+                  "$ref": "#/components/schemas/ConnectionDetailResponse"
                 }
               }
             }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         }
       }
     },
-    "/v1/platform/connected-apps": {
+    "/v1/platform/connections/{connectionId}/usage": {
       "get": {
         "tags": [
           "Platform"
         ],
-        "summary": "List connected apps (user side)",
-        "description": "Returns platform apps connected to the calling user's account.",
+        "summary": "Get per-connection usage",
+        "description": "Returns inference spend for the current UTC month for this connection.",
         "security": [
           {
             "BearerAuth": []
           }
         ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
         "responses": {
           "200": {
-            "description": "Connected apps",
+            "description": "Usage summary",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "connected_apps": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/ConnectedAppResponse"
-                      }
-                    }
-                  }
+                  "$ref": "#/components/schemas/ConnectionUsageResponse"
                 }
               }
             }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         }
       }
     },
-    "/v1/platform/connected-apps/{connectionId}": {
-      "patch": {
+    "/v1/platform/connections/{connectionId}/entitlements": {
+      "get": {
         "tags": [
           "Platform"
         ],
-        "summary": "Update connection delegation",
-        "description": "Toggle delegation and update delegation scopes for a connected platform app. User-only.",
-        "operationId": "updateConnectionDelegation",
+        "summary": "List entitlement evaluations",
+        "description": "Returns on-chain entitlement watch status for the connection.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Entitlement watches",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EntitlementsListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/entitlements/refresh": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Refresh entitlement evaluations",
+        "description": "Triggers an immediate entitlement monitor cycle for this connection's org.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "202": {
+            "description": "Refresh accepted"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/{appId}/audit": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Platform audit log",
+        "description": "Returns audit events related to this platform app.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "in": "query",
+            "name": "offset",
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Audit events",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "events": {
+                      "type": "array",
+                      "items": {
+                        "type": "object"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/connected-apps": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List connected apps (user side)",
+        "description": "Returns platform apps connected to the calling user's account.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connected apps",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "connected_apps": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/ConnectedAppResponse"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/connected-apps/{connectionId}": {
+      "patch": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Update connection delegation",
+        "description": "Toggle delegation and update delegation scopes for a connected platform app. User-only.",
+        "operationId": "updateConnectionDelegation",
         "security": [
           {
             "BearerAuth": []
@@ -18031,6 +18403,14 @@
           },
           "mfa_token": {
             "type": "string"
+          },
+          "mfa_method": {
+            "type": "string",
+            "enum": [
+              "totp",
+              "passkey"
+            ],
+            "description": "When MFA is required, which second factor to collect"
           }
         }
       },
@@ -18052,6 +18432,19 @@
           },
           "refresh_token": {
             "type": "string"
+          },
+          "mfa_required": {
+            "type": "boolean"
+          },
+          "mfa_token": {
+            "type": "string"
+          },
+          "mfa_method": {
+            "type": "string",
+            "enum": [
+              "totp",
+              "passkey"
+            ]
           }
         }
       },
@@ -18277,6 +18670,15 @@
         "properties": {
           "enabled": {
             "type": "boolean"
+          },
+          "eligible": {
+            "type": "boolean"
+          },
+          "totp_enabled": {
+            "type": "boolean"
+          },
+          "passkey_mfa_enabled": {
+            "type": "boolean"
           }
         }
       },
@@ -24663,7 +25065,8 @@
           },
           "subject_token_type": {
             "type": "string",
-            "default": "urn:ietf:params:oauth:token-type:jwt"
+            "default": "urn:ietf:params:oauth:token-type:jwt",
+            "description": "Token type for subject_token. Use `urn:1claw:params:oauth:token-type:siwe`\nwith `siwe_message` and `siwe_signature` for wallet-based provisioning.\n"
           },
           "email": {
             "type": "string",
@@ -24672,6 +25075,24 @@
           },
           "display_name": {
             "type": "string"
+          },
+          "siwe_message": {
+            "type": "string",
+            "description": "EIP-4361 Sign-In With Ethereum message (required for SIWE upsert)"
+          },
+          "siwe_signature": {
+            "type": "string",
+            "description": "Hex-encoded SIWE signature (required for SIWE upsert)"
+          },
+          "return_to": {
+            "type": "string",
+            "format": "uri",
+            "description": "Redirect URL after cross-org link consent"
+          },
+          "create_sub_org": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, creates a sub-org under the platform app's org"
           }
         }
       },
@@ -24800,6 +25221,11 @@
             "type": "string",
             "format": "uri",
             "description": "URL to redirect the user to after claiming resources."
+          },
+          "parameters": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Template parameters substituted as `{{params.*}}` during bootstrap.\nCombined with `Idempotency-Key` header for params-aware idempotent replay.\n"
           }
         }
       },
@@ -25807,6 +26233,34 @@
             "type": "integer",
             "description": "Maximum number of transactions per 24h window"
           },
+          "inference_allowance_usd": {
+            "type": "string",
+            "description": "Monthly LLM inference allowance in USD (decimal string)"
+          },
+          "inference_reserved_pct": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 100,
+            "default": 25,
+            "description": "Percent of allowance held in reserve (not spendable)"
+          },
+          "inference_hard_stop": {
+            "type": "boolean",
+            "default": true,
+            "description": "When true, block inference when allowance is exhausted"
+          },
+          "inference_allowance_mode": {
+            "type": "string",
+            "enum": [
+              "policy",
+              "credits"
+            ],
+            "default": "policy"
+          },
+          "max_request_cost_usd": {
+            "type": "string",
+            "description": "Maximum estimated cost per LLM request in USD"
+          },
           "human_factor_auth": {
             "type": "object",
             "additionalProperties": true,
@@ -25814,6 +26268,271 @@
           }
         }
       },
+      "SiweChallengeRequest": {
+        "type": "object",
+        "properties": {
+          "domain": {
+            "type": "string",
+            "description": "Optional SIWE domain override (defaults to platform app's siwe_domain)"
+          }
+        }
+      },
+      "SiweChallengeResponse": {
+        "type": "object",
+        "required": [
+          "nonce",
+          "expires_in",
+          "domain"
+        ],
+        "properties": {
+          "nonce": {
+            "type": "string"
+          },
+          "expires_in": {
+            "type": "integer",
+            "description": "Seconds until nonce expiry"
+          },
+          "domain": {
+            "type": "string"
+          }
+        }
+      },
+      "ConnectionDetailResponse": {
+        "type": "object",
+        "required": [
+          "connection_id",
+          "user_id",
+          "status",
+          "entitlement_status",
+          "vault_ids",
+          "agent_ids",
+          "claim"
+        ],
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "user_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "status": {
+            "type": "string"
+          },
+          "entitlement_status": {
+            "type": "string"
+          },
+          "wallet_address": {
+            "type": "string",
+            "nullable": true
+          },
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "claimed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "claim": {
+            "$ref": "#/components/schemas/ClaimStatusResponse"
+          }
+        }
+      },
+      "ClaimStatusResponse": {
+        "type": "object",
+        "required": [
+          "status"
+        ],
+        "properties": {
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "active",
+              "claimed"
+            ]
+          },
+          "redeemed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          }
+        }
+      },
+      "ConnectionUsageResponse": {
+        "type": "object",
+        "required": [
+          "connection_id",
+          "period",
+          "inference_spent_usd"
+        ],
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "period": {
+            "type": "string",
+            "description": "UTC month (YYYY-MM)"
+          },
+          "inference_spent_usd": {
+            "type": "string"
+          }
+        }
+      },
+      "EntitlementsListResponse": {
+        "type": "object",
+        "required": [
+          "evaluations"
+        ],
+        "properties": {
+          "evaluations": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/EntitlementEvaluationResponse"
+            }
+          }
+        }
+      },
+      "EntitlementEvaluationResponse": {
+        "type": "object",
+        "required": [
+          "id",
+          "status",
+          "watch_kind",
+          "chain",
+          "holder_address"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "watch_kind": {
+            "type": "string"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "holder_address": {
+            "type": "string"
+          },
+          "last_value_raw": {
+            "type": "string",
+            "nullable": true
+          },
+          "last_checked_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          }
+        }
+      },
+      "TemplatePreviewRequest": {
+        "type": "object",
+        "properties": {
+          "parameters": {
+            "type": "object",
+            "additionalProperties": true
+          },
+          "subject": {
+            "type": "object",
+            "properties": {
+              "user_id": {
+                "type": "string"
+              },
+              "external_subject": {
+                "type": "string"
+              },
+              "wallet_address": {
+                "type": "string"
+              },
+              "email": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "TemplatePreviewResponse": {
+        "type": "object",
+        "required": [
+          "resolved_spec"
+        ],
+        "properties": {
+          "resolved_spec": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        }
+      },
+      "InferenceBudgetResponse": {
+        "type": "object",
+        "required": [
+          "allowance_usd",
+          "spent_usd",
+          "remaining_usd",
+          "reserved_pct",
+          "max_request_cost_usd",
+          "period_end"
+        ],
+        "properties": {
+          "allowance_usd": {
+            "type": "string"
+          },
+          "spent_usd": {
+            "type": "string"
+          },
+          "remaining_usd": {
+            "type": "string"
+          },
+          "reserved_pct": {
+            "type": "integer"
+          },
+          "max_request_cost_usd": {
+            "type": "string"
+          },
+          "period_end": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "connection_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          }
+        }
+      },
+      "InferenceBudgetUnconfiguredResponse": {
+        "type": "object",
+        "properties": {
+          "allowance_usd": {
+            "type": "string",
+            "nullable": true
+          },
+          "remaining_usd": {
+            "nullable": true
+          },
+          "message": {
+            "type": "string"
+          }
+        }
+      },
       "SpendPolicyResponse": {
         "type": "object",
         "required": [
@@ -25871,6 +26590,26 @@
             "type": "integer",
             "nullable": true
           },
+          "inference_allowance_usd": {
+            "type": "string",
+            "nullable": true
+          },
+          "inference_reserved_pct": {
+            "type": "integer",
+            "nullable": true
+          },
+          "inference_hard_stop": {
+            "type": "boolean",
+            "nullable": true
+          },
+          "inference_allowance_mode": {
+            "type": "string",
+            "nullable": true
+          },
+          "max_request_cost_usd": {
+            "type": "string",
+            "nullable": true
+          },
           "human_factor_auth": {
             "type": "object",
             "additionalProperties": true,
@@ -26053,6 +26792,33 @@
           }
         }
       },
+      "MfaPasskeyCompleteRequest": {
+        "type": "object",
+        "required": [
+          "mfa_token",
+          "credential_id",
+          "authenticator_data",
+          "client_data_json",
+          "signature"
+        ],
+        "properties": {
+          "mfa_token": {
+            "type": "string"
+          },
+          "credential_id": {
+            "type": "string"
+          },
+          "authenticator_data": {
+            "type": "string"
+          },
+          "client_data_json": {
+            "type": "string"
+          },
+          "signature": {
+            "type": "string"
+          }
+        }
+      },
       "GuardrailWideningQueuedResponse": {
         "type": "object",
         "required": [