@1claw/openapi-spec 0.56.3 → 0.58.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.56.3",
+    "version": "0.58.0",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -1404,6 +1404,9 @@
                     "require_passkey_for_vaults": {
                       "type": "boolean"
                     },
+                    "require_passkey_for_mfa": {
+                      "type": "boolean"
+                    },
                     "passkey_count": {
                       "type": "integer"
                     }
@@ -1419,7 +1422,7 @@
           "Authentication"
         ],
         "summary": "Update user security settings",
-        "description": "Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`\n(purpose `security.vault_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n",
+        "description": "Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`\n(purpose `security.vault_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n\nDisabling `require_passkey_for_mfa` requires `X-Auth-Confirm`\n(purpose `security.mfa_passkey.disable`) with a passkey or TOTP\nwhen either is enrolled.\n",
         "operationId": "updateSecuritySettings",
         "parameters": [
           {
@@ -1440,6 +1443,9 @@
                 "properties": {
                   "require_passkey_for_vaults": {
                     "type": "boolean"
+                  },
+                  "require_passkey_for_mfa": {
+                    "type": "boolean"
                   }
                 }
               }
@@ -1624,6 +1630,84 @@
         }
       }
     },
+    "/v1/auth/mfa/passkey/begin": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Begin passkey MFA verification during login",
+        "operationId": "mfaPasskeyBegin",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "mfa_token"
+                ],
+                "properties": {
+                  "mfa_token": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "WebAuthn challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeyAssertBeginResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        }
+      }
+    },
+    "/v1/auth/mfa/passkey/complete": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Complete passkey MFA verification during login",
+        "operationId": "mfaPasskeyComplete",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MfaPasskeyCompleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "MFA verified, JWT issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TokenResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
     "/v1/auth/mfa": {
       "delete": {
         "tags": [
@@ -8557,6 +8641,43 @@
         }
       }
     },
+    "/v1/treasury/wallets/inference-budget": {
+      "get": {
+        "tags": [
+          "Treasury Wallets"
+        ],
+        "summary": "Get inference budget for current user",
+        "description": "Returns the user's remaining LLM inference allowance when connected via a platform app.\nIncludes allowance, spent, remaining USD, per-request cap, and billing period end.\n",
+        "operationId": "getUserInferenceBudget",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Inference budget (or unconfigured message)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/InferenceBudgetResponse"
+                    },
+                    {
+                      "$ref": "#/components/schemas/InferenceBudgetUnconfiguredResponse"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
     "/v1/webhooks": {
       "post": {
         "tags": [
@@ -9527,8 +9648,15 @@
           }
         ],
         "responses": {
-          "204": {
-            "description": "Deleted"
+          "200": {
+            "description": "Soft-deleted; slug released for reuse within the org",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlatformAppDeleteResponse"
+                }
+              }
+            }
           },
           "403": {
             "description": "Only human users can delete platform apps"
@@ -9536,6 +9664,71 @@
         }
       }
     },
+    "/v1/platform/apps/{appId}/transfer-ownership": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Transfer platform app to another organization",
+        "description": "Moves the platform app record to another organization. Requires org\nowner/admin in the source org and step-up auth (`X-Auth-Confirm`,\npurpose `platform.app.transfer`). End-user connections and provisioned\nresources remain in their original organizations.\n",
+        "operationId": "transferPlatformAppOwnership",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "header",
+            "name": "X-Auth-Confirm",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TransferPlatformAppOwnershipRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Ownership transferred",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TransferPlatformAppOwnershipResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/apps/{appId}/rotate-key": {
       "post": {
         "tags": [
@@ -9907,6 +10100,65 @@
         }
       }
     },
+    "/v1/platform/apps/{appId}/templates/{template_id}/preview": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Preview resolved template spec",
+        "description": "Resolves `{{params.*}}` and `{{subject.*}}` placeholders in a template spec\nwithout provisioning resources. Useful for validating parameterized bootstrap templates.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "template_id",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TemplatePreviewRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Resolved template spec",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TemplatePreviewResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/users/upsert": {
       "post": {
         "tags": [
@@ -9963,6 +10215,45 @@
         }
       }
     },
+    "/v1/platform/siwe/challenge": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Issue SIWE nonce",
+        "description": "Creates a one-time nonce for Sign-In With Ethereum user provisioning.\nRequires platform (`plt_`) authentication. The nonce expires in 5 minutes.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SiweChallengeRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Nonce issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SiweChallengeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "SIWE domain not configured"
+          }
+        }
+      }
+    },
     "/v1/platform/apps/{appId}/users": {
       "get": {
         "tags": [
@@ -10125,7 +10416,160 @@
         }
       }
     },
-    "/v1/platform/apps/{appId}/audit": {
+    "/v1/platform/connections/{connectionId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get connection details",
+        "description": "Returns connection status, claim state, wallet address, and provisioned resource IDs.\nUse for polling the claim loop after bootstrap.\n",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connection details",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectionDetailResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/usage": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get per-connection usage",
+        "description": "Returns inference spend for the current UTC month for this connection.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Usage summary",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectionUsageResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/entitlements": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List entitlement evaluations",
+        "description": "Returns on-chain entitlement watch status for the connection.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Entitlement watches",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EntitlementsListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/entitlements/refresh": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Refresh entitlement evaluations",
+        "description": "Triggers an immediate entitlement monitor cycle for this connection's org.",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "202": {
+            "description": "Refresh accepted"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/{appId}/audit": {
       "get": {
         "tags": [
           "Platform"
@@ -10713,6 +11157,53 @@
       }
     },
     "/v1/platform/apps/{appId}/spend-policies/{policyId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a spend policy by ID",
+        "operationId": "getSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "policyId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Spend policy",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SpendPolicyResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
       "delete": {
         "tags": [
           "Platform"
@@ -10755,6 +11246,57 @@
       }
     },
     "/v1/platform/connections/{connectionId}/spend-policy": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get effective spend policy for a connection",
+        "description": "Returns the effective spend policy for the connected user, resolving\nper-user overrides before app-level defaults. Requires plt_ platform auth.\n",
+        "operationId": "getConnectionSpendPolicy",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Effective spend policy (or null)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "policy": {
+                      "oneOf": [
+                        {
+                          "$ref": "#/components/schemas/SpendPolicyResponse"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
       "put": {
         "tags": [
           "Platform"
@@ -10776,6 +11318,15 @@
               "type": "string",
               "format": "uuid"
             }
+          },
+          {
+            "in": "header",
+            "name": "Idempotency-Key",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Optional replay protection; same key + body returns cached response (409 on body mismatch)."
           }
         ],
         "requestBody": {
@@ -10790,7 +11341,17 @@
         },
         "responses": {
           "200": {
-            "description": "Spend policy set",
+            "description": "Spend policy set (or idempotent replay)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SpendPolicyResponse"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Spend policy created",
             "content": {
               "application/json": {
                 "schema": {
@@ -10804,19 +11365,214 @@
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "description": "Idempotency-Key reused with different body"
           }
         }
       }
     },
-    "/v1/approvals": {
+    "/v1/platform/connections/{connectionId}/approvals": {
       "get": {
         "tags": [
-          "Approvals"
+          "Platform"
         ],
-        "summary": "List pending approvals",
-        "description": "Returns approvals for the authenticated user's organization.\nHuman-only. Supports filtering by status and pagination.\n",
-        "operationId": "listApprovals",
-        "parameters": [
+        "summary": "List approvals for a platform connection",
+        "description": "Returns approvals assigned to the connection's user, filtered to agents\nprovisioned on the connection. Requires plt_ platform auth.\n",
+        "operationId": "listConnectionApprovals",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "risk_tier",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connection-scoped approvals",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/approvals/{approvalId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a connection-scoped approval",
+        "operationId": "getConnectionApproval",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "approvalId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Approval detail",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/pending-approvals": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List pending consensus approvals for a connection",
+        "description": "Returns pending approvals for agents provisioned on the connection,\nincluding `action_payload` and `payload_hash` for consensus UX.\nRequires plt_ platform auth.\n",
+        "operationId": "listConnectionPendingApprovals",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "default": "pending"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Pending approvals list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PendingApprovalListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/approvals": {
+      "get": {
+        "tags": [
+          "Approvals"
+        ],
+        "summary": "List pending approvals",
+        "description": "Returns approvals for the authenticated user's organization.\nHuman-only. Supports filtering by status and pagination.\n",
+        "operationId": "listApprovals",
+        "parameters": [
           {
             "name": "status",
             "in": "query",
@@ -13827,7 +14583,7 @@
           "Runtimes"
         ],
         "summary": "Chat with a running runtime agent",
-        "description": "Human-only. Proxies to the runtime container's OpenAI-compatible\n`POST /v1/chat/completions` (hermes / openclaw / openclaude chat bridge).\nStarts the runtime if stopped. Streams SSE when `Accept: text/event-stream`\nor `stream: true`. Conversation history is ephemeral (pass `messages`).\nRequires a public URL (shell access, Shroud sidecar, or HTTP hosting).\n",
+        "description": "Human-only. Proxies to the runtime container's OpenAI-compatible\n`POST /v1/chat/completions` (hermes / openclaw / openclaude / opencode chat bridge).\nStarts the runtime if stopped. Streams SSE when `Accept: text/event-stream`\nor `stream: true`. Conversation history is ephemeral (pass `messages`).\nRequires a public URL (shell access, Shroud sidecar, or HTTP hosting).\n",
         "operationId": "runtimeChat",
         "parameters": [
           {
@@ -18031,6 +18787,14 @@
           },
           "mfa_token": {
             "type": "string"
+          },
+          "mfa_method": {
+            "type": "string",
+            "enum": [
+              "totp",
+              "passkey"
+            ],
+            "description": "When MFA is required, which second factor to collect"
           }
         }
       },
@@ -18052,6 +18816,19 @@
           },
           "refresh_token": {
             "type": "string"
+          },
+          "mfa_required": {
+            "type": "boolean"
+          },
+          "mfa_token": {
+            "type": "string"
+          },
+          "mfa_method": {
+            "type": "string",
+            "enum": [
+              "totp",
+              "passkey"
+            ]
           }
         }
       },
@@ -18277,6 +19054,15 @@
         "properties": {
           "enabled": {
             "type": "boolean"
+          },
+          "eligible": {
+            "type": "boolean"
+          },
+          "totp_enabled": {
+            "type": "boolean"
+          },
+          "passkey_mfa_enabled": {
+            "type": "boolean"
           }
         }
       },
@@ -24496,6 +25282,69 @@
           }
         }
       },
+      "PlatformAppDeleteResponse": {
+        "type": "object",
+        "required": [
+          "deleted",
+          "soft_delete",
+          "slug_released",
+          "former_slug"
+        ],
+        "properties": {
+          "deleted": {
+            "type": "boolean"
+          },
+          "soft_delete": {
+            "type": "boolean"
+          },
+          "slug_released": {
+            "type": "boolean"
+          },
+          "former_slug": {
+            "type": "string"
+          }
+        }
+      },
+      "TransferPlatformAppOwnershipRequest": {
+        "type": "object",
+        "properties": {
+          "target_org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "target_user_email": {
+            "type": "string",
+            "format": "email"
+          }
+        },
+        "description": "Provide `target_org_id` or `target_user_email` (owner/admin in destination org)."
+      },
+      "TransferPlatformAppOwnershipResponse": {
+        "type": "object",
+        "required": [
+          "app_id",
+          "former_org_id",
+          "new_org_id",
+          "message"
+        ],
+        "properties": {
+          "app_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "former_org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "new_org_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "message": {
+            "type": "string"
+          }
+        }
+      },
       "PlatformAppResponse": {
         "type": "object",
         "properties": {
@@ -24663,7 +25512,8 @@
           },
           "subject_token_type": {
             "type": "string",
-            "default": "urn:ietf:params:oauth:token-type:jwt"
+            "default": "urn:ietf:params:oauth:token-type:jwt",
+            "description": "Token type for subject_token. Use `urn:1claw:params:oauth:token-type:siwe`\nwith `siwe_message` and `siwe_signature` for wallet-based provisioning.\n"
           },
           "email": {
             "type": "string",
@@ -24672,6 +25522,24 @@
           },
           "display_name": {
             "type": "string"
+          },
+          "siwe_message": {
+            "type": "string",
+            "description": "EIP-4361 Sign-In With Ethereum message (required for SIWE upsert)"
+          },
+          "siwe_signature": {
+            "type": "string",
+            "description": "Hex-encoded SIWE signature (required for SIWE upsert)"
+          },
+          "return_to": {
+            "type": "string",
+            "format": "uri",
+            "description": "Redirect URL after cross-org link consent"
+          },
+          "create_sub_org": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, creates a sub-org under the platform app's org"
           }
         }
       },
@@ -24800,6 +25668,11 @@
             "type": "string",
             "format": "uri",
             "description": "URL to redirect the user to after claiming resources."
+          },
+          "parameters": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Template parameters substituted as `{{params.*}}` during bootstrap.\nCombined with `Idempotency-Key` header for params-aware idempotent replay.\n"
           }
         }
       },
@@ -25518,6 +26391,24 @@
           }
         }
       },
+      "ApprovalListResponse": {
+        "type": "object",
+        "required": [
+          "approvals",
+          "total"
+        ],
+        "properties": {
+          "approvals": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ApprovalResponse"
+            }
+          },
+          "total": {
+            "type": "integer"
+          }
+        }
+      },
       "ApprovalStatusResponse": {
         "type": "object",
         "required": [
@@ -25807,6 +26698,34 @@
             "type": "integer",
             "description": "Maximum number of transactions per 24h window"
           },
+          "inference_allowance_usd": {
+            "type": "string",
+            "description": "Monthly LLM inference allowance in USD (decimal string)"
+          },
+          "inference_reserved_pct": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 100,
+            "default": 25,
+            "description": "Percent of allowance held in reserve (not spendable)"
+          },
+          "inference_hard_stop": {
+            "type": "boolean",
+            "default": true,
+            "description": "When true, block inference when allowance is exhausted"
+          },
+          "inference_allowance_mode": {
+            "type": "string",
+            "enum": [
+              "policy",
+              "credits"
+            ],
+            "default": "policy"
+          },
+          "max_request_cost_usd": {
+            "type": "string",
+            "description": "Maximum estimated cost per LLM request in USD"
+          },
           "human_factor_auth": {
             "type": "object",
             "additionalProperties": true,
@@ -25814,6 +26733,271 @@
           }
         }
       },
+      "SiweChallengeRequest": {
+        "type": "object",
+        "properties": {
+          "domain": {
+            "type": "string",
+            "description": "Optional SIWE domain override (defaults to platform app's siwe_domain)"
+          }
+        }
+      },
+      "SiweChallengeResponse": {
+        "type": "object",
+        "required": [
+          "nonce",
+          "expires_in",
+          "domain"
+        ],
+        "properties": {
+          "nonce": {
+            "type": "string"
+          },
+          "expires_in": {
+            "type": "integer",
+            "description": "Seconds until nonce expiry"
+          },
+          "domain": {
+            "type": "string"
+          }
+        }
+      },
+      "ConnectionDetailResponse": {
+        "type": "object",
+        "required": [
+          "connection_id",
+          "user_id",
+          "status",
+          "entitlement_status",
+          "vault_ids",
+          "agent_ids",
+          "claim"
+        ],
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "user_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "status": {
+            "type": "string"
+          },
+          "entitlement_status": {
+            "type": "string"
+          },
+          "wallet_address": {
+            "type": "string",
+            "nullable": true
+          },
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "claimed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "claim": {
+            "$ref": "#/components/schemas/ClaimStatusResponse"
+          }
+        }
+      },
+      "ClaimStatusResponse": {
+        "type": "object",
+        "required": [
+          "status"
+        ],
+        "properties": {
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "active",
+              "claimed"
+            ]
+          },
+          "redeemed_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          }
+        }
+      },
+      "ConnectionUsageResponse": {
+        "type": "object",
+        "required": [
+          "connection_id",
+          "period",
+          "inference_spent_usd"
+        ],
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "period": {
+            "type": "string",
+            "description": "UTC month (YYYY-MM)"
+          },
+          "inference_spent_usd": {
+            "type": "string"
+          }
+        }
+      },
+      "EntitlementsListResponse": {
+        "type": "object",
+        "required": [
+          "evaluations"
+        ],
+        "properties": {
+          "evaluations": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/EntitlementEvaluationResponse"
+            }
+          }
+        }
+      },
+      "EntitlementEvaluationResponse": {
+        "type": "object",
+        "required": [
+          "id",
+          "status",
+          "watch_kind",
+          "chain",
+          "holder_address"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "watch_kind": {
+            "type": "string"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "holder_address": {
+            "type": "string"
+          },
+          "last_value_raw": {
+            "type": "string",
+            "nullable": true
+          },
+          "last_checked_at": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          }
+        }
+      },
+      "TemplatePreviewRequest": {
+        "type": "object",
+        "properties": {
+          "parameters": {
+            "type": "object",
+            "additionalProperties": true
+          },
+          "subject": {
+            "type": "object",
+            "properties": {
+              "user_id": {
+                "type": "string"
+              },
+              "external_subject": {
+                "type": "string"
+              },
+              "wallet_address": {
+                "type": "string"
+              },
+              "email": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "TemplatePreviewResponse": {
+        "type": "object",
+        "required": [
+          "resolved_spec"
+        ],
+        "properties": {
+          "resolved_spec": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        }
+      },
+      "InferenceBudgetResponse": {
+        "type": "object",
+        "required": [
+          "allowance_usd",
+          "spent_usd",
+          "remaining_usd",
+          "reserved_pct",
+          "max_request_cost_usd",
+          "period_end"
+        ],
+        "properties": {
+          "allowance_usd": {
+            "type": "string"
+          },
+          "spent_usd": {
+            "type": "string"
+          },
+          "remaining_usd": {
+            "type": "string"
+          },
+          "reserved_pct": {
+            "type": "integer"
+          },
+          "max_request_cost_usd": {
+            "type": "string"
+          },
+          "period_end": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "connection_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          }
+        }
+      },
+      "InferenceBudgetUnconfiguredResponse": {
+        "type": "object",
+        "properties": {
+          "allowance_usd": {
+            "type": "string",
+            "nullable": true
+          },
+          "remaining_usd": {
+            "nullable": true
+          },
+          "message": {
+            "type": "string"
+          }
+        }
+      },
       "SpendPolicyResponse": {
         "type": "object",
         "required": [
@@ -25871,6 +27055,26 @@
             "type": "integer",
             "nullable": true
           },
+          "inference_allowance_usd": {
+            "type": "string",
+            "nullable": true
+          },
+          "inference_reserved_pct": {
+            "type": "integer",
+            "nullable": true
+          },
+          "inference_hard_stop": {
+            "type": "boolean",
+            "nullable": true
+          },
+          "inference_allowance_mode": {
+            "type": "string",
+            "nullable": true
+          },
+          "max_request_cost_usd": {
+            "type": "string",
+            "nullable": true
+          },
           "human_factor_auth": {
             "type": "object",
             "additionalProperties": true,
@@ -26053,6 +27257,33 @@
           }
         }
       },
+      "MfaPasskeyCompleteRequest": {
+        "type": "object",
+        "required": [
+          "mfa_token",
+          "credential_id",
+          "authenticator_data",
+          "client_data_json",
+          "signature"
+        ],
+        "properties": {
+          "mfa_token": {
+            "type": "string"
+          },
+          "credential_id": {
+            "type": "string"
+          },
+          "authenticator_data": {
+            "type": "string"
+          },
+          "client_data_json": {
+            "type": "string"
+          },
+          "signature": {
+            "type": "string"
+          }
+        }
+      },
       "GuardrailWideningQueuedResponse": {
         "type": "object",
         "required": [