@1claw/openapi-spec 0.57.0 → 0.58.2

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: 0.57.0
+    version: 0.58.0
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -6216,11 +6216,59 @@ paths:
                       type: string
                       format: uuid
             responses:
-                "204":
-                    description: Deleted
+                "200":
+                    description: Soft-deleted; slug released for reuse within the org
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PlatformAppDeleteResponse"
                 "403":
                     description: Only human users can delete platform apps
 
+    /v1/platform/apps/{appId}/transfer-ownership:
+        post:
+            tags: [Platform]
+            summary: Transfer platform app to another organization
+            description: |
+                Moves the platform app record to another organization. Requires org
+                owner/admin in the source org and step-up auth (`X-Auth-Confirm`,
+                purpose `platform.app.transfer`). End-user connections and provisioned
+                resources remain in their original organizations.
+            operationId: transferPlatformAppOwnership
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: header
+                  name: X-Auth-Confirm
+                  required: true
+                  schema:
+                      type: string
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/TransferPlatformAppOwnershipRequest"
+            responses:
+                "200":
+                    description: Ownership transferred
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/TransferPlatformAppOwnershipResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/platform/apps/{appId}/rotate-key:
         post:
             tags: [Platform]
@@ -6377,6 +6425,35 @@ paths:
                                     $ref: "#/components/schemas/PlatformTemplateResponse"
 
     /v1/platform/apps/{appId}/templates/{template_id}:
+        get:
+            tags: [Platform]
+            summary: Get a bootstrap template
+            description: Returns the full template spec for a platform app. plt_ or user JWT.
+            operationId: getPlatformTemplate
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: template_id
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Template details
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PlatformTemplateResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
         patch:
             tags: [Platform]
             summary: Update a bootstrap template
@@ -7026,41 +7103,400 @@ paths:
                 Public endpoint — the token itself is the authentication. Returns 409 if already claimed, 410 if expired.
             parameters:
                 - in: path
-                  name: token
+                  name: token
+                  required: true
+                  schema:
+                      type: string
+                  description: The `ct_` prefixed claim token from the bootstrap response
+            responses:
+                "200":
+                    description: Claim redeemed
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ClaimRedeemResponse"
+                "404":
+                    description: Invalid claim token
+                "409":
+                    description: Claim token already used
+                "410":
+                    description: Claim token has expired
+
+    # --- Spend Policies ---
+
+    /v1/platform/apps/{appId}/spend-policies:
+        post:
+            tags: [Platform]
+            summary: Create wallet spend policy
+            description: |
+                Create an app-wide spend policy that governs what embedded wallet users
+                can do with their wallets. Policies apply to all connected users by default
+                and can be overridden per-user via connection-level policies.
+            operationId: createSpendPolicy
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/CreateSpendPolicyRequest"
+            responses:
+                "201":
+                    description: Spend policy created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/SpendPolicyResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+        get:
+            tags: [Platform]
+            summary: List spend policies for app
+            description: Returns all spend policies configured for the platform app.
+            operationId: listSpendPolicies
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Spend policies
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    policies:
+                                        type: array
+                                        items:
+                                            $ref: "#/components/schemas/SpendPolicyResponse"
+
+    /v1/platform/apps/{appId}/spend-policies/{policyId}:
+        get:
+            tags: [Platform]
+            summary: Get a spend policy by ID
+            operationId: getSpendPolicy
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: policyId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Spend policy
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/SpendPolicyResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        delete:
+            tags: [Platform]
+            summary: Delete a spend policy
+            operationId: deleteSpendPolicy
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: policyId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Deleted
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/spend-policy:
+        get:
+            tags: [Platform]
+            summary: Get effective spend policy for a connection
+            description: |
+                Returns the effective spend policy for the connected user, resolving
+                per-user overrides before app-level defaults. Requires plt_ platform auth.
+            operationId: getConnectionSpendPolicy
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Effective spend policy (or null)
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    policy:
+                                        oneOf:
+                                            - $ref: "#/components/schemas/SpendPolicyResponse"
+                                            - type: "null"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        put:
+            tags: [Platform]
+            summary: Set per-user spend policy override
+            description: |
+                Replace the per-user spend policy for a connected user (deactivates the
+                previous active row, then inserts). Requires plt_ platform auth.
+                Optional `Idempotency-Key` header must cover the full request body — reusing
+                the same key with different parameters returns 409.
+            operationId: setUserSpendPolicy
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: header
+                  name: Idempotency-Key
+                  required: false
+                  schema:
+                      type: string
+                  description: Optional replay protection; same key + body returns cached response (409 on body mismatch).
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/CreateSpendPolicyRequest"
+            responses:
+                "200":
+                    description: Spend policy set (or idempotent replay)
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/SpendPolicyResponse"
+                "201":
+                    description: Spend policy created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/SpendPolicyResponse"
+                "409":
+                    description: Idempotency-Key reused with different body
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/approvals:
+        get:
+            tags: [Platform]
+            summary: List approvals for a platform connection
+            description: |
+                Returns approvals assigned to the connection's user, filtered to agents
+                provisioned on the connection. Requires plt_ platform auth.
+            operationId: listConnectionApprovals
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - name: status
+                  in: query
+                  required: false
+                  schema:
+                      type: string
+                - name: risk_tier
+                  in: query
+                  required: false
+                  schema:
+                      type: integer
+                - name: limit
+                  in: query
+                  required: false
+                  schema:
+                      type: integer
+                      default: 50
+                - name: offset
+                  in: query
+                  required: false
+                  schema:
+                      type: integer
+                      default: 0
+            responses:
+                "200":
+                    description: Connection-scoped approvals
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ApprovalListResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/approvals/{approvalId}:
+        get:
+            tags: [Platform]
+            summary: Get a connection-scoped approval
+            operationId: getConnectionApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Approval detail
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ApprovalResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/pending-approvals:
+        get:
+            tags: [Platform]
+            summary: List pending consensus approvals for a connection
+            description: |
+                Returns pending approvals for agents provisioned on the connection,
+                including `action_payload` and `payload_hash` for consensus UX.
+                Requires plt_ platform auth.
+            operationId: listConnectionPendingApprovals
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - name: status
+                  in: query
+                  schema:
+                      type: string
+                      default: pending
+                - name: limit
+                  in: query
+                  schema:
+                      type: integer
+                      default: 50
+                - name: offset
+                  in: query
+                  schema:
+                      type: integer
+                      default: 0
+            responses:
+                "200":
+                    description: Pending approvals list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalListResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}:
+        get:
+            tags: [Platform]
+            summary: Get a connection-scoped pending approval (with payload_hash)
+            operationId: getConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
                   required: true
                   schema:
                       type: string
-                  description: The `ct_` prefixed claim token from the bootstrap response
+                      format: uuid
             responses:
                 "200":
-                    description: Claim redeemed
+                    description: Pending approval detail including action_payload and payload_hash
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/ClaimRedeemResponse"
+                                $ref: "#/components/schemas/PendingApprovalResponse"
                 "404":
-                    description: Invalid claim token
-                "409":
-                    description: Claim token already used
-                "410":
-                    description: Claim token has expired
-
-    # --- Spend Policies ---
+                    $ref: "#/components/responses/NotFound"
 
-    /v1/platform/apps/{appId}/spend-policies:
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}/decide:
         post:
             tags: [Platform]
-            summary: Create wallet spend policy
+            summary: Decide a pending approval for a connection user
             description: |
-                Create an app-wide spend policy that governs what embedded wallet users
-                can do with their wallets. Policies apply to all connected users by default
-                and can be overridden per-user via connection-level policies.
-            operationId: createSpendPolicy
+                Platform apps vote on behalf of the connected user after verifying intent
+                out-of-band (e.g. wallet mandate). Requires `payload_hash` matching the
+                pending row. Accepts `decision`: `approve` or `reject` (aliases `approved` /
+                `rejected`). plt_ auth only; scoped to agents on the connection.
+            operationId: decideConnectionPendingApproval
             security:
                 - BearerAuth: []
             parameters:
                 - in: path
-                  name: appId
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
                   required: true
                   schema:
                       type: string
@@ -7070,80 +7506,119 @@ paths:
                 content:
                     application/json:
                         schema:
-                            $ref: "#/components/schemas/CreateSpendPolicyRequest"
+                            $ref: "#/components/schemas/ApprovePendingApprovalRequest"
             responses:
-                "201":
-                    description: Spend policy created
+                "200":
+                    description: Updated pending approval
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/SpendPolicyResponse"
+                                $ref: "#/components/schemas/PendingApprovalResponse"
                 "400":
                     $ref: "#/components/responses/BadRequest"
                 "403":
                     $ref: "#/components/responses/Forbidden"
-        get:
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already voted
+
+    /v1/platform/connections/{connectionId}/approvals/{approvalId}/decide:
+        post:
             tags: [Platform]
-            summary: List spend policies for app
-            description: Returns all spend policies configured for the platform app.
-            operationId: listSpendPolicies
+            summary: Decide a mobile/agent approval for a connection user
+            description: |
+                Platform apps decide agent approval requests on behalf of the connected user.
+                Accepts `decision`: `approved` or `rejected` (aliases `approve` / `reject`).
+                plt_ auth only.
+            operationId: decideConnectionApproval
             security:
                 - BearerAuth: []
             parameters:
                 - in: path
-                  name: appId
+                  name: connectionId
                   required: true
                   schema:
                       type: string
                       format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [decision]
+                            properties:
+                                decision:
+                                    type: string
+                                    enum: [approved, rejected, approve, reject]
+                                reason:
+                                    type: string
             responses:
                 "200":
-                    description: Spend policies
+                    description: Decided approval
                     content:
                         application/json:
                             schema:
-                                type: object
-                                properties:
-                                    policies:
-                                        type: array
-                                        items:
-                                            $ref: "#/components/schemas/SpendPolicyResponse"
+                                $ref: "#/components/schemas/ApprovalResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already decided
 
-    /v1/platform/apps/{appId}/spend-policies/{policyId}:
+    /v1/platform/connections/{connectionId}/signing-keys/{chain}:
         delete:
             tags: [Platform]
-            summary: Delete a spend policy
-            operationId: deleteSpendPolicy
+            summary: Deactivate a signing key for a connection agent
+            description: |
+                Deactivates the signing key for an agent provisioned on the connection.
+                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
+            operationId: deactivateConnectionSigningKey
             security:
                 - BearerAuth: []
             parameters:
                 - in: path
-                  name: appId
+                  name: connectionId
                   required: true
                   schema:
                       type: string
                       format: uuid
                 - in: path
-                  name: policyId
+                  name: chain
                   required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
                   schema:
                       type: string
                       format: uuid
             responses:
                 "204":
-                    description: Deleted
+                    description: Key deactivated
+                "400":
+                    description: Multiple agents — agent_id required
                 "404":
                     $ref: "#/components/responses/NotFound"
 
-    /v1/platform/connections/{connectionId}/spend-policy:
-        put:
+    /v1/platform/connections/{connectionId}/runtimes:
+        post:
             tags: [Platform]
-            summary: Set per-user spend policy override
+            summary: Create a runtime for a connection agent
             description: |
-                Override the app-wide spend policy for a specific connected user. This
-                policy takes precedence over the app default. Remove by deleting the
-                connection-level policy.
-            operationId: setUserSpendPolicy
+                Creates a Cloud Runtime in the end-user's org for an agent on this connection.
+                Use instead of `POST /v1/runtimes` with a plt_ key (which resolves to the platform org).
+                App must verify user intent out-of-band (e.g. wallet mandate) before calling.
+            operationId: createConnectionRuntime
             security:
                 - BearerAuth: []
             parameters:
@@ -7158,18 +7633,55 @@ paths:
                 content:
                     application/json:
                         schema:
-                            $ref: "#/components/schemas/CreateSpendPolicyRequest"
+                            $ref: "#/components/schemas/CreateConnectionRuntimeRequest"
             responses:
-                "200":
-                    description: Spend policy set
+                "201":
+                    description: Runtime created
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/SpendPolicyResponse"
-                "400":
-                    $ref: "#/components/responses/BadRequest"
+                                $ref: "#/components/schemas/RuntimeResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/agents/{agentId}/chat:
+        post:
+            tags: [Platform]
+            summary: Chat with a connection agent (plt_ scoped)
+            description: |
+                Send a chat message to an agent provisioned on this connection, acting as the
+                connected end-user. Use instead of `POST /v1/agents/{id}/chat` with a plt_ key.
+            operationId: connectionAgentChat
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: agentId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/SendChatMessageRequest"
+            responses:
+                "200":
+                    description: Message sent (JSON or SSE stream)
                 "403":
                     $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
 
     # --- Approvals ---
 
@@ -8749,6 +9261,45 @@ paths:
                             schema:
                                 $ref: "#/components/schemas/AutomationPresetsResponse"
 
+    /v1/agents/{agent_id}/automations:
+        post:
+            tags: [Automations]
+            summary: Create agent automation (agent-only)
+            operationId: createAgentAutomation
+            description: |
+                Agent-scoped create for simple manual or webhook automations from chat/runtime tools.
+                Allowed step types: log, notify, memory_get, memory_put, wait (max 10).
+                Cron, swap, http, and transaction steps require human dashboard setup.
+                Requires agent JWT; agent_id in path must match the caller.
+            parameters:
+                - name: agent_id
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/AgentCreateAutomationRequest"
+            responses:
+                "201":
+                    description: Automation created (includes one-time webhook credentials when trigger_type is webhook)
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/AutomationCreatedResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     # ---------------------------------------------------------------------------
     # Runtimes
     # ---------------------------------------------------------------------------
@@ -9053,7 +9604,7 @@ paths:
             summary: Chat with a running runtime agent
             description: |
                 Human-only. Proxies to the runtime container's OpenAI-compatible
-                `POST /v1/chat/completions` (hermes / openclaw / openclaude chat bridge).
+                `POST /v1/chat/completions` (hermes / openclaw / openclaude / opencode chat bridge).
                 Starts the runtime if stopped. Streams SSE when `Accept: text/event-stream`
                 or `stream: true`. Conversation history is ephemeral (pass `messages`).
                 Requires a public URL (shell access, Shroud sidecar, or HTTP hosting).
@@ -16353,6 +16904,46 @@ components:
                     nullable: true
                     description: Optional expiration time for the platform API key. Set to null to clear.
 
+        PlatformAppDeleteResponse:
+            type: object
+            required: [deleted, soft_delete, slug_released, former_slug]
+            properties:
+                deleted:
+                    type: boolean
+                soft_delete:
+                    type: boolean
+                slug_released:
+                    type: boolean
+                former_slug:
+                    type: string
+
+        TransferPlatformAppOwnershipRequest:
+            type: object
+            properties:
+                target_org_id:
+                    type: string
+                    format: uuid
+                target_user_email:
+                    type: string
+                    format: email
+            description: Provide `target_org_id` or `target_user_email` (owner/admin in destination org).
+
+        TransferPlatformAppOwnershipResponse:
+            type: object
+            required: [app_id, former_org_id, new_org_id, message]
+            properties:
+                app_id:
+                    type: string
+                    format: uuid
+                former_org_id:
+                    type: string
+                    format: uuid
+                new_org_id:
+                    type: string
+                    format: uuid
+                message:
+                    type: string
+
         PlatformAppResponse:
             type: object
             properties:
@@ -17080,6 +17671,17 @@ components:
                     type: string
                     format: date-time
 
+        ApprovalListResponse:
+            type: object
+            required: [approvals, total]
+            properties:
+                approvals:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/ApprovalResponse"
+                total:
+                    type: integer
+
         ApprovalStatusResponse:
             type: object
             required: [status]
@@ -17358,6 +17960,16 @@ components:
                     items:
                         type: string
                         format: uuid
+                runtime_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                automation_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
                 claimed_at:
                     type: string
                     format: date-time
@@ -18206,6 +18818,33 @@ components:
                         - type: object
                           additionalProperties: true
 
+        AgentCreateAutomationRequest:
+            type: object
+            required: [name, workflow_spec]
+            description: |
+                Agent-scoped automation create. Defaults to manual trigger.
+                workflow_spec must use only agent-allowed step types (log, notify, memory_get, memory_put, wait).
+            properties:
+                name:
+                    type: string
+                    maxLength: 128
+                trigger_type:
+                    type: string
+                    enum: [manual, webhook]
+                    default: manual
+                workflow_spec:
+                    oneOf:
+                        - type: array
+                          items:
+                              type: object
+                              additionalProperties: true
+                        - type: object
+                          additionalProperties: true
+                auto_trigger:
+                    type: boolean
+                    default: false
+                    description: When true (manual trigger only), start a run immediately after creation
+
         UpdateAutomationRequest:
             type: object
             properties:
@@ -18289,6 +18928,10 @@ components:
                     type: string
                     nullable: true
                     description: Resolved agent display name (enriched list field)
+                created_by_type:
+                    type: string
+                    enum: [user, agent]
+                    description: Whether the automation was created by a human or agent (chat-native create)
                 created_at:
                     type: string
                     format: date-time
@@ -18434,6 +19077,35 @@ components:
 
         # --- Runtimes ---
 
+        CreateConnectionRuntimeRequest:
+            type: object
+            required: [name]
+            properties:
+                name:
+                    type: string
+                agent_id:
+                    type: string
+                    format: uuid
+                    description: Required when multiple agents on the connection; defaults to sole agent
+                template:
+                    type: string
+                preset:
+                    type: string
+                    default: medium
+                env_public:
+                    type: object
+                    additionalProperties: true
+                idle_timeout_secs:
+                    type: integer
+                expose_http:
+                    type: boolean
+                slug:
+                    type: string
+                inbound_auth:
+                    type: string
+                startup_command:
+                    type: string
+
         CreateRuntimeRequest:
             type: object
             required: [name, agent_id]
@@ -20332,7 +21004,7 @@ components:
             properties:
                 decision:
                     type: string
-                    enum: [approve, reject]
+                    enum: [approve, reject, approved, rejected]
                 payload_hash:
                     type: string
                 reason: