@1claw/openapi-spec 0.58.0 → 0.58.2

package/README.md

@@ -1,4 +1,4 @@
-# @1claw/openapi-spec
+# @1claw/openapi-spec (v0.58.0)
 
 OpenAPI 3.1.0 specification for the [1Claw Vault API](https://1claw.xyz). Use this package to generate API clients in any language.
 
@@ -40,7 +40,27 @@ openapi-generator generate \
 import spec from "@1claw/openapi-spec/openapi.json";
 ```
 
-## What's in the spec (v0.55.0)
+## What's in the spec (v0.58.0)
+
+### Platform control plane (v0.58)
+- **App-scoped reads (`plt_`)** — `GET /v1/platform/connections/{id}/approvals`, pending-approvals (includes `payload_hash`), spend-policy
+- **Spend policy** — `GET /v1/platform/apps/{id}/spend-policies/{policy_id}`; `PUT .../connections/{id}/spend-policy` supports optional **`Idempotency-Key`** (24h body-hash replay)
+- **App lifecycle** — soft-delete returns `{ id, slug, deleted_at }`; slug unique per org; inactive apps return 404
+- **Ownership transfer** — `POST /v1/platform/apps/{id}/transfer-ownership` with step-up auth
+
+### Platform API expansion (v0.57)
+- **SIWE provisioning** — `POST /v1/platform/siwe/challenge`; upsert with wallet subject token
+- **Parameterized templates** — bootstrap `parameters` JSON; `POST .../templates/{tid}/preview` dry-runs `{{params.*}}` / `{{subject.*}}`
+- **Connection polling** — `GET /v1/platform/connections/{id}` (status, claim, entitlements, wallet address)
+- **Per-connection usage** — `GET .../connections/{id}/usage` (inference spend, UTC period)
+- **On-chain entitlements** — template `entitlements[]`; refresh + monitor endpoints
+- **Inference budgets** — spend policy inference allowance fields; `GET /v1/treasury/wallets/inference-budget`
+
+### Safe accounts & guardrail governance (v0.56)
+- **Agent accounts** — `GET/POST /v1/agents/{id}/accounts`, migrate/deprecate EOA, module registry
+- **Guardrail governance** — shadow report, revisions, replay; widening guardrails return **202** + approval
+- **Human Factor Auth** — treasury send/swap/export step-up policies
+- **Org unfreeze** — T3 step-up; cumulative gas budget ledger
 
 ### Graduated HITL & extended guardrails (v0.54–0.55)
 - **Agent fields** — `tx_approval_policy`, `typed_data_policy`, `simulation_failure_policy`, `raw_signing_policy`, `personal_sign_policy`, `tx_block_unlimited_approvals`, per-recipient limits, USD caps, `allow_erc4337`, `allow_eip7702`, `auto_suspended`, `clear_auto_suspended` (update)

package/openapi.json

@@ -9985,6 +9985,54 @@
       }
     },
     "/v1/platform/apps/{appId}/templates/{template_id}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a bootstrap template",
+        "description": "Returns the full template spec for a platform app. plt_ or user JWT.",
+        "operationId": "getPlatformTemplate",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "appId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "template_id",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Template details",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PlatformTemplateResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
       "patch": {
         "tags": [
           "Platform"
@@ -11302,7 +11350,7 @@
           "Platform"
         ],
         "summary": "Set per-user spend policy override",
-        "description": "Override the app-wide spend policy for a specific connected user. This\npolicy takes precedence over the app default. Remove by deleting the\nconnection-level policy.\n",
+        "description": "Replace the per-user spend policy for a connected user (deactivates the\nprevious active row, then inserts). Requires plt_ platform auth.\nOptional `Idempotency-Key` header must cover the full request body — reusing\nthe same key with different parameters returns 409.\n",
         "operationId": "setUserSpendPolicy",
         "security": [
           {
@@ -11415,34 +11463,403 @@
             }
           },
           {
-            "name": "limit",
-            "in": "query",
-            "required": false,
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connection-scoped approvals",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/approvals/{approvalId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a connection-scoped approval",
+        "operationId": "getConnectionApproval",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "approvalId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Approval detail",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/pending-approvals": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List pending consensus approvals for a connection",
+        "description": "Returns pending approvals for agents provisioned on the connection,\nincluding `action_payload` and `payload_hash` for consensus UX.\nRequires plt_ platform auth.\n",
+        "operationId": "listConnectionPendingApprovals",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "default": "pending"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 50
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 0
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Pending approvals list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PendingApprovalListResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/pending-approvals/{approvalId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a connection-scoped pending approval (with payload_hash)",
+        "operationId": "getConnectionPendingApproval",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "approvalId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Pending approval detail including action_payload and payload_hash",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PendingApprovalResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/pending-approvals/{approvalId}/decide": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Decide a pending approval for a connection user",
+        "description": "Platform apps vote on behalf of the connected user after verifying intent\nout-of-band (e.g. wallet mandate). Requires `payload_hash` matching the\npending row. Accepts `decision`: `approve` or `reject` (aliases `approved` /\n`rejected`). plt_ auth only; scoped to agents on the connection.\n",
+        "operationId": "decideConnectionPendingApproval",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "approvalId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ApprovePendingApprovalRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Updated pending approval",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PendingApprovalResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "description": "Already voted"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/approvals/{approvalId}/decide": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Decide a mobile/agent approval for a connection user",
+        "description": "Platform apps decide agent approval requests on behalf of the connected user.\nAccepts `decision`: `approved` or `rejected` (aliases `approve` / `reject`).\nplt_ auth only.\n",
+        "operationId": "decideConnectionApproval",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "approvalId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "decision"
+                ],
+                "properties": {
+                  "decision": {
+                    "type": "string",
+                    "enum": [
+                      "approved",
+                      "rejected",
+                      "approve",
+                      "reject"
+                    ]
+                  },
+                  "reason": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Decided approval",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "description": "Already decided"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/signing-keys/{chain}": {
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Deactivate a signing key for a connection agent",
+        "description": "Deactivates the signing key for an agent provisioned on the connection.\nWhen multiple agents exist, pass `agent_id` query param. plt_ auth only.\n",
+        "operationId": "deactivateConnectionSigningKey",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "chain",
+            "required": true,
             "schema": {
-              "type": "integer",
-              "default": 50
+              "type": "string"
             }
           },
           {
-            "name": "offset",
             "in": "query",
+            "name": "agent_id",
             "required": false,
             "schema": {
-              "type": "integer",
-              "default": 0
+              "type": "string",
+              "format": "uuid"
             }
           }
         ],
         "responses": {
-          "200": {
-            "description": "Connection-scoped approvals",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApprovalListResponse"
-                }
-              }
-            }
+          "204": {
+            "description": "Key deactivated"
+          },
+          "400": {
+            "description": "Multiple agents — agent_id required"
           },
           "404": {
             "$ref": "#/components/responses/NotFound"
@@ -11450,13 +11867,14 @@
         }
       }
     },
-    "/v1/platform/connections/{connectionId}/approvals/{approvalId}": {
-      "get": {
+    "/v1/platform/connections/{connectionId}/runtimes": {
+      "post": {
         "tags": [
           "Platform"
         ],
-        "summary": "Get a connection-scoped approval",
-        "operationId": "getConnectionApproval",
+        "summary": "Create a runtime for a connection agent",
+        "description": "Creates a Cloud Runtime in the end-user's org for an agent on this connection.\nUse instead of `POST /v1/runtimes` with a plt_ key (which resolves to the platform org).\nApp must verify user intent out-of-band (e.g. wallet mandate) before calling.\n",
+        "operationId": "createConnectionRuntime",
         "security": [
           {
             "BearerAuth": []
@@ -11471,42 +11889,46 @@
               "type": "string",
               "format": "uuid"
             }
-          },
-          {
-            "in": "path",
-            "name": "approvalId",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "format": "uuid"
-            }
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateConnectionRuntimeRequest"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
-            "description": "Approval detail",
+          "201": {
+            "description": "Runtime created",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApprovalResponse"
+                  "$ref": "#/components/schemas/RuntimeResponse"
                 }
               }
             }
           },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/NotFound"
           }
         }
       }
     },
-    "/v1/platform/connections/{connectionId}/pending-approvals": {
-      "get": {
+    "/v1/platform/connections/{connectionId}/agents/{agentId}/chat": {
+      "post": {
         "tags": [
           "Platform"
         ],
-        "summary": "List pending consensus approvals for a connection",
-        "description": "Returns pending approvals for agents provisioned on the connection,\nincluding `action_payload` and `payload_hash` for consensus UX.\nRequires plt_ platform auth.\n",
-        "operationId": "listConnectionPendingApprovals",
+        "summary": "Chat with a connection agent (plt_ scoped)",
+        "description": "Send a chat message to an agent provisioned on this connection, acting as the\nconnected end-user. Use instead of `POST /v1/agents/{id}/chat` with a plt_ key.\n",
+        "operationId": "connectionAgentChat",
         "security": [
           {
             "BearerAuth": []
@@ -11523,40 +11945,31 @@
             }
           },
           {
-            "name": "status",
-            "in": "query",
+            "in": "path",
+            "name": "agentId",
+            "required": true,
             "schema": {
               "type": "string",
-              "default": "pending"
-            }
-          },
-          {
-            "name": "limit",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "default": 50
-            }
-          },
-          {
-            "name": "offset",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "default": 0
+              "format": "uuid"
             }
           }
         ],
-        "responses": {
-          "200": {
-            "description": "Pending approvals list",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PendingApprovalListResponse"
-                }
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SendChatMessageRequest"
               }
             }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Message sent (JSON or SSE stream)"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           },
           "404": {
             "$ref": "#/components/responses/NotFound"
@@ -14121,6 +14534,61 @@
         }
       }
     },
+    "/v1/agents/{agent_id}/automations": {
+      "post": {
+        "tags": [
+          "Automations"
+        ],
+        "summary": "Create agent automation (agent-only)",
+        "operationId": "createAgentAutomation",
+        "description": "Agent-scoped create for simple manual or webhook automations from chat/runtime tools.\nAllowed step types: log, notify, memory_get, memory_put, wait (max 10).\nCron, swap, http, and transaction steps require human dashboard setup.\nRequires agent JWT; agent_id in path must match the caller.\n",
+        "parameters": [
+          {
+            "name": "agent_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AgentCreateAutomationRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Automation created (includes one-time webhook credentials when trigger_type is webhook)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AutomationCreatedResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/runtimes": {
       "post": {
         "tags": [
@@ -26806,6 +27274,20 @@
               "format": "uuid"
             }
           },
+          "runtime_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "automation_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
           "claimed_at": {
             "type": "string",
             "format": "date-time",
@@ -28137,6 +28619,48 @@
           }
         }
       },
+      "AgentCreateAutomationRequest": {
+        "type": "object",
+        "required": [
+          "name",
+          "workflow_spec"
+        ],
+        "description": "Agent-scoped automation create. Defaults to manual trigger.\nworkflow_spec must use only agent-allowed step types (log, notify, memory_get, memory_put, wait).\n",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 128
+          },
+          "trigger_type": {
+            "type": "string",
+            "enum": [
+              "manual",
+              "webhook"
+            ],
+            "default": "manual"
+          },
+          "workflow_spec": {
+            "oneOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": true
+                }
+              },
+              {
+                "type": "object",
+                "additionalProperties": true
+              }
+            ]
+          },
+          "auto_trigger": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true (manual trigger only), start a run immediately after creation"
+          }
+        }
+      },
       "UpdateAutomationRequest": {
         "type": "object",
         "properties": {
@@ -28269,6 +28793,14 @@
             "nullable": true,
             "description": "Resolved agent display name (enriched list field)"
           },
+          "created_by_type": {
+            "type": "string",
+            "enum": [
+              "user",
+              "agent"
+            ],
+            "description": "Whether the automation was created by a human or agent (chat-native create)"
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -28498,6 +29030,48 @@
           }
         }
       },
+      "CreateConnectionRuntimeRequest": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Required when multiple agents on the connection; defaults to sole agent"
+          },
+          "template": {
+            "type": "string"
+          },
+          "preset": {
+            "type": "string",
+            "default": "medium"
+          },
+          "env_public": {
+            "type": "object",
+            "additionalProperties": true
+          },
+          "idle_timeout_secs": {
+            "type": "integer"
+          },
+          "expose_http": {
+            "type": "boolean"
+          },
+          "slug": {
+            "type": "string"
+          },
+          "inbound_auth": {
+            "type": "string"
+          },
+          "startup_command": {
+            "type": "string"
+          }
+        }
+      },
       "CreateRuntimeRequest": {
         "type": "object",
         "required": [
@@ -31272,7 +31846,9 @@
             "type": "string",
             "enum": [
               "approve",
-              "reject"
+              "reject",
+              "approved",
+              "rejected"
             ]
           },
           "payload_hash": {

package/openapi.yaml

@@ -6425,6 +6425,35 @@ paths:
                                     $ref: "#/components/schemas/PlatformTemplateResponse"
 
     /v1/platform/apps/{appId}/templates/{template_id}:
+        get:
+            tags: [Platform]
+            summary: Get a bootstrap template
+            description: Returns the full template spec for a platform app. plt_ or user JWT.
+            operationId: getPlatformTemplate
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: appId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: template_id
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Template details
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PlatformTemplateResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
         patch:
             tags: [Platform]
             summary: Update a bootstrap template
@@ -7246,9 +7275,10 @@ paths:
             tags: [Platform]
             summary: Set per-user spend policy override
             description: |
-                Override the app-wide spend policy for a specific connected user. This
-                policy takes precedence over the app default. Remove by deleting the
-                connection-level policy.
+                Replace the per-user spend policy for a connected user (deactivates the
+                previous active row, then inserts). Requires plt_ platform auth.
+                Optional `Idempotency-Key` header must cover the full request body — reusing
+                the same key with different parameters returns 409.
             operationId: setUserSpendPolicy
             security:
                 - BearerAuth: []
@@ -7416,6 +7446,243 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}:
+        get:
+            tags: [Platform]
+            summary: Get a connection-scoped pending approval (with payload_hash)
+            operationId: getConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Pending approval detail including action_payload and payload_hash
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}/decide:
+        post:
+            tags: [Platform]
+            summary: Decide a pending approval for a connection user
+            description: |
+                Platform apps vote on behalf of the connected user after verifying intent
+                out-of-band (e.g. wallet mandate). Requires `payload_hash` matching the
+                pending row. Accepts `decision`: `approve` or `reject` (aliases `approved` /
+                `rejected`). plt_ auth only; scoped to agents on the connection.
+            operationId: decideConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/ApprovePendingApprovalRequest"
+            responses:
+                "200":
+                    description: Updated pending approval
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already voted
+
+    /v1/platform/connections/{connectionId}/approvals/{approvalId}/decide:
+        post:
+            tags: [Platform]
+            summary: Decide a mobile/agent approval for a connection user
+            description: |
+                Platform apps decide agent approval requests on behalf of the connected user.
+                Accepts `decision`: `approved` or `rejected` (aliases `approve` / `reject`).
+                plt_ auth only.
+            operationId: decideConnectionApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [decision]
+                            properties:
+                                decision:
+                                    type: string
+                                    enum: [approved, rejected, approve, reject]
+                                reason:
+                                    type: string
+            responses:
+                "200":
+                    description: Decided approval
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ApprovalResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already decided
+
+    /v1/platform/connections/{connectionId}/signing-keys/{chain}:
+        delete:
+            tags: [Platform]
+            summary: Deactivate a signing key for a connection agent
+            description: |
+                Deactivates the signing key for an agent provisioned on the connection.
+                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
+            operationId: deactivateConnectionSigningKey
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: chain
+                  required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Key deactivated
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/runtimes:
+        post:
+            tags: [Platform]
+            summary: Create a runtime for a connection agent
+            description: |
+                Creates a Cloud Runtime in the end-user's org for an agent on this connection.
+                Use instead of `POST /v1/runtimes` with a plt_ key (which resolves to the platform org).
+                App must verify user intent out-of-band (e.g. wallet mandate) before calling.
+            operationId: createConnectionRuntime
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/CreateConnectionRuntimeRequest"
+            responses:
+                "201":
+                    description: Runtime created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/RuntimeResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/agents/{agentId}/chat:
+        post:
+            tags: [Platform]
+            summary: Chat with a connection agent (plt_ scoped)
+            description: |
+                Send a chat message to an agent provisioned on this connection, acting as the
+                connected end-user. Use instead of `POST /v1/agents/{id}/chat` with a plt_ key.
+            operationId: connectionAgentChat
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: agentId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/SendChatMessageRequest"
+            responses:
+                "200":
+                    description: Message sent (JSON or SSE stream)
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     # --- Approvals ---
 
     /v1/approvals:
@@ -8994,6 +9261,45 @@ paths:
                             schema:
                                 $ref: "#/components/schemas/AutomationPresetsResponse"
 
+    /v1/agents/{agent_id}/automations:
+        post:
+            tags: [Automations]
+            summary: Create agent automation (agent-only)
+            operationId: createAgentAutomation
+            description: |
+                Agent-scoped create for simple manual or webhook automations from chat/runtime tools.
+                Allowed step types: log, notify, memory_get, memory_put, wait (max 10).
+                Cron, swap, http, and transaction steps require human dashboard setup.
+                Requires agent JWT; agent_id in path must match the caller.
+            parameters:
+                - name: agent_id
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/AgentCreateAutomationRequest"
+            responses:
+                "201":
+                    description: Automation created (includes one-time webhook credentials when trigger_type is webhook)
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/AutomationCreatedResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     # ---------------------------------------------------------------------------
     # Runtimes
     # ---------------------------------------------------------------------------
@@ -17654,6 +17960,16 @@ components:
                     items:
                         type: string
                         format: uuid
+                runtime_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                automation_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
                 claimed_at:
                     type: string
                     format: date-time
@@ -18502,6 +18818,33 @@ components:
                         - type: object
                           additionalProperties: true
 
+        AgentCreateAutomationRequest:
+            type: object
+            required: [name, workflow_spec]
+            description: |
+                Agent-scoped automation create. Defaults to manual trigger.
+                workflow_spec must use only agent-allowed step types (log, notify, memory_get, memory_put, wait).
+            properties:
+                name:
+                    type: string
+                    maxLength: 128
+                trigger_type:
+                    type: string
+                    enum: [manual, webhook]
+                    default: manual
+                workflow_spec:
+                    oneOf:
+                        - type: array
+                          items:
+                              type: object
+                              additionalProperties: true
+                        - type: object
+                          additionalProperties: true
+                auto_trigger:
+                    type: boolean
+                    default: false
+                    description: When true (manual trigger only), start a run immediately after creation
+
         UpdateAutomationRequest:
             type: object
             properties:
@@ -18585,6 +18928,10 @@ components:
                     type: string
                     nullable: true
                     description: Resolved agent display name (enriched list field)
+                created_by_type:
+                    type: string
+                    enum: [user, agent]
+                    description: Whether the automation was created by a human or agent (chat-native create)
                 created_at:
                     type: string
                     format: date-time
@@ -18730,6 +19077,35 @@ components:
 
         # --- Runtimes ---
 
+        CreateConnectionRuntimeRequest:
+            type: object
+            required: [name]
+            properties:
+                name:
+                    type: string
+                agent_id:
+                    type: string
+                    format: uuid
+                    description: Required when multiple agents on the connection; defaults to sole agent
+                template:
+                    type: string
+                preset:
+                    type: string
+                    default: medium
+                env_public:
+                    type: object
+                    additionalProperties: true
+                idle_timeout_secs:
+                    type: integer
+                expose_http:
+                    type: boolean
+                slug:
+                    type: string
+                inbound_auth:
+                    type: string
+                startup_command:
+                    type: string
+
         CreateRuntimeRequest:
             type: object
             required: [name, agent_id]
@@ -20628,7 +21004,7 @@ components:
             properties:
                 decision:
                     type: string
-                    enum: [approve, reject]
+                    enum: [approve, reject, approved, rejected]
                 payload_hash:
                     type: string
                 reason:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.58.0",
+  "version": "0.58.2",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {