@1claw/openapi-spec 0.58.2 → 0.59.2

package/README.md

@@ -1,4 +1,4 @@
-# @1claw/openapi-spec (v0.58.0)
+# @1claw/openapi-spec (v0.59.2)
 
 OpenAPI 3.1.0 specification for the [1Claw Vault API](https://1claw.xyz). Use this package to generate API clients in any language.
 

package/openapi.json

@@ -6218,6 +6218,60 @@
         }
       }
     },
+    "/v1/org/onboarding/status": {
+      "get": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Onboarding funnel status",
+        "description": "Returns welcome-bundle and MCP connection progress for the connect wizard.",
+        "operationId": "getOnboardingStatus",
+        "responses": {
+          "200": {
+            "description": "Onboarding status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OnboardingStatus"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/onboarding/provision": {
+      "post": {
+        "tags": [
+          "Organization"
+        ],
+        "summary": "Provision MCP onboarding bundle",
+        "description": "Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.",
+        "operationId": "provisionOnboarding",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OnboardingProvisionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Provisioned resources",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OnboardingProvisionResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/org/status": {
       "get": {
         "tags": [
@@ -10331,9 +10385,17 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/PlatformConnectedUserResponse"
+                  "type": "object",
+                  "required": [
+                    "users"
+                  ],
+                  "properties": {
+                    "users": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/PlatformConnectedUserResponse"
+                      }
+                    }
                   }
                 }
               }
@@ -11813,7 +11875,119 @@
         }
       }
     },
+    "/v1/platform/connections/{connectionId}/signing-keys": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List signing keys for a connection agent",
+        "description": "Returns public signing-key metadata (chain, address, public_key, curve) for\nagent(s) provisioned on the connection. Never includes private keys.\nWhen multiple agents exist, pass `agent_id` query param. plt_ auth only.\n",
+        "operationId": "listConnectionSigningKeys",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "query",
+            "name": "agent_id",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Signing keys for the connection agent",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectionSigningKeyListResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Multiple agents — agent_id required"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/connections/{connectionId}/signing-keys/{chain}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a signing key for a connection agent by chain",
+        "description": "Returns public signing-key metadata for one chain on a connection agent.\nNever includes private keys. plt_ auth only.\n",
+        "operationId": "getConnectionSigningKey",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "chain",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "agent_id",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Signing key metadata",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectionSigningKeyDetailResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Multiple agents — agent_id required"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
       "delete": {
         "tags": [
           "Platform"
@@ -11921,6 +12095,150 @@
         }
       }
     },
+    "/v1/platform/connections/{connectionId}/runtimes/{runtimeId}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get a connection runtime (plt_ scoped)",
+        "description": "Returns a runtime provisioned on this connection. Use instead of\n`GET /v1/runtimes/{id}` with a plt_ key (which resolves to the platform org).\n",
+        "operationId": "getConnectionRuntime",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "runtimeId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Runtime details",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RuntimeResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/passkeys/enroll/begin": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Begin passkey enrollment for a connected user",
+        "description": "Starts WebAuthn registration for the end-user on this connection.\nPlatform apps use this instead of `POST /v1/auth/passkeys/register/begin` (user JWT only).\n",
+        "operationId": "connectionPasskeyEnrollBegin",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "WebAuthn registration ceremony options",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeyRegisterBeginResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/passkeys/enroll/complete": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Complete passkey enrollment for a connected user",
+        "operationId": "connectionPasskeyEnrollComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PasskeyRegisterCompleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Passkey registered",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeyRegisterCompleteResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/connections/{connectionId}/agents/{agentId}/chat": {
       "post": {
         "tags": [
@@ -11968,6 +12286,9 @@
           "200": {
             "description": "Message sent (JSON or SSE stream)"
           },
+          "402": {
+            "description": "Payment required (LLM billing / inference allowance)"
+          },
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
@@ -20545,6 +20866,10 @@
           "shroud_config": {
             "$ref": "#/components/schemas/ShroudConfig"
           },
+          "system_prompt": {
+            "type": "string",
+            "description": "Default system prompt for agent chat when requests do not override it."
+          },
           "execution_intents_enabled": {
             "type": "boolean",
             "default": false,
@@ -20811,6 +21136,11 @@
           "shroud_config": {
             "$ref": "#/components/schemas/ShroudConfig"
           },
+          "system_prompt": {
+            "type": "string",
+            "nullable": true,
+            "description": "Default system prompt for agent chat (null clears)."
+          },
           "execution_intents_enabled": {
             "type": "boolean",
             "description": "Enable/disable Execution Intents for this agent"
@@ -21154,6 +21484,10 @@
           "shroud_config": {
             "$ref": "#/components/schemas/ShroudConfig"
           },
+          "system_prompt": {
+            "type": "string",
+            "description": "Default system prompt for agent chat when requests do not override it."
+          },
           "execution_intents_enabled": {
             "type": "boolean",
             "description": "Whether Execution Intents (bindings and execute endpoint) are enabled for this agent"
@@ -22590,6 +22924,59 @@
           }
         }
       },
+      "ConnectionSigningKeyPublic": {
+        "type": "object",
+        "properties": {
+          "chain": {
+            "type": "string"
+          },
+          "address": {
+            "type": "string"
+          },
+          "public_key": {
+            "type": "string"
+          },
+          "curve": {
+            "type": "string"
+          }
+        }
+      },
+      "ConnectionSigningKeyListResponse": {
+        "type": "object",
+        "properties": {
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "keys": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ConnectionSigningKeyPublic"
+            }
+          }
+        }
+      },
+      "ConnectionSigningKeyDetailResponse": {
+        "type": "object",
+        "properties": {
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "address": {
+            "type": "string"
+          },
+          "public_key": {
+            "type": "string"
+          },
+          "curve": {
+            "type": "string"
+          }
+        }
+      },
       "LeaseBankrKeyRequest": {
         "type": "object",
         "properties": {
@@ -23557,6 +23944,82 @@
           }
         }
       },
+      "OnboardingStatus": {
+        "type": "object",
+        "required": [
+          "has_vault",
+          "has_agent",
+          "has_policy",
+          "has_sample_secret",
+          "first_secret_read",
+          "welcome_bundle_complete"
+        ],
+        "properties": {
+          "has_vault": {
+            "type": "boolean"
+          },
+          "has_agent": {
+            "type": "boolean"
+          },
+          "has_policy": {
+            "type": "boolean"
+          },
+          "has_sample_secret": {
+            "type": "boolean"
+          },
+          "first_secret_read": {
+            "type": "boolean"
+          },
+          "welcome_bundle_complete": {
+            "type": "boolean"
+          },
+          "default_vault_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          }
+        }
+      },
+      "OnboardingProvisionRequest": {
+        "type": "object",
+        "properties": {
+          "agent_name": {
+            "type": "string"
+          },
+          "client": {
+            "type": "string"
+          }
+        }
+      },
+      "OnboardingProvisionResponse": {
+        "type": "object",
+        "required": [
+          "agent_id",
+          "api_key",
+          "vault_id",
+          "mcp_stdio_config",
+          "verify_prompt"
+        ],
+        "properties": {
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "api_key": {
+            "type": "string"
+          },
+          "vault_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "mcp_stdio_config": {
+            "type": "object"
+          },
+          "verify_prompt": {
+            "type": "string"
+          }
+        }
+      },
       "AgentKeysVaultResponse": {
         "type": "object",
         "properties": {
@@ -25747,6 +26210,11 @@
             "format": "date-time",
             "nullable": true,
             "description": "Optional expiration time for the platform API key. Set to null to clear."
+          },
+          "siwe_domain": {
+            "type": "string",
+            "nullable": true,
+            "description": "Hostname allowed in SIWE messages for wallet sign-in (EIP-4361)."
           }
         }
       },
@@ -25887,6 +26355,11 @@
             "nullable": true,
             "description": "When the platform API key was last rotated."
           },
+          "siwe_domain": {
+            "type": "string",
+            "nullable": true,
+            "description": "Hostname allowed in SIWE messages for wallet sign-in (EIP-4361)."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -25931,7 +26404,7 @@
           },
           "spec": {
             "type": "object",
-            "description": "Template specification defining vault, agents, policies, and signing keys to bootstrap.\nTop-level fields: `vault` (object with name, description), `agents` (array of agent specs\nwith name, description, shroud_enabled, intents, shroud_config), `policies` (array with\nvault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of\n`{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).\nWhen `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the\nbootstrapped agent.\n"
+            "description": "Template specification defining vault, agents, policies, and signing keys to bootstrap.\nTop-level fields: `vault` (object with name, description), `agents` (array of agent specs),\n`policies` (array with vault_ref, principal_ref, paths, permissions, conditions), and\n`signing_keys` (array of `{ chain }` objects — supported chains: ethereum, bitcoin, solana,\nxrp, cardano, tron). When `signing_keys` is present, HSM-backed signing keys are\nauto-provisioned for the bootstrapped agent.\n\nEach agent entry accepts Intents API and Execution Intents flags under any of these aliases\n(direct API field name, boolean shorthand, or `{ enabled: true }` object):\n- Intents API → `intents_api_enabled`, `intents: true`, or `intents: { enabled: true }`\n  (maps to `agents.intents_api_enabled`)\n- Execution Intents → `execution_intents_enabled`, `execution: true`, or\n  `execution: { enabled: true }` (maps to `agents.execution_intents_enabled`)\n\nOther agent fields: `name`, `description`, `shroud_enabled`, `shroud_config`, `system_prompt`,\n`environment`, `signing_keys`, `provision_eoa`, `memory`, `runtime`, `default_llm_provider`.\n"
           }
         }
       },
@@ -27256,6 +27729,11 @@
           "entitlement_status": {
             "type": "string"
           },
+          "provisioned_tier": {
+            "type": "string",
+            "nullable": true,
+            "description": "Billing tier granted to the end-user org when billing_model is platform_pays\n(from template plan at bootstrap). Null when not provisioned.\n"
+          },
           "wallet_address": {
             "type": "string",
             "nullable": true
@@ -27664,6 +28142,84 @@
           }
         }
       },
+      "PasskeyRegisterBeginResponse": {
+        "type": "object",
+        "properties": {
+          "challenge": {
+            "type": "string"
+          },
+          "rp_id": {
+            "type": "string"
+          },
+          "rp_name": {
+            "type": "string"
+          },
+          "user_id": {
+            "type": "string"
+          },
+          "user_name": {
+            "type": "string"
+          },
+          "user_display_name": {
+            "type": "string"
+          },
+          "attestation": {
+            "type": "string"
+          },
+          "authenticator_selection": {
+            "type": "object"
+          },
+          "pub_key_cred_params": {
+            "type": "array",
+            "items": {
+              "type": "object"
+            }
+          }
+        }
+      },
+      "PasskeyRegisterCompleteRequest": {
+        "type": "object",
+        "required": [
+          "credential_id",
+          "attestation_object",
+          "client_data_json"
+        ],
+        "properties": {
+          "credential_id": {
+            "type": "string"
+          },
+          "attestation_object": {
+            "type": "string"
+          },
+          "client_data_json": {
+            "type": "string"
+          },
+          "transports": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
+      "PasskeyRegisterCompleteResponse": {
+        "type": "object",
+        "properties": {
+          "passkey_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "credential_id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
       "PasskeyTxAssertBeginRequest": {
         "type": "object",
         "required": [
@@ -29758,12 +30314,10 @@
       },
       "SendChatMessageRequest": {
         "type": "object",
-        "required": [
-          "message"
-        ],
         "properties": {
           "message": {
-            "type": "string"
+            "type": "string",
+            "description": "User message text. Optional when `messages` includes a user turn."
           },
           "conversation_id": {
             "type": "string",
@@ -29779,6 +30333,40 @@
             "type": "string"
           },
           "system_prompt": {
+            "type": "string",
+            "description": "Stored on new conversations when `conversation_id` is omitted."
+          },
+          "system": {
+            "type": "string",
+            "description": "Per-request system prompt alias (same precedence as `system_prompt_override`)."
+          },
+          "system_prompt_override": {
+            "type": "string",
+            "description": "Per-request override; highest precedence except inline `messages` system role."
+          },
+          "messages": {
+            "type": "array",
+            "description": "Optional OpenAI-shaped history. When set, used for LLM context instead of DB history.",
+            "items": {
+              "type": "object",
+              "required": [
+                "role",
+                "content"
+              ],
+              "properties": {
+                "role": {
+                  "type": "string"
+                },
+                "content": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "llm_api_key_vault_id": {
+            "type": "string"
+          },
+          "llm_api_key_path": {
             "type": "string"
           }
         }

package/openapi.yaml

@@ -4018,6 +4018,40 @@ paths:
                 "404":
                     description: Agent-keys vault not found
 
+    /v1/org/onboarding/status:
+        get:
+            tags: [Organization]
+            summary: Onboarding funnel status
+            description: Returns welcome-bundle and MCP connection progress for the connect wizard.
+            operationId: getOnboardingStatus
+            responses:
+                "200":
+                    description: Onboarding status
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OnboardingStatus"
+
+    /v1/onboarding/provision:
+        post:
+            tags: [Organization]
+            summary: Provision MCP onboarding bundle
+            description: Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.
+            operationId: provisionOnboarding
+            requestBody:
+                required: false
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/OnboardingProvisionRequest"
+            responses:
+                "200":
+                    description: Provisioned resources
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OnboardingProvisionResponse"
+
     /v1/org/status:
         get:
             tags: [Organization]
@@ -6641,9 +6675,13 @@ paths:
                     content:
                         application/json:
                             schema:
-                                type: array
-                                items:
-                                    $ref: "#/components/schemas/PlatformConnectedUserResponse"
+                                type: object
+                                required: [users]
+                                properties:
+                                    users:
+                                        type: array
+                                        items:
+                                            $ref: "#/components/schemas/PlatformConnectedUserResponse"
 
     /v1/platform/connections/{connectionId}/bootstrap:
         post:
@@ -7574,7 +7612,81 @@ paths:
                 "409":
                     description: Already decided
 
+    /v1/platform/connections/{connectionId}/signing-keys:
+        get:
+            tags: [Platform]
+            summary: List signing keys for a connection agent
+            description: |
+                Returns public signing-key metadata (chain, address, public_key, curve) for
+                agent(s) provisioned on the connection. Never includes private keys.
+                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
+            operationId: listConnectionSigningKeys
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Signing keys for the connection agent
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ConnectionSigningKeyListResponse"
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/platform/connections/{connectionId}/signing-keys/{chain}:
+        get:
+            tags: [Platform]
+            summary: Get a signing key for a connection agent by chain
+            description: |
+                Returns public signing-key metadata for one chain on a connection agent.
+                Never includes private keys. plt_ auth only.
+            operationId: getConnectionSigningKey
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: chain
+                  required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Signing key metadata
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ConnectionSigningKeyDetailResponse"
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
         delete:
             tags: [Platform]
             summary: Deactivate a signing key for a connection agent
@@ -7646,6 +7758,98 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/platform/connections/{connectionId}/runtimes/{runtimeId}:
+        get:
+            tags: [Platform]
+            summary: Get a connection runtime (plt_ scoped)
+            description: |
+                Returns a runtime provisioned on this connection. Use instead of
+                `GET /v1/runtimes/{id}` with a plt_ key (which resolves to the platform org).
+            operationId: getConnectionRuntime
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: runtimeId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Runtime details
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/RuntimeResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/passkeys/enroll/begin:
+        post:
+            tags: [Platform]
+            summary: Begin passkey enrollment for a connected user
+            description: |
+                Starts WebAuthn registration for the end-user on this connection.
+                Platform apps use this instead of `POST /v1/auth/passkeys/register/begin` (user JWT only).
+            operationId: connectionPasskeyEnrollBegin
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: WebAuthn registration ceremony options
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PasskeyRegisterBeginResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/passkeys/enroll/complete:
+        post:
+            tags: [Platform]
+            summary: Complete passkey enrollment for a connected user
+            operationId: connectionPasskeyEnrollComplete
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/PasskeyRegisterCompleteRequest"
+            responses:
+                "201":
+                    description: Passkey registered
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PasskeyRegisterCompleteResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/platform/connections/{connectionId}/agents/{agentId}/chat:
         post:
             tags: [Platform]
@@ -7678,6 +7882,8 @@ paths:
             responses:
                 "200":
                     description: Message sent (JSON or SSE stream)
+                "402":
+                    description: Payment required (LLM billing / inference allowance)
                 "403":
                     $ref: "#/components/responses/Forbidden"
                 "404":
@@ -13218,6 +13424,9 @@ components:
                     description: Enable Shroud LLM Proxy for this agent
                 shroud_config:
                     $ref: "#/components/schemas/ShroudConfig"
+                system_prompt:
+                    type: string
+                    description: Default system prompt for agent chat when requests do not override it.
                 execution_intents_enabled:
                     type: boolean
                     default: false
@@ -13421,6 +13630,10 @@ components:
                     description: Enable/disable Shroud LLM Proxy
                 shroud_config:
                     $ref: "#/components/schemas/ShroudConfig"
+                system_prompt:
+                    type: string
+                    nullable: true
+                    description: Default system prompt for agent chat (null clears).
                 execution_intents_enabled:
                     type: boolean
                     description: Enable/disable Execution Intents for this agent
@@ -13691,6 +13904,9 @@ components:
                     description: Whether this agent routes LLM traffic through the Shroud TEE proxy
                 shroud_config:
                     $ref: "#/components/schemas/ShroudConfig"
+                system_prompt:
+                    type: string
+                    description: Default system prompt for agent chat when requests do not override it.
                 execution_intents_enabled:
                     type: boolean
                     description: Whether Execution Intents (bindings and execute endpoint) are enabled for this agent
@@ -14705,6 +14921,44 @@ components:
                     items:
                         $ref: "#/components/schemas/SigningKeyResponse"
 
+        ConnectionSigningKeyPublic:
+            type: object
+            properties:
+                chain:
+                    type: string
+                address:
+                    type: string
+                public_key:
+                    type: string
+                curve:
+                    type: string
+
+        ConnectionSigningKeyListResponse:
+            type: object
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                keys:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/ConnectionSigningKeyPublic"
+
+        ConnectionSigningKeyDetailResponse:
+            type: object
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                chain:
+                    type: string
+                address:
+                    type: string
+                public_key:
+                    type: string
+                curve:
+                    type: string
+
         # Bankr Dynamic Key Vending
         LeaseBankrKeyRequest:
             type: object
@@ -15404,6 +15658,58 @@ components:
                 email:
                     type: string
 
+        OnboardingStatus:
+            type: object
+            required:
+                - has_vault
+                - has_agent
+                - has_policy
+                - has_sample_secret
+                - first_secret_read
+                - welcome_bundle_complete
+            properties:
+                has_vault:
+                    type: boolean
+                has_agent:
+                    type: boolean
+                has_policy:
+                    type: boolean
+                has_sample_secret:
+                    type: boolean
+                first_secret_read:
+                    type: boolean
+                welcome_bundle_complete:
+                    type: boolean
+                default_vault_id:
+                    type: string
+                    format: uuid
+                    nullable: true
+
+        OnboardingProvisionRequest:
+            type: object
+            properties:
+                agent_name:
+                    type: string
+                client:
+                    type: string
+
+        OnboardingProvisionResponse:
+            type: object
+            required: [agent_id, api_key, vault_id, mcp_stdio_config, verify_prompt]
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                api_key:
+                    type: string
+                vault_id:
+                    type: string
+                    format: uuid
+                mcp_stdio_config:
+                    type: object
+                verify_prompt:
+                    type: string
+
         AgentKeysVaultResponse:
             type: object
             properties:
@@ -16903,6 +17209,10 @@ components:
                     format: date-time
                     nullable: true
                     description: Optional expiration time for the platform API key. Set to null to clear.
+                siwe_domain:
+                    type: string
+                    nullable: true
+                    description: Hostname allowed in SIWE messages for wallet sign-in (EIP-4361).
 
         PlatformAppDeleteResponse:
             type: object
@@ -16999,6 +17309,10 @@ components:
                     format: date-time
                     nullable: true
                     description: When the platform API key was last rotated.
+                siwe_domain:
+                    type: string
+                    nullable: true
+                    description: Hostname allowed in SIWE messages for wallet sign-in (EIP-4361).
                 created_at:
                     type: string
                     format: date-time
@@ -17028,12 +17342,21 @@ components:
                     type: object
                     description: |
                         Template specification defining vault, agents, policies, and signing keys to bootstrap.
-                        Top-level fields: `vault` (object with name, description), `agents` (array of agent specs
-                        with name, description, shroud_enabled, intents, shroud_config), `policies` (array with
-                        vault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of
-                        `{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).
-                        When `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the
-                        bootstrapped agent.
+                        Top-level fields: `vault` (object with name, description), `agents` (array of agent specs),
+                        `policies` (array with vault_ref, principal_ref, paths, permissions, conditions), and
+                        `signing_keys` (array of `{ chain }` objects — supported chains: ethereum, bitcoin, solana,
+                        xrp, cardano, tron). When `signing_keys` is present, HSM-backed signing keys are
+                        auto-provisioned for the bootstrapped agent.
+
+                        Each agent entry accepts Intents API and Execution Intents flags under any of these aliases
+                        (direct API field name, boolean shorthand, or `{ enabled: true }` object):
+                        - Intents API → `intents_api_enabled`, `intents: true`, or `intents: { enabled: true }`
+                          (maps to `agents.intents_api_enabled`)
+                        - Execution Intents → `execution_intents_enabled`, `execution: true`, or
+                          `execution: { enabled: true }` (maps to `agents.execution_intents_enabled`)
+
+                        Other agent fields: `name`, `description`, `shroud_enabled`, `shroud_config`, `system_prompt`,
+                        `environment`, `signing_keys`, `provision_eoa`, `memory`, `runtime`, `default_llm_provider`.
 
         PlatformTemplateResponse:
             type: object
@@ -17947,6 +18270,12 @@ components:
                     type: string
                 entitlement_status:
                     type: string
+                provisioned_tier:
+                    type: string
+                    nullable: true
+                    description: |
+                        Billing tier granted to the end-user org when billing_model is platform_pays
+                        (from template plan at bootstrap). Null when not provisioned.
                 wallet_address:
                     type: string
                     nullable: true
@@ -18210,6 +18539,58 @@ components:
                     minimum: 0
                     description: Number of WebAuthn passkeys registered for the calling user.
 
+        PasskeyRegisterBeginResponse:
+            type: object
+            properties:
+                challenge:
+                    type: string
+                rp_id:
+                    type: string
+                rp_name:
+                    type: string
+                user_id:
+                    type: string
+                user_name:
+                    type: string
+                user_display_name:
+                    type: string
+                attestation:
+                    type: string
+                authenticator_selection:
+                    type: object
+                pub_key_cred_params:
+                    type: array
+                    items:
+                        type: object
+
+        PasskeyRegisterCompleteRequest:
+            type: object
+            required: [credential_id, attestation_object, client_data_json]
+            properties:
+                credential_id:
+                    type: string
+                attestation_object:
+                    type: string
+                client_data_json:
+                    type: string
+                transports:
+                    type: array
+                    items:
+                        type: string
+                name:
+                    type: string
+
+        PasskeyRegisterCompleteResponse:
+            type: object
+            properties:
+                passkey_id:
+                    type: string
+                    format: uuid
+                credential_id:
+                    type: string
+                name:
+                    type: string
+
         PasskeyTxAssertBeginRequest:
             type: object
             required: [tx_digest]
@@ -19558,10 +19939,10 @@ components:
 
         SendChatMessageRequest:
             type: object
-            required: [message]
             properties:
                 message:
                     type: string
+                    description: User message text. Optional when `messages` includes a user turn.
                 conversation_id:
                     type: string
                     format: uuid
@@ -19573,6 +19954,28 @@ components:
                     type: string
                 system_prompt:
                     type: string
+                    description: Stored on new conversations when `conversation_id` is omitted.
+                system:
+                    type: string
+                    description: Per-request system prompt alias (same precedence as `system_prompt_override`).
+                system_prompt_override:
+                    type: string
+                    description: Per-request override; highest precedence except inline `messages` system role.
+                messages:
+                    type: array
+                    description: Optional OpenAI-shaped history. When set, used for LLM context instead of DB history.
+                    items:
+                        type: object
+                        required: [role, content]
+                        properties:
+                            role:
+                                type: string
+                            content:
+                                type: string
+                llm_api_key_vault_id:
+                    type: string
+                llm_api_key_path:
+                    type: string
 
         ChatMessageResponse:
             type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.58.2",
+  "version": "0.59.2",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {