@1claw/openapi-spec 0.59.0 → 0.59.5

package/openapi.yaml

@@ -4018,6 +4018,40 @@ paths:
                 "404":
                     description: Agent-keys vault not found
 
+    /v1/org/onboarding/status:
+        get:
+            tags: [Organization]
+            summary: Onboarding funnel status
+            description: Returns welcome-bundle and MCP connection progress for the connect wizard.
+            operationId: getOnboardingStatus
+            responses:
+                "200":
+                    description: Onboarding status
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OnboardingStatus"
+
+    /v1/onboarding/provision:
+        post:
+            tags: [Organization]
+            summary: Provision MCP onboarding bundle
+            description: Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.
+            operationId: provisionOnboarding
+            requestBody:
+                required: false
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/OnboardingProvisionRequest"
+            responses:
+                "200":
+                    description: Provisioned resources
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/OnboardingProvisionResponse"
+
     /v1/org/status:
         get:
             tags: [Organization]
@@ -6020,6 +6054,34 @@ paths:
                             schema:
                                 $ref: "#/components/schemas/ShroudAttestationResponse"
 
+    /v1/shroud/inspect-content:
+        post:
+            tags: [Shroud]
+            summary: Inspect text for security threats
+            description: |
+                Standalone content inspection (MCP `inspect_content` parity). Scans for command
+                injection, encoding tricks, social engineering, PII, and suspicious URLs.
+                Fail-closed — returns `safe: false` when high/critical threats match.
+                Accepts plt_ platform keys, agent JWTs, and user JWTs.
+            operationId: inspectContent
+            security:
+                - BearerAuth: []
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/InspectContentRequest"
+            responses:
+                "200":
+                    description: Inspection report
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/InspectContentResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+
     /v1/shroud/activity:
         get:
             tags: [Shroud]
@@ -6341,6 +6403,34 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/platform/apps/{appId}/webhooks:
+        get:
+            tags: [Platform]
+            summary: Platform webhook delivery catalog
+            description: |
+                Returns whether `webhook_url` is configured and the event types delivered to
+                the platform app webhook (payload includes `connection_id` when applicable).
+                Org-scoped webhook subscriptions (`GET /v1/webhooks`) are separate.
+            operationId: getPlatformWebhooks
+            security:
+                - BearerAuth: []
+            parameters:
+                - name: appId
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Webhook configuration summary
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PlatformWebhookInfoResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/platform/apps/{appId}/rotate-webhook-secret:
         post:
             tags: [Platform]
@@ -7441,20 +7531,455 @@ paths:
                       type: integer
                       default: 0
             responses:
-                "200":
-                    description: Pending approvals list
+                "200":
+                    description: Pending approvals list
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalListResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        post:
+            tags: [Platform]
+            summary: Create a pending consensus approval for a connection agent
+            description: |
+                Platform apps submit over-cap or consensus-gated actions on behalf of a
+                connected user's agent. When `policy_id` is omitted, the server resolves the
+                matching agent `consensus_trigger` policy from `action_payload` (chain, to, value).
+                Returns **202** with `pending_approval_id` and `payload_hash` for decide/execute.
+                Requires plt_ auth; agent must be provisioned on the connection.
+            operationId: createConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/ConnectionSubmitPendingApprovalRequest"
+            responses:
+                "202":
+                    description: Pending approval created
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/SubmitPendingApprovalResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}:
+        get:
+            tags: [Platform]
+            summary: Get a connection-scoped pending approval (with payload_hash)
+            operationId: getConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Pending approval detail including action_payload and payload_hash
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}/decide:
+        post:
+            tags: [Platform]
+            summary: Decide a pending approval for a connection user
+            description: |
+                Platform apps vote on behalf of the connected user after verifying intent
+                out-of-band (e.g. wallet mandate). Requires `payload_hash` matching the
+                pending row. Accepts `decision`: `approve` or `reject` (aliases `approved` /
+                `rejected`). plt_ auth only; scoped to agents on the connection.
+            operationId: decideConnectionPendingApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/ApprovePendingApprovalRequest"
+            responses:
+                "200":
+                    description: Updated pending approval
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PendingApprovalResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already voted
+
+    /v1/platform/connections/{connectionId}/approvals/{approvalId}/decide:
+        post:
+            tags: [Platform]
+            summary: Decide a mobile/agent approval for a connection user
+            description: |
+                Platform apps decide agent approval requests on behalf of the connected user.
+                Accepts `decision`: `approved` or `rejected` (aliases `approve` / `reject`).
+                plt_ auth only.
+            operationId: decideConnectionApproval
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: approvalId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [decision]
+                            properties:
+                                decision:
+                                    type: string
+                                    enum: [approved, rejected, approve, reject]
+                                reason:
+                                    type: string
+            responses:
+                "200":
+                    description: Decided approval
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ApprovalResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    description: Already decided
+
+    /v1/platform/connections/{connectionId}/signing-keys:
+        get:
+            tags: [Platform]
+            summary: List signing keys for a connection agent
+            description: |
+                Returns public signing-key metadata (chain, address, public_key, curve) for
+                agent(s) provisioned on the connection. Never includes private keys.
+                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
+            operationId: listConnectionSigningKeys
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Signing keys for the connection agent
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ConnectionSigningKeyListResponse"
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/signing-keys/{chain}:
+        get:
+            tags: [Platform]
+            summary: Get a signing key for a connection agent by chain
+            description: |
+                Returns public signing-key metadata for one chain on a connection agent.
+                Network names (e.g. `base`, `sepolia`) resolve to canonical signing keys
+                (e.g. `ethereum`). Never includes private keys. plt_ auth only.
+            operationId: getConnectionSigningKey
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: chain
+                  required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Signing key metadata
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ConnectionSigningKeyDetailResponse"
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        delete:
+            tags: [Platform]
+            summary: Deactivate a signing key for a connection agent
+            description: |
+                Deactivates the signing key for an agent provisioned on the connection.
+                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
+            operationId: deactivateConnectionSigningKey
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: chain
+                  required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Key deactivated
+                "400":
+                    description: Multiple agents — agent_id required
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/agents/{agentId}:
+        patch:
+            tags: [Platform]
+            summary: Update limited agent settings for a connection
+            description: |
+                Platform-scoped agent update for connected end-users. Allows enabling Intents API,
+                Execution Intents, and updating the default system prompt without human dashboard access.
+                Agent must be provisioned on the connection. plt_ auth only.
+            operationId: patchConnectionAgent
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: agentId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/PatchConnectionAgentRequest"
+            responses:
+                "200":
+                    description: Updated agent settings
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PatchConnectionAgentResponse"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/portfolio:
+        get:
+            tags: [Platform]
+            summary: Portfolio for connection agents
+            description: |
+                Aggregates signing-key and smart-account balances for agents provisioned on
+                the connection. plt_ auth only.
+            operationId: getConnectionPortfolio
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: query
+                  name: chains
+                  required: false
+                  schema:
+                      type: string
+                      description: Comma-separated chain filter (e.g. `ethereum,base`)
+                - in: query
+                  name: include_tokens
+                  required: false
+                  schema:
+                      type: boolean
+            responses:
+                "200":
+                    description: Connection-scoped portfolio
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PortfolioResponse"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
+    /v1/platform/connections/{connectionId}/balances:
+        get:
+            tags: [Platform]
+            summary: Balances alias for connection portfolio
+            description: Alias of `GET .../portfolio`. plt_ auth only.
+            operationId: getConnectionBalances
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: query
+                  name: chains
+                  required: false
+                  schema:
+                      type: string
+            responses:
+                "200":
+                    description: Connection-scoped portfolio
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PortfolioResponse"
+
+    /v1/platform/connections/{connectionId}/automations:
+        get:
+            tags: [Platform]
+            summary: List automations for connection agents
+            operationId: listConnectionAutomations
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "200":
+                    description: Automations scoped to connection agents
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/AutomationListResponse"
+        post:
+            tags: [Platform]
+            summary: Create automation for a connection agent
+            operationId: createConnectionAutomation
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/CreateAutomationRequest"
+            responses:
+                "201":
+                    description: Automation created
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/PendingApprovalListResponse"
-                "404":
-                    $ref: "#/components/responses/NotFound"
+                                $ref: "#/components/schemas/AutomationCreatedResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
 
-    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}:
-        get:
+    /v1/platform/connections/{connectionId}/automations/{automationId}/runs/{runId}/cancel:
+        post:
             tags: [Platform]
-            summary: Get a connection-scoped pending approval (with payload_hash)
-            operationId: getConnectionPendingApproval
+            summary: Cancel an automation run (connection-scoped)
+            operationId: cancelConnectionAutomationRun
             security:
                 - BearerAuth: []
             parameters:
@@ -7465,31 +7990,32 @@ paths:
                       type: string
                       format: uuid
                 - in: path
-                  name: approvalId
+                  name: automationId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: runId
                   required: true
                   schema:
                       type: string
                       format: uuid
             responses:
                 "200":
-                    description: Pending approval detail including action_payload and payload_hash
+                    description: Run cancelled
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/PendingApprovalResponse"
+                                $ref: "#/components/schemas/AutomationRunResponse"
                 "404":
                     $ref: "#/components/responses/NotFound"
 
-    /v1/platform/connections/{connectionId}/pending-approvals/{approvalId}/decide:
-        post:
+    /v1/platform/connections/{connectionId}/memory/{namespace}/{key}:
+        get:
             tags: [Platform]
-            summary: Decide a pending approval for a connection user
-            description: |
-                Platform apps vote on behalf of the connected user after verifying intent
-                out-of-band (e.g. wallet mandate). Requires `payload_hash` matching the
-                pending row. Accepts `decision`: `approve` or `reject` (aliases `approved` /
-                `rejected`). plt_ auth only; scoped to agents on the connection.
-            operationId: decideConnectionPendingApproval
+            summary: Get agent memory entry (connection-scoped)
+            operationId: getConnectionMemory
             security:
                 - BearerAuth: []
             parameters:
@@ -7500,42 +8026,36 @@ paths:
                       type: string
                       format: uuid
                 - in: path
-                  name: approvalId
+                  name: namespace
+                  required: true
+                  schema:
+                      type: string
+                - in: path
+                  name: key
                   required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
                   schema:
                       type: string
                       format: uuid
-            requestBody:
-                required: true
-                content:
-                    application/json:
-                        schema:
-                            $ref: "#/components/schemas/ApprovePendingApprovalRequest"
             responses:
                 "200":
-                    description: Updated pending approval
+                    description: Memory entry
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/PendingApprovalResponse"
-                "400":
-                    $ref: "#/components/responses/BadRequest"
+                                $ref: "#/components/schemas/MemoryEntry"
                 "403":
                     $ref: "#/components/responses/Forbidden"
                 "404":
                     $ref: "#/components/responses/NotFound"
-                "409":
-                    description: Already voted
-
-    /v1/platform/connections/{connectionId}/approvals/{approvalId}/decide:
-        post:
+        put:
             tags: [Platform]
-            summary: Decide a mobile/agent approval for a connection user
-            description: |
-                Platform apps decide agent approval requests on behalf of the connected user.
-                Accepts `decision`: `approved` or `rejected` (aliases `approve` / `reject`).
-                plt_ auth only.
-            operationId: decideConnectionApproval
+            summary: Upsert agent memory entry (connection-scoped)
+            operationId: putConnectionMemory
             security:
                 - BearerAuth: []
             parameters:
@@ -7546,8 +8066,18 @@ paths:
                       type: string
                       format: uuid
                 - in: path
-                  name: approvalId
+                  name: namespace
+                  required: true
+                  schema:
+                      type: string
+                - in: path
+                  name: key
                   required: true
+                  schema:
+                      type: string
+                - in: query
+                  name: agent_id
+                  required: false
                   schema:
                       type: string
                       format: uuid
@@ -7556,36 +8086,18 @@ paths:
                 content:
                     application/json:
                         schema:
-                            type: object
-                            required: [decision]
-                            properties:
-                                decision:
-                                    type: string
-                                    enum: [approved, rejected, approve, reject]
-                                reason:
-                                    type: string
+                            $ref: "#/components/schemas/PutMemoryRequest"
             responses:
                 "200":
-                    description: Decided approval
+                    description: Memory entry stored
                     content:
                         application/json:
                             schema:
-                                $ref: "#/components/schemas/ApprovalResponse"
-                "403":
-                    $ref: "#/components/responses/Forbidden"
-                "404":
-                    $ref: "#/components/responses/NotFound"
-                "409":
-                    description: Already decided
-
-    /v1/platform/connections/{connectionId}/signing-keys/{chain}:
+                                $ref: "#/components/schemas/MemoryEntry"
         delete:
             tags: [Platform]
-            summary: Deactivate a signing key for a connection agent
-            description: |
-                Deactivates the signing key for an agent provisioned on the connection.
-                When multiple agents exist, pass `agent_id` query param. plt_ auth only.
-            operationId: deactivateConnectionSigningKey
+            summary: Delete agent memory entry (connection-scoped)
+            operationId: deleteConnectionMemory
             security:
                 - BearerAuth: []
             parameters:
@@ -7596,7 +8108,12 @@ paths:
                       type: string
                       format: uuid
                 - in: path
-                  name: chain
+                  name: namespace
+                  required: true
+                  schema:
+                      type: string
+                - in: path
+                  name: key
                   required: true
                   schema:
                       type: string
@@ -7608,9 +8125,7 @@ paths:
                       format: uuid
             responses:
                 "204":
-                    description: Key deactivated
-                "400":
-                    description: Multiple agents — agent_id required
+                    description: Deleted
                 "404":
                     $ref: "#/components/responses/NotFound"
 
@@ -14813,6 +15328,69 @@ components:
                     items:
                         $ref: "#/components/schemas/SigningKeyResponse"
 
+        ConnectionSigningKeyPublic:
+            type: object
+            properties:
+                chain:
+                    type: string
+                address:
+                    type: string
+                public_key:
+                    type: string
+                curve:
+                    type: string
+
+        ConnectionSigningKeyListResponse:
+            type: object
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                keys:
+                    type: array
+                    items:
+                        $ref: "#/components/schemas/ConnectionSigningKeyPublic"
+
+        ConnectionSigningKeyDetailResponse:
+            type: object
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                chain:
+                    type: string
+                address:
+                    type: string
+                public_key:
+                    type: string
+                curve:
+                    type: string
+
+        PatchConnectionAgentRequest:
+            type: object
+            properties:
+                intents_api_enabled:
+                    type: boolean
+                execution_intents_enabled:
+                    type: boolean
+                system_prompt:
+                    type: string
+                    nullable: true
+
+        PatchConnectionAgentResponse:
+            type: object
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                intents_api_enabled:
+                    type: boolean
+                execution_intents_enabled:
+                    type: boolean
+                system_prompt:
+                    type: string
+                    nullable: true
+
         # Bankr Dynamic Key Vending
         LeaseBankrKeyRequest:
             type: object
@@ -15512,6 +16090,58 @@ components:
                 email:
                     type: string
 
+        OnboardingStatus:
+            type: object
+            required:
+                - has_vault
+                - has_agent
+                - has_policy
+                - has_sample_secret
+                - first_secret_read
+                - welcome_bundle_complete
+            properties:
+                has_vault:
+                    type: boolean
+                has_agent:
+                    type: boolean
+                has_policy:
+                    type: boolean
+                has_sample_secret:
+                    type: boolean
+                first_secret_read:
+                    type: boolean
+                welcome_bundle_complete:
+                    type: boolean
+                default_vault_id:
+                    type: string
+                    format: uuid
+                    nullable: true
+
+        OnboardingProvisionRequest:
+            type: object
+            properties:
+                agent_name:
+                    type: string
+                client:
+                    type: string
+
+        OnboardingProvisionResponse:
+            type: object
+            required: [agent_id, api_key, vault_id, mcp_stdio_config, verify_prompt]
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                api_key:
+                    type: string
+                vault_id:
+                    type: string
+                    format: uuid
+                mcp_stdio_config:
+                    type: object
+                verify_prompt:
+                    type: string
+
         AgentKeysVaultResponse:
             type: object
             properties:
@@ -17011,6 +17641,10 @@ components:
                     format: date-time
                     nullable: true
                     description: Optional expiration time for the platform API key. Set to null to clear.
+                siwe_domain:
+                    type: string
+                    nullable: true
+                    description: Hostname allowed in SIWE messages for wallet sign-in (EIP-4361).
 
         PlatformAppDeleteResponse:
             type: object
@@ -17107,6 +17741,10 @@ components:
                     format: date-time
                     nullable: true
                     description: When the platform API key was last rotated.
+                siwe_domain:
+                    type: string
+                    nullable: true
+                    description: Hostname allowed in SIWE messages for wallet sign-in (EIP-4361).
                 created_at:
                     type: string
                     format: date-time
@@ -17136,12 +17774,21 @@ components:
                     type: object
                     description: |
                         Template specification defining vault, agents, policies, and signing keys to bootstrap.
-                        Top-level fields: `vault` (object with name, description), `agents` (array of agent specs
-                        with name, description, shroud_enabled, intents, shroud_config), `policies` (array with
-                        vault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of
-                        `{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).
-                        When `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the
-                        bootstrapped agent.
+                        Top-level fields: `vault` (object with name, description), `agents` (array of agent specs),
+                        `policies` (array with vault_ref, principal_ref, paths, permissions, conditions), and
+                        `signing_keys` (array of `{ chain }` objects — supported chains: ethereum, bitcoin, solana,
+                        xrp, cardano, tron). When `signing_keys` is present, HSM-backed signing keys are
+                        auto-provisioned for the bootstrapped agent.
+
+                        Each agent entry accepts Intents API and Execution Intents flags under any of these aliases
+                        (direct API field name, boolean shorthand, or `{ enabled: true }` object):
+                        - Intents API → `intents_api_enabled`, `intents: true`, or `intents: { enabled: true }`
+                          (maps to `agents.intents_api_enabled`)
+                        - Execution Intents → `execution_intents_enabled`, `execution: true`, or
+                          `execution: { enabled: true }` (maps to `agents.execution_intents_enabled`)
+
+                        Other agent fields: `name`, `description`, `shroud_enabled`, `shroud_config`, `system_prompt`,
+                        `environment`, `signing_keys`, `provision_eoa`, `memory`, `runtime`, `default_llm_provider`.
 
         PlatformTemplateResponse:
             type: object
@@ -21168,6 +21815,83 @@ components:
                 action_payload:
                     type: object
 
+        ConnectionSubmitPendingApprovalRequest:
+            type: object
+            required: [action_payload]
+            properties:
+                agent_id:
+                    type: string
+                    format: uuid
+                    description: Required when the connection has multiple agents
+                policy_id:
+                    type: string
+                    format: uuid
+                    description: Optional — auto-resolved from agent consensus policies when omitted
+                action:
+                    type: string
+                    default: transaction
+                action_payload:
+                    type: object
+                    description: Transaction/intent fields (chain, to, value, …) hashed for decide binding
+                summary:
+                    type: string
+                    description: Human-readable label included in webhook payloads
+
+        InspectContentRequest:
+            type: object
+            required: [content]
+            properties:
+                content:
+                    type: string
+                    maxLength: 102400
+                context:
+                    type: string
+                    enum: [input, output]
+                    description: Inspection context (reserved for future rules)
+
+        InspectContentResponse:
+            type: object
+            properties:
+                safe:
+                    type: boolean
+                verdict:
+                    type: string
+                    enum: [clean, malicious]
+                threat_count:
+                    type: integer
+                threats:
+                    type: array
+                    items:
+                        type: object
+                        properties:
+                            type:
+                                type: string
+                            pattern:
+                                type: string
+                            severity:
+                                type: string
+                unicode_normalized:
+                    type: boolean
+                normalized_content:
+                    type: string
+
+        PlatformWebhookInfoResponse:
+            type: object
+            properties:
+                app_id:
+                    type: string
+                    format: uuid
+                webhook_configured:
+                    type: boolean
+                webhook_url_host:
+                    type: string
+                platform_events:
+                    type: array
+                    items:
+                        type: string
+                org_webhooks_note:
+                    type: string
+
         SubmitPendingApprovalResponse:
             type: object
             properties: