@1claw/openapi-spec 0.59.5 → 0.59.7

package/README.md

@@ -1,6 +1,8 @@
 # @1claw/openapi-spec (v0.59.4)
 
-OpenAPI 3.1.0 specification for the [1Claw Vault API](https://1claw.xyz). Use this package to generate API clients in any language.
+> ⭐ **Star [1clawAI/agent-templates](https://github.com/1clawAI/agent-templates)** — ready-to-run agent templates wired to 1Claw. It is our single starred repo.
+
+OpenAPI 3.1.0 specification for the [1Claw Vault API](https://1claw.co). Use this package to generate API clients in any language.
 
 ## Install
 

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.58.0",
+    "version": "0.59.7",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
@@ -1409,6 +1409,10 @@
                     },
                     "passkey_count": {
                       "type": "integer"
+                    },
+                    "passkey_requirements_downgraded": {
+                      "type": "boolean",
+                      "description": "True while this account carries a passkey requirement\nthat the 1claw.xyz → 1claw.co move cleared on its\nbehalf. The two flags above read false, but that was\nnot the user's choice: registering a passkey on the\ncanonical domain restores them.\n"
                     }
                   }
                 }
@@ -6246,7 +6250,7 @@
           "Organization"
         ],
         "summary": "Provision MCP onboarding bundle",
-        "description": "Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.",
+        "description": "Creates welcome vault + sample secret, MCP agent, and a policy on the\nvault. Returns one-time API key and stdio MCP config.\n\nThe grant is `**` only when the welcome vault is newly created. If an\norg already has a vault named `default`, it is reused and the agent is\ngranted `examples/**` instead — enough to read the sample it is asked to\nverify with, without exposing secrets already kept there.\n\nSubject to `agent.create` control-plane consensus; see `approval_id`.\n",
         "operationId": "provisionOnboarding",
         "requestBody": {
           "required": false,
@@ -13721,7 +13725,7 @@
           "Authentication"
         ],
         "summary": "Verify email OTP and get JWT",
-        "description": "Verifies the 6-digit code sent to the user's email. If the user does not\nexist, a new account is created. Optionally auto-provisions treasury wallets\nfor the specified chains. Returns a JWT for subsequent API calls.\n",
+        "description": "Verifies the 6-digit code sent to the user's email. Optionally\nauto-provisions treasury wallets for the specified chains. Returns a JWT\nfor subsequent API calls.\n\nAn unrecognized address is rejected unless the request carries\n`platform_app_id` or sets `allow_signup`.\n",
         "operationId": "verifyEmailOtp",
         "security": [],
         "requestBody": {
@@ -13753,6 +13757,11 @@
                       "type": "string"
                     },
                     "description": "Chains to auto-generate wallets for (e.g. [\"ethereum\", \"base\"])"
+                  },
+                  "allow_signup": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Opt in to creating an account when the address is not\nrecognized. Without it an unknown address is rejected\nrather than silently given a new user and org — a valid\ncode proves control of an inbox, not consent to sign up.\nNot required when `platform_app_id` is present: creating\nthe end user on first login is the embedded-wallet flow.\n"
                   }
                 }
               }
@@ -23507,8 +23516,10 @@
               "solana",
               "xrp",
               "cardano",
-              "tron"
-            ]
+              "tron",
+              "midnight"
+            ],
+            "description": "`midnight` is Preprod-only and requires the midnight-signer\nsidecar. Note it can be provisioned but not rotated or\nimported: derivation happens in the sidecar, so there is no\nlocal keygen and no raw private key to import. Both of\nthose endpoints refuse it before consuming an approval.\n"
           }
         }
       },
@@ -24662,6 +24673,11 @@
           },
           "client": {
             "type": "string"
+          },
+          "approval_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Approval satisfying an `agent.create` control-plane consensus policy,\nif the org has one. Same field and meaning as on `POST /v1/agents`:\nthe first call returns 202 with the approval to collect, and the\nretry passes its id here.\n"
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: 0.58.0
+    version: "0.59.7"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -936,6 +936,14 @@ paths:
                                         type: boolean
                                     passkey_count:
                                         type: integer
+                                    passkey_requirements_downgraded:
+                                        type: boolean
+                                        description: |
+                                            True while this account carries a passkey requirement
+                                            that the 1claw.xyz → 1claw.co move cleared on its
+                                            behalf. The two flags above read false, but that was
+                                            not the user's choice: registering a passkey on the
+                                            canonical domain restores them.
         patch:
             tags: [Authentication]
             summary: Update user security settings
@@ -4036,7 +4044,16 @@ paths:
         post:
             tags: [Organization]
             summary: Provision MCP onboarding bundle
-            description: Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.
+            description: |
+                Creates welcome vault + sample secret, MCP agent, and a policy on the
+                vault. Returns one-time API key and stdio MCP config.
+
+                The grant is `**` only when the welcome vault is newly created. If an
+                org already has a vault named `default`, it is reused and the agent is
+                granted `examples/**` instead — enough to read the sample it is asked to
+                verify with, without exposing secrets already kept there.
+
+                Subject to `agent.create` control-plane consensus; see `approval_id`.
             operationId: provisionOnboarding
             requestBody:
                 required: false
@@ -8767,9 +8784,12 @@ paths:
             tags: [Authentication]
             summary: Verify email OTP and get JWT
             description: |
-                Verifies the 6-digit code sent to the user's email. If the user does not
-                exist, a new account is created. Optionally auto-provisions treasury wallets
-                for the specified chains. Returns a JWT for subsequent API calls.
+                Verifies the 6-digit code sent to the user's email. Optionally
+                auto-provisions treasury wallets for the specified chains. Returns a JWT
+                for subsequent API calls.
+
+                An unrecognized address is rejected unless the request carries
+                `platform_app_id` or sets `allow_signup`.
             operationId: verifyEmailOtp
             security: []
             requestBody:
@@ -8793,6 +8813,16 @@ paths:
                                     type: array
                                     items: { type: string }
                                     description: Chains to auto-generate wallets for (e.g. ["ethereum", "base"])
+                                allow_signup:
+                                    type: boolean
+                                    default: false
+                                    description: |
+                                        Opt in to creating an account when the address is not
+                                        recognized. Without it an unknown address is rejected
+                                        rather than silently given a new user and org — a valid
+                                        code proves control of an inbox, not consent to sign up.
+                                        Not required when `platform_app_id` is present: creating
+                                        the end user on first login is the embedded-wallet flow.
             responses:
                 "200":
                     description: Existing user authenticated
@@ -15288,7 +15318,13 @@ components:
             properties:
                 chain:
                     type: string
-                    enum: [ethereum, bitcoin, solana, xrp, cardano, tron]
+                    enum: [ethereum, bitcoin, solana, xrp, cardano, tron, midnight]
+                    description: |
+                        `midnight` is Preprod-only and requires the midnight-signer
+                        sidecar. Note it can be provisioned but not rotated or
+                        imported: derivation happens in the sidecar, so there is no
+                        local keygen and no raw private key to import. Both of
+                        those endpoints refuse it before consuming an approval.
 
         SigningKeyResponse:
             type: object
@@ -16124,6 +16160,14 @@ components:
                     type: string
                 client:
                     type: string
+                approval_id:
+                    type: string
+                    format: uuid
+                    description: |
+                        Approval satisfying an `agent.create` control-plane consensus policy,
+                        if the org has one. Same field and meaning as on `POST /v1/agents`:
+                        the first call returns 202 with the approval to collect, and the
+                        retry passes its id here.
 
         OnboardingProvisionResponse:
             type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.59.5",
+  "version": "0.59.7",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {