@1claw/openapi-spec 0.59.6 → 0.59.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/openapi.json +40 -11
  2. package/openapi.yaml +82 -11
  3. package/package.json +2 -2
package/openapi.json CHANGED
@@ -2,28 +2,36 @@
2
2
  "openapi": "3.1.0",
3
3
  "info": {
4
4
  "title": "1Claw API",
5
- "version": "0.58.0",
6
- "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
5
+ "version": "0.59.8",
6
+ "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
7
7
  "contact": {
8
8
  "email": "ops@1claw.xyz"
9
9
  }
10
10
  },
11
11
  "servers": [
12
12
  {
13
- "url": "http://localhost:8443",
14
- "description": "Development"
13
+ "url": "https://api.1claw.co",
14
+ "description": "Production (canonical)"
15
+ },
16
+ {
17
+ "url": "https://shroud.1claw.co",
18
+ "description": "Shroud TEE Proxy (Intents API + LLM proxy)"
15
19
  },
16
20
  {
17
21
  "url": "https://api.1claw.xyz",
18
- "description": "Production"
22
+ "description": "Production (legacy domain; still answers, tokens minted before the move carry this issuer)"
19
23
  },
20
24
  {
21
25
  "url": "https://shroud.1claw.xyz",
22
- "description": "Shroud TEE Proxy (Intents API + LLM proxy)"
26
+ "description": "Shroud TEE Proxy (legacy domain)"
27
+ },
28
+ {
29
+ "url": "http://localhost:8443",
30
+ "description": "Development"
23
31
  }
24
32
  ],
25
33
  "x-agentcash-guidance": {
26
- "llmsTxtUrl": "https://1claw.xyz/llms.txt"
34
+ "llmsTxtUrl": "https://1claw.co/llms.txt"
27
35
  },
28
36
  "security": [
29
37
  {
@@ -1409,6 +1417,10 @@
1409
1417
  },
1410
1418
  "passkey_count": {
1411
1419
  "type": "integer"
1420
+ },
1421
+ "passkey_requirements_downgraded": {
1422
+ "type": "boolean",
1423
+ "description": "True while this account carries a passkey requirement\nthat the 1claw.xyz → 1claw.co move cleared on its\nbehalf. The two flags above read false, but that was\nnot the user's choice: registering a passkey on the\ncanonical domain restores them.\n"
1412
1424
  }
1413
1425
  }
1414
1426
  }
@@ -6246,7 +6258,7 @@
6246
6258
  "Organization"
6247
6259
  ],
6248
6260
  "summary": "Provision MCP onboarding bundle",
6249
- "description": "Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.",
6261
+ "description": "Creates welcome vault + sample secret, MCP agent, and a policy on the\nvault. Returns one-time API key and stdio MCP config.\n\nThe grant is `**` only when the welcome vault is newly created. If an\norg already has a vault named `default`, it is reused and the agent is\ngranted `examples/**` instead — enough to read the sample it is asked to\nverify with, without exposing secrets already kept there.\n\nSubject to `agent.create` control-plane consensus; see `approval_id`.\n",
6250
6262
  "operationId": "provisionOnboarding",
6251
6263
  "requestBody": {
6252
6264
  "required": false,
@@ -13721,7 +13733,7 @@
13721
13733
  "Authentication"
13722
13734
  ],
13723
13735
  "summary": "Verify email OTP and get JWT",
13724
- "description": "Verifies the 6-digit code sent to the user's email. If the user does not\nexist, a new account is created. Optionally auto-provisions treasury wallets\nfor the specified chains. Returns a JWT for subsequent API calls.\n",
13736
+ "description": "Verifies the 6-digit code sent to the user's email. Optionally\nauto-provisions treasury wallets for the specified chains. Returns a JWT\nfor subsequent API calls.\n\nAn unrecognized address is rejected unless the request carries\n`platform_app_id` or sets `allow_signup`.\n",
13725
13737
  "operationId": "verifyEmailOtp",
13726
13738
  "security": [],
13727
13739
  "requestBody": {
@@ -13753,6 +13765,11 @@
13753
13765
  "type": "string"
13754
13766
  },
13755
13767
  "description": "Chains to auto-generate wallets for (e.g. [\"ethereum\", \"base\"])"
13768
+ },
13769
+ "allow_signup": {
13770
+ "type": "boolean",
13771
+ "default": false,
13772
+ "description": "Opt in to creating an account when the address is not\nrecognized. Without it an unknown address is rejected\nrather than silently given a new user and org — a valid\ncode proves control of an inbox, not consent to sign up.\nNot required when `platform_app_id` is present: creating\nthe end user on first login is the embedded-wallet flow.\n"
13756
13773
  }
13757
13774
  }
13758
13775
  }
@@ -23507,8 +23524,10 @@
23507
23524
  "solana",
23508
23525
  "xrp",
23509
23526
  "cardano",
23510
- "tron"
23511
- ]
23527
+ "tron",
23528
+ "midnight"
23529
+ ],
23530
+ "description": "`midnight` is Preprod-only and requires the midnight-signer\nsidecar. Note it can be provisioned but not rotated or\nimported: derivation happens in the sidecar, so there is no\nlocal keygen and no raw private key to import. Both of\nthose endpoints refuse it before consuming an approval.\n"
23512
23531
  }
23513
23532
  }
23514
23533
  },
@@ -24662,6 +24681,11 @@
24662
24681
  },
24663
24682
  "client": {
24664
24683
  "type": "string"
24684
+ },
24685
+ "approval_id": {
24686
+ "type": "string",
24687
+ "format": "uuid",
24688
+ "description": "Approval satisfying an `agent.create` control-plane consensus policy,\nif the org has one. Same field and meaning as on `POST /v1/agents`:\nthe first call returns 202 with the approval to collect, and the\nretry passes its id here.\n"
24665
24689
  }
24666
24690
  }
24667
24691
  },
@@ -27155,6 +27179,11 @@
27155
27179
  "type": "boolean",
27156
27180
  "default": false,
27157
27181
  "description": "When true, creates a sub-org under the platform app's org"
27182
+ },
27183
+ "app_id": {
27184
+ "type": "string",
27185
+ "format": "uuid",
27186
+ "description": "Required only when calling as a user (the dashboard wizard).\nA `plt_` key carries its app in the credential; a user does not,\nso the app is named here and checked against the caller's org.\n"
27158
27187
  }
27159
27188
  }
27160
27189
  },
package/openapi.yaml CHANGED
@@ -2,7 +2,7 @@ openapi: 3.1.0
2
2
 
3
3
  info:
4
4
  title: 1Claw API
5
- version: 0.58.0
5
+ version: "0.59.8"
6
6
  description: |
7
7
  Secure secret management for AI agents. Provides vaults, secrets,
8
8
  policy-based access control, agent identity, Intents API,
@@ -10,21 +10,41 @@ info:
10
10
  webhook tokens, event triggers, Assist), cloud runtimes with
11
11
  interactive shell sessions, agent memory, and discovery.
12
12
 
13
+ ## Domains
14
+
15
+ `api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API
16
+ mints, and the first entry in `servers` — a generated client takes its
17
+ base URL from there, and the previous ordering pointed every SDK at the
18
+ domain the issuer had already left. `api.1claw.xyz` still answers and is
19
+ still accepted on token validation, because tokens minted before the
20
+ move carry it; it is never minted now.
21
+
22
+ One deliberate exception: the Shroud attestation identity token is
23
+ requested from GCP with `audience: https://api.1claw.xyz`, so
24
+ `/v1/shroud/attestation` reports that as its `expected_audience`. That
25
+ is accurate rather than stale — the audience is a verification contract
26
+ with anyone already checking the token, and moving it is a breaking
27
+ change for them, not a rename.
28
+
13
29
  All endpoints require JWT Bearer authentication unless marked with
14
30
  `security: []`.
15
31
  contact:
16
32
  email: ops@1claw.xyz
17
33
 
18
34
  servers:
19
- - url: http://localhost:8443
20
- description: Development
35
+ - url: https://api.1claw.co
36
+ description: Production (canonical)
37
+ - url: https://shroud.1claw.co
38
+ description: Shroud TEE Proxy (Intents API + LLM proxy)
21
39
  - url: https://api.1claw.xyz
22
- description: Production
40
+ description: Production (legacy domain; still answers, tokens minted before the move carry this issuer)
23
41
  - url: https://shroud.1claw.xyz
24
- description: Shroud TEE Proxy (Intents API + LLM proxy)
42
+ description: Shroud TEE Proxy (legacy domain)
43
+ - url: http://localhost:8443
44
+ description: Development
25
45
 
26
46
  x-agentcash-guidance:
27
- llmsTxtUrl: https://1claw.xyz/llms.txt
47
+ llmsTxtUrl: https://1claw.co/llms.txt
28
48
 
29
49
  security:
30
50
  - BearerAuth: []
@@ -936,6 +956,14 @@ paths:
936
956
  type: boolean
937
957
  passkey_count:
938
958
  type: integer
959
+ passkey_requirements_downgraded:
960
+ type: boolean
961
+ description: |
962
+ True while this account carries a passkey requirement
963
+ that the 1claw.xyz → 1claw.co move cleared on its
964
+ behalf. The two flags above read false, but that was
965
+ not the user's choice: registering a passkey on the
966
+ canonical domain restores them.
939
967
  patch:
940
968
  tags: [Authentication]
941
969
  summary: Update user security settings
@@ -4036,7 +4064,16 @@ paths:
4036
4064
  post:
4037
4065
  tags: [Organization]
4038
4066
  summary: Provision MCP onboarding bundle
4039
- description: Creates welcome vault + sample secret, MCP agent, and default ** policy. Returns one-time API key and stdio MCP config.
4067
+ description: |
4068
+ Creates welcome vault + sample secret, MCP agent, and a policy on the
4069
+ vault. Returns one-time API key and stdio MCP config.
4070
+
4071
+ The grant is `**` only when the welcome vault is newly created. If an
4072
+ org already has a vault named `default`, it is reused and the agent is
4073
+ granted `examples/**` instead — enough to read the sample it is asked to
4074
+ verify with, without exposing secrets already kept there.
4075
+
4076
+ Subject to `agent.create` control-plane consensus; see `approval_id`.
4040
4077
  operationId: provisionOnboarding
4041
4078
  requestBody:
4042
4079
  required: false
@@ -8767,9 +8804,12 @@ paths:
8767
8804
  tags: [Authentication]
8768
8805
  summary: Verify email OTP and get JWT
8769
8806
  description: |
8770
- Verifies the 6-digit code sent to the user's email. If the user does not
8771
- exist, a new account is created. Optionally auto-provisions treasury wallets
8772
- for the specified chains. Returns a JWT for subsequent API calls.
8807
+ Verifies the 6-digit code sent to the user's email. Optionally
8808
+ auto-provisions treasury wallets for the specified chains. Returns a JWT
8809
+ for subsequent API calls.
8810
+
8811
+ An unrecognized address is rejected unless the request carries
8812
+ `platform_app_id` or sets `allow_signup`.
8773
8813
  operationId: verifyEmailOtp
8774
8814
  security: []
8775
8815
  requestBody:
@@ -8793,6 +8833,16 @@ paths:
8793
8833
  type: array
8794
8834
  items: { type: string }
8795
8835
  description: Chains to auto-generate wallets for (e.g. ["ethereum", "base"])
8836
+ allow_signup:
8837
+ type: boolean
8838
+ default: false
8839
+ description: |
8840
+ Opt in to creating an account when the address is not
8841
+ recognized. Without it an unknown address is rejected
8842
+ rather than silently given a new user and org — a valid
8843
+ code proves control of an inbox, not consent to sign up.
8844
+ Not required when `platform_app_id` is present: creating
8845
+ the end user on first login is the embedded-wallet flow.
8796
8846
  responses:
8797
8847
  "200":
8798
8848
  description: Existing user authenticated
@@ -15288,7 +15338,13 @@ components:
15288
15338
  properties:
15289
15339
  chain:
15290
15340
  type: string
15291
- enum: [ethereum, bitcoin, solana, xrp, cardano, tron]
15341
+ enum: [ethereum, bitcoin, solana, xrp, cardano, tron, midnight]
15342
+ description: |
15343
+ `midnight` is Preprod-only and requires the midnight-signer
15344
+ sidecar. Note it can be provisioned but not rotated or
15345
+ imported: derivation happens in the sidecar, so there is no
15346
+ local keygen and no raw private key to import. Both of
15347
+ those endpoints refuse it before consuming an approval.
15292
15348
 
15293
15349
  SigningKeyResponse:
15294
15350
  type: object
@@ -16124,6 +16180,14 @@ components:
16124
16180
  type: string
16125
16181
  client:
16126
16182
  type: string
16183
+ approval_id:
16184
+ type: string
16185
+ format: uuid
16186
+ description: |
16187
+ Approval satisfying an `agent.create` control-plane consensus policy,
16188
+ if the org has one. Same field and meaning as on `POST /v1/agents`:
16189
+ the first call returns 202 with the approval to collect, and the
16190
+ retry passes its id here.
16127
16191
 
16128
16192
  OnboardingProvisionResponse:
16129
16193
  type: object
@@ -17848,6 +17912,13 @@ components:
17848
17912
  type: boolean
17849
17913
  default: false
17850
17914
  description: When true, creates a sub-org under the platform app's org
17915
+ app_id:
17916
+ type: string
17917
+ format: uuid
17918
+ description: |
17919
+ Required only when calling as a user (the dashboard wizard).
17920
+ A `plt_` key carries its app in the credential; a user does not,
17921
+ so the app is named here and checked against the caller's org.
17851
17922
 
17852
17923
  PlatformUserResponse:
17853
17924
  type: object
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@1claw/openapi-spec",
3
- "version": "0.59.6",
4
- "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
3
+ "version": "0.59.8",
4
+ "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
5
5
  "license": "MIT",
6
6
  "repository": {
7
7
  "type": "git",