@1claw/openapi-spec 0.59.7 → 0.59.8

package/openapi.json

@@ -2,28 +2,36 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.59.7",
-    "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
+    "version": "0.59.8",
+    "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.xyz"
     }
   },
   "servers": [
     {
-      "url": "http://localhost:8443",
-      "description": "Development"
+      "url": "https://api.1claw.co",
+      "description": "Production (canonical)"
+    },
+    {
+      "url": "https://shroud.1claw.co",
+      "description": "Shroud TEE Proxy (Intents API + LLM proxy)"
     },
     {
       "url": "https://api.1claw.xyz",
-      "description": "Production"
+      "description": "Production (legacy domain; still answers, tokens minted before the move carry this issuer)"
     },
     {
       "url": "https://shroud.1claw.xyz",
-      "description": "Shroud TEE Proxy (Intents API + LLM proxy)"
+      "description": "Shroud TEE Proxy (legacy domain)"
+    },
+    {
+      "url": "http://localhost:8443",
+      "description": "Development"
     }
   ],
   "x-agentcash-guidance": {
-    "llmsTxtUrl": "https://1claw.xyz/llms.txt"
+    "llmsTxtUrl": "https://1claw.co/llms.txt"
   },
   "security": [
     {
@@ -27171,6 +27179,11 @@
             "type": "boolean",
             "default": false,
             "description": "When true, creates a sub-org under the platform app's org"
+          },
+          "app_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Required only when calling as a user (the dashboard wizard).\nA `plt_` key carries its app in the credential; a user does not,\nso the app is named here and checked against the caller's org.\n"
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.59.7"
+    version: "0.59.8"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -10,21 +10,41 @@ info:
         webhook tokens, event triggers, Assist), cloud runtimes with
         interactive shell sessions, agent memory, and discovery.
 
+        ## Domains
+
+        `api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API
+        mints, and the first entry in `servers` — a generated client takes its
+        base URL from there, and the previous ordering pointed every SDK at the
+        domain the issuer had already left. `api.1claw.xyz` still answers and is
+        still accepted on token validation, because tokens minted before the
+        move carry it; it is never minted now.
+
+        One deliberate exception: the Shroud attestation identity token is
+        requested from GCP with `audience: https://api.1claw.xyz`, so
+        `/v1/shroud/attestation` reports that as its `expected_audience`. That
+        is accurate rather than stale — the audience is a verification contract
+        with anyone already checking the token, and moving it is a breaking
+        change for them, not a rename.
+
         All endpoints require JWT Bearer authentication unless marked with
         `security: []`.
     contact:
         email: ops@1claw.xyz
 
 servers:
-    - url: http://localhost:8443
-      description: Development
+    - url: https://api.1claw.co
+      description: Production (canonical)
+    - url: https://shroud.1claw.co
+      description: Shroud TEE Proxy (Intents API + LLM proxy)
     - url: https://api.1claw.xyz
-      description: Production
+      description: Production (legacy domain; still answers, tokens minted before the move carry this issuer)
     - url: https://shroud.1claw.xyz
-      description: Shroud TEE Proxy (Intents API + LLM proxy)
+      description: Shroud TEE Proxy (legacy domain)
+    - url: http://localhost:8443
+      description: Development
 
 x-agentcash-guidance:
-    llmsTxtUrl: https://1claw.xyz/llms.txt
+    llmsTxtUrl: https://1claw.co/llms.txt
 
 security:
     - BearerAuth: []
@@ -17892,6 +17912,13 @@ components:
                     type: boolean
                     default: false
                     description: When true, creates a sub-org under the platform app's org
+                app_id:
+                    type: string
+                    format: uuid
+                    description: |
+                        Required only when calling as a user (the dashboard wizard).
+                        A `plt_` key carries its app in the credential; a user does not,
+                        so the app is named here and checked against the caller's org.
 
         PlatformUserResponse:
             type: object

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.59.7",
-  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
+  "version": "0.59.8",
+  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {
     "type": "git",