@1claw/openapi-spec 0.59.8 → 0.59.9

package/openapi.json

@@ -2,10 +2,10 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.59.8",
+    "version": "0.59.9",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
-      "email": "ops@1claw.xyz"
+      "email": "ops@1claw.co"
     }
   },
   "servers": [
@@ -12540,6 +12540,7 @@
           {
             "in": "query",
             "name": "agent_id",
+            "description": "Optional only while the connection has exactly one agent.\nWith more than one it becomes required and the call answers\n400 without it — the Fleet template provisions three.\n",
             "required": false,
             "schema": {
               "type": "string",
@@ -12802,8 +12803,9 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Begin passkey enrollment for a connected user",
-        "description": "Starts WebAuthn registration for the end-user on this connection.\nPlatform apps use this instead of `POST /v1/auth/passkeys/register/begin` (user JWT only).\n",
+        "summary": "Begin passkey enrollment for a connected user (always 403)",
+        "deprecated": true,
+        "description": "**This endpoint always returns 403 and cannot be made to work.**\nThe description here previously said platform apps should use it\ninstead of `POST /v1/auth/passkeys/register/begin`, which was\nwrong and cost integrators a WebAuthn ceremony to discover.\n\nA passkey enrolled this way is login-capable: it can be asserted\nthrough the public sign-in flow to mint a full, non-delegated\nuser session, so an app that enrolled one would hold a credential\nstronger than the delegation boundary it operates under. The\ncapability was removed for that reason and will not return.\n\n**A passkey is enrolled by the user, in their own session**, via\n`POST /v1/auth/passkeys/register/begin`. For a connected user\nthat means completing the claim flow on the connection first.\n\nTo *use* a passkey a connected user already has, see:\n  - `GET /v1/platform/connections/{connectionId}/passkeys` —\n    whether the confirm step can be offered at all.\n  - `POST /v1/platform/connections/{connectionId}/passkeys/tx-assert/begin`\n    and `.../complete` — ask that user to touch their\n    authenticator over a specific digest.\n",
         "operationId": "connectionPasskeyEnrollBegin",
         "security": [
           {
@@ -12821,30 +12823,147 @@
             }
           }
         ],
+        "responses": {
+          "403": {
+            "description": "Always. Platform apps cannot enroll login passkeys for\nconnected users.\n",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/passkeys/enroll/complete": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Complete passkey enrollment for a connected user (always 403)",
+        "deprecated": true,
+        "description": "**This endpoint always returns 403.** See\n`POST /v1/platform/connections/{connectionId}/passkeys/enroll/begin`\nfor why, and for the paths that do work.\n",
+        "operationId": "connectionPasskeyEnrollComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PasskeyRegisterCompleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "403": {
+            "description": "Always. Platform apps cannot enroll login passkeys for\nconnected users.\n",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/passkeys": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Whether a connected user can be asked for a passkey touch",
+        "description": "Answers one question: can this app offer the passkey confirm\nstep to this user? No credential material is returned — not\ncredential ids, not public keys, not enrolment times.\n\n`count` is what matters. Passkeys are bound to the domain they\nwere registered on, so an account can hold credentials that this\ndomain cannot offer; `count` reports only those usable on\n`rp_id`, while `registered_count` is the raw total. Branch on\n`has_passkey`.\n",
+        "operationId": "listConnectionPasskeys",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
         "responses": {
           "200": {
-            "description": "WebAuthn registration ceremony options",
+            "description": "Passkey availability for this connection",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PasskeyRegisterBeginResponse"
+                  "type": "object",
+                  "required": [
+                    "has_passkey",
+                    "count",
+                    "registered_count",
+                    "rp_id"
+                  ],
+                  "properties": {
+                    "has_passkey": {
+                      "type": "boolean",
+                      "description": "True when count > 0."
+                    },
+                    "count": {
+                      "type": "integer",
+                      "format": "int64",
+                      "description": "Passkeys usable on rp_id."
+                    },
+                    "registered_count": {
+                      "type": "integer",
+                      "format": "int64",
+                      "description": "All passkeys on the account, including any\nbound to a different domain.\n"
+                    },
+                    "rp_id": {
+                      "type": "string",
+                      "description": "The domain these counts are measured against."
+                    }
+                  }
                 }
               }
             }
           },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/NotFound"
           }
         }
       }
     },
-    "/v1/platform/connections/{connectionId}/passkeys/enroll/complete": {
+    "/v1/platform/connections/{connectionId}/passkeys/tx-assert/begin": {
       "post": {
         "tags": [
           "Platform"
         ],
-        "summary": "Complete passkey enrollment for a connected user",
-        "operationId": "connectionPasskeyEnrollComplete",
+        "summary": "Ask a connected user to touch their authenticator",
+        "description": "Begins a WebAuthn assertion bound to `tx_digest`, for the user on\nthis connection. The connection in the path is the addressing\nthat `POST /v1/auth/passkeys/tx-assert/begin` lacks: that route\nresolves the *calling* principal, so with a `plt_` key it looks\nup the app itself and reports no passkeys. An app never needs to\nhold an email to name one of its users.\n\nReturns 404 when the user has no passkey usable on this domain —\ncheck `GET /v1/platform/connections/{connectionId}/passkeys`\nfirst and only offer the step when `has_passkey` is true.\n",
+        "operationId": "connectionPasskeyTxAssertBegin",
         "security": [
           {
             "BearerAuth": []
@@ -12866,18 +12985,133 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PasskeyRegisterCompleteRequest"
+                "type": "object",
+                "required": [
+                  "tx_digest"
+                ],
+                "properties": {
+                  "tx_digest": {
+                    "type": "string",
+                    "description": "SHA-256 hex of the exact text being confirmed."
+                  },
+                  "action": {
+                    "type": "string",
+                    "enum": [
+                      "send",
+                      "swap"
+                    ],
+                    "default": "send"
+                  }
+                }
               }
             }
           }
         },
         "responses": {
-          "201": {
-            "description": "Passkey registered",
+          "200": {
+            "description": "WebAuthn assertion ceremony options",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeyAssertBeginResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "description": "This user has no passkey registered.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PasskeyRegisterCompleteResponse"
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connectionId}/passkeys/tx-assert/complete": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Verify the touch and return proof of it",
+        "description": "Verifies the assertion — origin, rpIdHash, the user-verified\nflag, the signature, and a sign count that must increase, which\nis what catches a cloned authenticator — and returns a\nshort-lived token proving this user touched their authenticator\nover that digest.\n\nThe token records that a platform app requested it. That\nprovenance is deliberate: it proves the touch to your\napplication, and it is **refused** as authorization for a\n1Claw treasury transfer. A user consenting to your action has\nnot consented to moving funds, and those remain a separate\nassertion from the user's own session.\n",
+        "operationId": "connectionPasskeyTxAssertComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "credential_id",
+                  "authenticator_data",
+                  "client_data_json",
+                  "signature"
+                ],
+                "properties": {
+                  "credential_id": {
+                    "type": "string"
+                  },
+                  "authenticator_data": {
+                    "type": "string"
+                  },
+                  "client_data_json": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Assertion verified",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "passkey_token",
+                    "expires_in"
+                  ],
+                  "properties": {
+                    "passkey_token": {
+                      "type": "string",
+                      "description": "Single-use proof of the touch, bound to the\ndigest and to this user.\n"
+                    },
+                    "expires_in": {
+                      "type": "integer",
+                      "description": "Seconds until the token expires."
+                    }
+                  }
                 }
               }
             }
@@ -12885,6 +13119,9 @@
           "400": {
             "$ref": "#/components/responses/BadRequest"
           },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/NotFound"
           }
@@ -19535,93 +19772,2592 @@
         }
       }
     },
-    "/v1/org/shamir-kek/setup": {
+    "/v1/agents/batch-delete": {
       "post": {
         "tags": [
-          "Shamir KEK"
+          "Agents"
         ],
-        "summary": "Set up Shamir KEK for the org",
-        "description": "Initialize a Shamir secret-sharing KEK for the org. Splits the master\nkey into shares distributed to custodians. Shares are returned one-time\nonly and must be stored securely by each custodian.\n",
-        "operationId": "setupShamirKek",
-        "security": [
-          {
-            "BearerAuth": []
+        "summary": "batch delete agents",
+        "operationId": "batch_delete_agents",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
           }
+        }
+      }
+    },
+    "/v1/agents/enroll/approve": {
+      "post": {
+        "tags": [
+          "Agents"
         ],
+        "summary": "Authenticated: consume token, create agent, return API key once.  **Email-bound pending:** caller must belong to the same org and match `human_email`.",
+        "operationId": "approve_enrollment",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/ShamirKekSetupRequest"
+                "type": "object",
+                "required": [
+                  "token"
+                ],
+                "properties": {
+                  "token": {
+                    "type": "string"
+                  },
+                  "approval_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Consensus approval to spend on this creation.\nApproving an enrollment creates an agent, so it is\ngated on `agent.create` exactly as POST /v1/agents\nis. Orgs without a control-plane consensus policy\nnever need this.\n"
+                  }
+                }
               }
             }
           }
         },
         "responses": {
-          "201": {
-            "description": "Shamir KEK configured (shares returned one-time)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ShamirKekSetupResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
+          "200": {
+            "description": "Success"
           },
           "401": {
-            "$ref": "#/components/responses/Unauthorized"
+            "description": "Unauthenticated"
           },
           "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "description": "Forbidden, the plan does not include this, or the org requires\nM-of-N consensus for `agent.create` and no approval was supplied.\n"
+          },
+          "404": {
+            "description": "Not found"
           }
         }
       }
     },
-    "/v1/org/shamir-kek": {
-      "get": {
+    "/v1/agents/enroll/deny": {
+      "post": {
         "tags": [
-          "Shamir KEK"
+          "Agents"
         ],
-        "summary": "Get Shamir KEK status",
-        "description": "Returns the current Shamir KEK configuration status for the org.",
-        "operationId": "getShamirKekStatus",
-        "security": [
-          {
-            "BearerAuth": []
+        "summary": "Authenticated: consume token and delete pending enrollment (deny).  **Email-bound:** caller org and email must match the pending row.  **Link-only:** ",
+        "operationId": "deny_enrollment",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "token"
+                ],
+                "properties": {
+                  "token": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/enroll/pending": {
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Public: validate enrollment token and return pending info for the dashboard (agent name, expires_at). Used so the UI can show 'Approve agent X?' witho",
+        "operationId": "get_enrollment_pending",
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/channels/{channel_id}/refresh-webhook": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "channel_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Re-register the provider webhook for this channel (repairs a stale or revoked subscription).",
+        "operationId": "refresh_channel_webhook",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/channels/{channel_id}/repair": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "channel_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Repair a channel: alias of refresh-webhook, re-registers the provider webhook for this channel.",
+        "operationId": "repair_channel_webhook",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/eoa": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Get the agent's EVM address (no private key exposure).",
+        "operationId": "get_agent_eoa",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Generate an EVM EOA for an agent. Creates a secp256k1 key, stores it in the __agent-keys vault, and records the derived address on the agent record.",
+        "operationId": "generate_agent_eoa",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/rotate-signer-key": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Rotate the agent's EVM signer key. Generates a new secp256k1 key, builds a swapOwner UserOp on the Safe, signs with the old key, submits to bundler, a",
+        "operationId": "rotate_signer_key",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/smart-accounts/{chain_id}": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "chain_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "delete": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "delete smart account",
+        "operationId": "delete_smart_account",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/unlock-platform": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "User-only. Clears platform_locked when the app is no longer actively connected.",
+        "operationId": "unlock_agent_platform",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/audit/export": {
+      "get": {
+        "tags": [
+          "Audit"
+        ],
+        "summary": "export audit events",
+        "operationId": "export_audit_events",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/credential-recovery/requests/{id}/cancel": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "cancel request",
+        "operationId": "cancel_request",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/migration-status": {
+      "get": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "What the account is currently anchored on, and what has to happen next.  The ordering is the part people get wrong, so it lives here rather than being",
+        "operationId": "migration_status",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/passkeys/vault-assert/begin": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Begin a passkey assertion that unlocks vault secret reads for users who have `require_passkey_for_vaults` enabled.",
+        "operationId": "vault_assert_begin",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/passkeys/vault-assert/complete": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Returns a short-lived `passkey_token` for the `X-Passkey-Token` header on secret reads.",
+        "operationId": "vault_assert_complete",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "credential_id",
+                  "authenticator_data",
+                  "client_data_json",
+                  "signature"
+                ],
+                "properties": {
+                  "credential_id": {
+                    "type": "string"
+                  },
+                  "authenticator_data": {
+                    "type": "string"
+                  },
+                  "client_data_json": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/reauth/begin": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "start a re-authentication ceremony. For passkey: returns a WebAuthn challenge. For password: returns immediately (no challenge needed).",
+        "operationId": "reauth_begin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "method"
+                ],
+                "properties": {
+                  "method": {
+                    "type": "string"
+                  },
+                  "purpose": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/reauth/complete": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "verify re-authentication and issue a single-use token.",
+        "operationId": "reauth_complete",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "method"
+                ],
+                "properties": {
+                  "method": {
+                    "type": "string"
+                  },
+                  "purpose": {
+                    "type": "string"
+                  },
+                  "password": {
+                    "type": "string"
+                  },
+                  "credential_id": {
+                    "type": "string"
+                  },
+                  "authenticator_data": {
+                    "type": "string"
+                  },
+                  "client_data_json": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/social/disconnect": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Sever every social identity link, so a social account that once owned this login can no longer reach it.  The case this exists for: someone leaves a c",
+        "operationId": "disconnect_social",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/sso/authorize": {
+      "get": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "returns JSON with authorization_url for WorkOS Hosted Auth.",
+        "operationId": "sso_authorize",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/sso/callback": {
+      "get": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "exchange code for profile, find/create user, redirect to dashboard with token.",
+        "operationId": "sso_callback",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/auth/sso/status": {
+      "get": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "returns whether SSO is configured (for dashboard to show/hide SSO button).",
+        "operationId": "sso_status",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/billing/llm-models": {
+      "get": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "get llm models",
+        "operationId": "get_llm_models",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/billing/llm-pricing": {
+      "get": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "get llm pricing",
+        "operationId": "get_llm_pricing",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/billing/promo/redeem": {
+      "get": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "get llm billing status",
+        "operationId": "get_llm_billing_status",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "redeem promo",
+        "operationId": "redeem_promo",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "code"
+                ],
+                "properties": {
+                  "code": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/billing/promo/validate": {
+      "get": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "validate promo",
+        "operationId": "validate_promo",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/chains/rpc": {
+      "post": {
+        "tags": [
+          "Chains"
+        ],
+        "summary": "Proxy a single JSON-RPC call to the chain's RPC URL. Only read-only methods in ALLOWED_RPC_METHODS are allowed (Treasury balances, Safe deployment, et",
+        "operationId": "chain_rpc_proxy",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "chain_id",
+                  "method",
+                  "params"
+                ],
+                "properties": {
+                  "chain_id": {
+                    "type": "integer"
+                  },
+                  "method": {
+                    "type": "string"
+                  },
+                  "params": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "additionalProperties": true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/fiat/webhooks": {
+      "post": {
+        "tags": [
+          "Fiat"
+        ],
+        "summary": "Receive completion events from fiat partners (MoonPay signed body or generic JSON).",
+        "operationId": "fiat_webhook",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/memory/shared-namespaces": {
+      "get": {
+        "tags": [
+          "Memory"
+        ],
+        "summary": "list shared namespaces",
+        "operationId": "list_shared_namespaces",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Memory"
+        ],
+        "summary": "create shared namespace",
+        "operationId": "create_shared_namespace",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "namespace",
+                  "agent_ids"
+                ],
+                "properties": {
+                  "namespace": {
+                    "type": "string"
+                  },
+                  "agent_ids": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "uuid"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/memory/shared-namespaces/{id}": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "delete": {
+        "tags": [
+          "Memory"
+        ],
+        "summary": "delete shared namespace",
+        "operationId": "delete_shared_namespace",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Memory"
+        ],
+        "summary": "update shared namespace",
+        "operationId": "update_shared_namespace",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "agent_ids"
+                ],
+                "properties": {
+                  "agent_ids": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "uuid"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/onboarding/journey": {
+      "post": {
+        "tags": [
+          "Onboarding"
+        ],
+        "summary": "record which path a user chose.  The dashboard already had `track()` calls for the wizard, but they POST to a dashboard route that does not exist, so ",
+        "operationId": "record_journey",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "journey"
+                ],
+                "properties": {
+                  "journey": {
+                    "type": "string"
+                  },
+                  "step": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/org/env-vars/{id}/delete": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "delete org env var",
+        "operationId": "delete_org_env_var",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/org/kek-custody": {
+      "get": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "Get current custody mode and share metadata",
+        "operationId": "get_custody",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "Setup Shamir key custody",
+        "operationId": "setup_custody",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "custody_mode"
+                ],
+                "properties": {
+                  "custody_mode": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/org/kek-custody/reconstruct": {
+      "get": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "list org env vars",
+        "operationId": "list_org_env_vars",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "TEE-bound reconstruction request",
+        "operationId": "reconstruct",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "approval_id",
+                  "action"
+                ],
+                "properties": {
+                  "approval_id": {
+                    "type": "object"
+                  },
+                  "client_share": {
+                    "type": "string"
+                  },
+                  "action": {
+                    "type": "object",
+                    "additionalProperties": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/org/settings": {
+      "get": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "list org settings",
+        "operationId": "list_org_settings",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Org"
+        ],
+        "summary": "update org setting",
+        "operationId": "update_org_setting",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key",
+                  "value"
+                ],
+                "properties": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string"
+                  },
+                  "approval_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/by-slug/{slug}/branding": {
+      "parameters": [
+        {
+          "name": "slug",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Public, returns app name + logo.",
+        "operationId": "app_branding",
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/{app_id}/automations": {
+      "parameters": [
+        {
+          "name": "app_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "list platform automations",
+        "operationId": "list_platform_automations",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "upsert user",
+        "operationId": "upsert_user",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "subject_token": {
+                    "type": "string"
+                  },
+                  "subject_token_type": {
+                    "type": "string"
+                  },
+                  "email": {
+                    "type": "string"
+                  },
+                  "display_name": {
+                    "type": "string"
+                  },
+                  "siwe_message": {
+                    "type": "string"
+                  },
+                  "siwe_signature": {
+                    "type": "string"
+                  },
+                  "return_to": {
+                    "type": "string"
+                  },
+                  "create_sub_org": {
+                    "type": "boolean"
+                  },
+                  "app_id": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connected-apps/{connection_id}/unlock-resources": {
+      "parameters": [
+        {
+          "name": "connection_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Unlocks platform-locked resources for a disconnected (or active) connection the user owns.",
+        "operationId": "unlock_connection_resources",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connection_id}/memory": {
+      "parameters": [
+        {
+          "name": "connection_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "list connection memory namespaces",
+        "operationId": "list_connection_memory_namespaces",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connection_id}/memory/{namespace}": {
+      "parameters": [
+        {
+          "name": "connection_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "namespace",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "list connection memory entries",
+        "operationId": "list_connection_memory_entries",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/connections/{connection_id}/resources": {
+      "parameters": [
+        {
+          "name": "connection_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "list connection resources",
+        "operationId": "list_connection_resources",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "create app policy",
+        "operationId": "create_app_policy",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "user_id": {
+                    "type": "object"
+                  },
+                  "to_allowlist": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "to_denylist": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "max_value_per_tx_eth": {
+                    "type": "string"
+                  },
+                  "daily_limit_eth": {
+                    "type": "string"
+                  },
+                  "allowed_chains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "allowed_tokens": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "max_transactions_per_day": {
+                    "type": "integer"
+                  },
+                  "human_factor_auth": {
+                    "type": "object",
+                    "additionalProperties": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/link-account": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Authenticated user links their account to a platform app. Used by the dashboard `/connect/{slug}/link` consent flow for cross-org users.",
+        "operationId": "link_account",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "client_id"
+                ],
+                "properties": {
+                  "client_id": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/platform/orphaned-resources": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "platform-locked agents/vaults with no active connection.",
+        "operationId": "list_orphaned_platform_resources",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/reports/request": {
+      "post": {
+        "tags": [
+          "Reports"
+        ],
+        "summary": "Public (no auth). Submits lead info, sends email with download link.",
+        "operationId": "request_report",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "first_name",
+                  "last_name",
+                  "email",
+                  "company"
+                ],
+                "properties": {
+                  "first_name": {
+                    "type": "string"
+                  },
+                  "last_name": {
+                    "type": "string"
+                  },
+                  "email": {
+                    "type": "string"
+                  },
+                  "company": {
+                    "type": "string"
+                  },
+                  "job_title": {
+                    "type": "string"
+                  },
+                  "report_slug": {
+                    "type": "string"
+                  },
+                  "marketing_consent": {
+                    "type": "boolean"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/chat/conversations": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "list runtime chat conversations",
+        "operationId": "list_runtime_chat_conversations",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/chat/conversations/{conversation_id}": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "conversation_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "delete": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Archives a runtime chat session so the next message starts a fresh conversation.",
+        "operationId": "archive_runtime_chat_conversation",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "get runtime chat conversation",
+        "operationId": "get_runtime_chat_conversation",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/chat/diagnostics": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Human-only snapshot of chat auth wiring: which platform env vars Vault will inject on the next Start and which upstream URL chat proxies to.",
+        "operationId": "runtime_chat_diagnostics",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/chat/unlock": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Step-up (password or passkey reauth token, purpose=`runtime_chat`) unlocks dashboard runtime chat for 15 minutes — same trust bar as Shell/Logs.",
+        "operationId": "unlock_runtime_chat",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/logs/stream": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "SSE live log streaming",
+        "operationId": "stream_runtime_logs",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/logs/unlock": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Step-up (password or passkey reauth token) unlocks log fetch/stream for 15 minutes.",
+        "operationId": "unlock_runtime_logs",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/rebuild": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Phase 1: invalidate the cached image tag and return the runtime to `stopped`. Next `start` re-pulls the image; for `source_repo` runtimes the entrypoi",
+        "operationId": "rebuild_runtime",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/restart": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "Force stop (best-effort) then start. Recovers stale `running` rows and proxy timeouts where the client never received the start response.",
+        "operationId": "restart_runtime",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/vaults/{vault_id}/secret-version-disable/{*path_and_version}": {
+      "parameters": [
+        {
+          "name": "vault_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Vaults"
+        ],
+        "summary": "Disable a specific version so it can no longer be read (but is retained for audit).",
+        "operationId": "disable_version",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/vaults/{vault_id}/secret-version/{*path_and_version}": {
+      "parameters": [
+        {
+          "name": "vault_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Vaults"
+        ],
+        "summary": "get secret version",
+        "operationId": "get_secret_version",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/vaults/{vault_id}/unlock-platform": {
+      "parameters": [
+        {
+          "name": "vault_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Vaults"
+        ],
+        "summary": "unlock vault platform",
+        "operationId": "unlock_vault_platform",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden, or the plan does not include this"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/webinars/register": {
+      "post": {
+        "tags": [
+          "Webinars"
+        ],
+        "summary": "Public (no auth). Registers for a webinar, sends confirmation + calendar invite.",
+        "operationId": "register_webinar",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "first_name",
+                  "last_name",
+                  "email",
+                  "company"
+                ],
+                "properties": {
+                  "first_name": {
+                    "type": "string"
+                  },
+                  "last_name": {
+                    "type": "string"
+                  },
+                  "email": {
+                    "type": "string"
+                  },
+                  "company": {
+                    "type": "string"
+                  },
+                  "job_title": {
+                    "type": "string"
+                  },
+                  "webinar_slug": {
+                    "type": "string"
+                  },
+                  "marketing_consent": {
+                    "type": "boolean"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/templates": {
+      "get": {
+        "tags": [
+          "Runtimes"
+        ],
+        "summary": "The provisionable runtime templates, with licence and whether the agent needs its own vendor account",
+        "operationId": "list_runtime_templates",
+        "responses": {
+          "200": {
+            "description": "The template catalogue",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "templates": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "id": {
+                            "type": "string"
+                          },
+                          "description": {
+                            "type": "string"
+                          },
+                          "chat_capable": {
+                            "type": "boolean"
+                          },
+                          "license": {
+                            "type": "string",
+                            "nullable": true,
+                            "description": "SPDX id, or null when the agent is proprietary"
+                          },
+                          "requires_vendor_subscription": {
+                            "type": "boolean",
+                            "description": "Whether the agent needs a paid account with its vendor. Independent of licence — the Codex CLI is Apache-2.0 and still requires a ChatGPT plan."
+                          },
+                          "vendor_credential_env": {
+                            "type": "string",
+                            "nullable": true
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthenticated"
+          }
+        }
+      }
+    },
+    "/v1/automations/step-types": {
+      "get": {
+        "tags": [
+          "Automations"
+        ],
+        "summary": "The automation step vocabulary an automation may use",
+        "operationId": "list_automation_step_types",
+        "responses": {
+          "200": {
+            "description": "Supported step types"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          }
+        }
+      }
+    },
+    "/v1/platform/apps/{app_id}/runtimes": {
+      "parameters": [
+        {
+          "name": "app_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Runtimes belonging to a platform app",
+        "operationId": "list_platform_runtimes",
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/browser/devices": {
+      "post": {
+        "tags": [
+          "Browser Bridge"
+        ],
+        "summary": "Pair a browser bridge and mint its credential. Human callers only, behind a step-up re-auth: pairing is what gives a browser the standing to ask for credentials later.",
+        "operationId": "pair_browser_device",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "label",
+                  "public_key_pin"
+                ],
+                "properties": {
+                  "label": {
+                    "type": "string",
+                    "description": "Name for this device. Re-pairing an existing label must present the same key."
+                  },
+                  "public_key_pin": {
+                    "type": "string",
+                    "description": "The bridge's public key, pinned on first use for this label."
+                  },
+                  "bridge_version": {
+                    "type": "string"
+                  },
+                  "platform": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Paired. The credential is returned once and there is no endpoint that returns it again.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "device_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "label": {
+                      "type": "string"
+                    },
+                    "credential": {
+                      "type": "string",
+                      "description": "The bb_ bridge credential. Shown once."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthenticated, or step-up re-auth not satisfied"
+          },
+          "403": {
+            "description": "Not a human caller — agents and platform keys cannot pair a device"
+          },
+          "409": {
+            "description": "That label is already pinned to a different key"
+          }
+        }
+      }
+    },
+    "/v1/browser/credentials": {
+      "post": {
+        "tags": [
+          "Browser Bridge"
+        ],
+        "summary": "Define a binding: which secret may be typed, and into which hosts. Humans only, behind a step-up — an agent that could create one could nominate any path it liked as fillable.",
+        "operationId": "create_browser_credential",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "label",
+                  "vault_id",
+                  "secret_path",
+                  "login_url",
+                  "allowed_hosts"
+                ],
+                "properties": {
+                  "label": {
+                    "type": "string"
+                  },
+                  "vault_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Must belong to the caller's org."
+                  },
+                  "secret_path": {
+                    "type": "string",
+                    "description": "Path of the secret inside that vault. The value never lands in the binding."
+                  },
+                  "login_url": {
+                    "type": "string",
+                    "description": "https only, and its host must be in allowed_hosts or sso_hosts — the bridge navigates here itself, one step before a password is typed."
+                  },
+                  "allowed_hosts": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Bare hostnames, compared exactly. URLs, ports and wildcards are refused: a wildcard would match nothing while looking like it allowed something."
+                  },
+                  "sso_hosts": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Identity-provider hosts the login legitimately bounces through."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Created. Every field is a pointer or a policy; none is secret."
+          },
+          "400": {
+            "description": "A host is not a bare hostname, allowed_hosts is empty, or login_url is http or outside the allowlist"
+          },
+          "403": {
+            "description": "Not a human caller, step-up not satisfied, or the vault belongs to another org"
+          },
+          "404": {
+            "description": "Vault not found"
           }
+        }
+      },
+      "get": {
+        "tags": [
+          "Browser Bridge"
         ],
+        "summary": "List this org's browser credential bindings",
+        "operationId": "list_browser_credentials",
         "responses": {
           "200": {
-            "description": "Shamir KEK status",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ShamirKekStatusResponse"
-                }
-              }
-            }
+            "description": "The bindings"
+          }
+        }
+      }
+    },
+    "/v1/browser/credentials/{id}": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "delete": {
+        "tags": [
+          "Browser Bridge"
+        ],
+        "summary": "Remove a browser credential binding",
+        "operationId": "delete_browser_credential",
+        "responses": {
+          "204": {
+            "description": "Deleted"
           },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
+          "403": {
+            "description": "Not a human caller"
+          },
+          "404": {
+            "description": "Binding not found"
           }
         }
       }
     },
-    "/v1/org/shamir-kek/reconstruct": {
+    "/v1/agents/{id}/browser/sessions": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
       "post": {
         "tags": [
-          "Shamir KEK"
+          "Browser Bridge"
         ],
-        "summary": "Reconstruct KEK from shares",
-        "description": "Submit Shamir shares to reconstruct the org KEK. Requires at least\n`threshold` valid shares. Used during disaster recovery.\n",
-        "operationId": "reconstructShamirKek",
-        "security": [
+        "summary": "Open a browser session. Accepts a paired bridge credential only — an agent token is refused, so a session cannot be bootstrapped on an unpaired machine.",
+        "operationId": "create_browser_session",
+        "parameters": [
           {
-            "BearerAuth": []
+            "name": "x-1claw-bridge-credential",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "The bb_ credential from `1claw browser-bridge login`"
+          },
+          {
+            "name": "x-1claw-bridge-version",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Bridge build. Versions below the server minimum are refused."
           }
         ],
         "requestBody": {
@@ -19629,81 +22365,245 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/ShamirKekReconstructRequest"
+                "type": "object",
+                "required": [
+                  "agent_id",
+                  "client_id"
+                ],
+                "properties": {
+                  "agent_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Must belong to the same org as the paired device."
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "bridge_version": {
+                    "type": "string"
+                  },
+                  "protocol_version": {
+                    "type": "string"
+                  }
+                }
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Reconstruction result",
+            "description": "Session created",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ShamirKekReconstructResponse"
+                  "type": "object",
+                  "properties": {
+                    "session_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "session_token": {
+                      "type": "string",
+                      "description": "bs_ prefixed. Only its hash is stored."
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    }
+                  }
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "description": "Missing or unsupported bridge version"
           },
           "401": {
-            "$ref": "#/components/responses/Unauthorized"
+            "description": "Not a paired bridge, or an agent token was presented"
           },
           "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "description": "The device and the agent are not in the same org"
           }
         }
       }
     },
-    "/v1/org/shamir-kek/recovery-codes": {
-      "get": {
+    "/v1/agents/{id}/browser/fills": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
         "tags": [
-          "Shamir KEK"
+          "Browser Bridge"
         ],
-        "summary": "Get Shamir recovery codes (one-time)",
-        "description": "Returns the one-time recovery codes for the Shamir KEK. These codes\ncan be used as an emergency fallback if custodian shares are lost.\nCodes are only returned once — subsequent calls return 410.\n",
-        "operationId": "getShamirKekRecoveryCodes",
-        "security": [
+        "summary": "Authorise one credential fill. Requires the bridge credential *and* an agent JWT — neither alone is sufficient.",
+        "operationId": "authorize_browser_fill",
+        "parameters": [
           {
-            "BearerAuth": []
+            "name": "x-1claw-bridge-credential",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "x-1claw-bridge-version",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "session_id",
+                  "binding_id",
+                  "tab_origin",
+                  "frame_origin",
+                  "frame_id",
+                  "generation"
+                ],
+                "properties": {
+                  "session_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Must match the session the presented bs_ token opened."
+                  },
+                  "binding_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "frame_id": {
+                    "type": "string",
+                    "description": "The target the fill is for. Recorded on the grant."
+                  },
+                  "generation": {
+                    "type": "integer",
+                    "format": "int64",
+                    "description": "The bridge's navigation counter. Compared again at consume: a navigation in between means the page decided about is no longer the page in front of the bridge."
+                  },
+                  "form_action_origin": {
+                    "type": "string",
+                    "description": "Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host."
+                  },
+                  "tab_origin": {
+                    "type": "string",
+                    "description": "Origin of the tab being driven. Checked against the binding's allowed and sso hosts by exact host match."
+                  },
+                  "frame_origin": {
+                    "type": "string",
+                    "description": "Origin of the frame holding the form. Checked separately — a credential typed into an allowed tab can still land in an attacker's iframe."
+                  }
+                }
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "Recovery codes (one-time)",
+            "description": "A grant, a denial, or a pending approval. Never a secret.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ShamirKekRecoveryCodesResponse"
+                  "type": "object",
+                  "properties": {
+                    "kind": {
+                      "type": "string",
+                      "enum": [
+                        "grant"
+                      ]
+                    },
+                    "grant_id": {
+                      "type": "string",
+                      "format": "uuid",
+                      "description": "Single-use, short-lived, redeemable only by the session it was issued to."
+                    },
+                    "binding_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "login_url": {
+                      "type": "string",
+                      "description": "The bridge navigates here itself. An agent-supplied URL would be the agent choosing who receives the password."
+                    }
+                  }
                 }
               }
             }
           },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
+          "400": {
+            "description": "Missing or unsupported bridge version"
           },
           "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "description": "Only one of the two required credentials was presented, an origin is not on the binding's allowlist, or the fill velocity cap was hit"
           },
-          "410": {
-            "description": "Codes already retrieved"
+          "404": {
+            "description": "No such binding for this org"
           }
         }
       }
     },
-    "/v1/org/shamir-kek/verify-recovery-code": {
+    "/v1/agents/{id}/browser/fills/consume": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
       "post": {
         "tags": [
-          "Shamir KEK"
+          "Browser Bridge"
         ],
-        "summary": "Verify a Shamir recovery code",
-        "description": "Check whether a recovery code is valid without consuming it.",
-        "operationId": "verifyShamirKekRecoveryCode",
-        "security": [
+        "summary": "Redeem a grant for the credential it authorised. Takes the browser session token and the bridge credential, and refuses an agent principal — the agent asks which binding, the bridge collects the answer.",
+        "operationId": "consume_browser_fill",
+        "parameters": [
           {
-            "BearerAuth": []
+            "name": "x-1claw-bridge-credential",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "x-1claw-bridge-session",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "The bs_ session token. Proof the redemption belongs to a session this bridge opened."
+          },
+          {
+            "name": "x-1claw-bridge-version",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
@@ -19711,27 +22611,100 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/ShamirKekVerifyCodeRequest"
+                "type": "object",
+                "required": [
+                  "session_id",
+                  "grant_id",
+                  "generation"
+                ],
+                "properties": {
+                  "session_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "grant_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "generation": {
+                    "type": "integer",
+                    "format": "int64",
+                    "description": "The bridge's navigation counter now. A mismatch means the page moved after the decision."
+                  }
+                }
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Verification result",
+            "description": "The credential itself, as raw bytes — the only route in the feature that returns secret material. Not a JSON envelope: the bridge adopts the body into a zeroable buffer, and a wrapper would force it to parse, interning the secret as a string that lives until GC. Metadata rides in `x-1claw-binding-id` and `x-1claw-form-fingerprint`; the response is `cache-control: no-store`.",
+            "headers": {
+              "x-1claw-binding-id": {
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              },
+              "x-1claw-form-fingerprint": {
+                "schema": {
+                  "type": "string",
+                  "format": "byte"
+                },
+                "description": "The binding's form fingerprint, base64-encoded JSON, when it has one. Base64 because a fingerprint naming a non-ASCII field is not a legal header value as raw JSON."
+              }
+            },
             "content": {
-              "application/json": {
+              "application/octet-stream": {
                 "schema": {
-                  "$ref": "#/components/schemas/ShamirKekVerifyCodeResponse"
+                  "type": "string",
+                  "format": "binary"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "description": "Missing or unsupported bridge version"
+          },
+          "403": {
+            "description": "Grant expired, already used, issued to another session or device; the page navigated after authorisation; or an agent principal was presented"
+          },
+          "404": {
+            "description": "The binding or the secret behind it is missing"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/chat/unlock": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Unlock an agent's chat history for reading",
+        "operationId": "unlock_agent_chat",
+        "responses": {
+          "200": {
+            "description": "Unlocked"
           },
           "401": {
-            "$ref": "#/components/responses/Unauthorized"
+            "description": "Unauthenticated"
+          },
+          "403": {
+            "description": "Forbidden"
+          },
+          "404": {
+            "description": "Agent not found"
           }
         }
       }
@@ -23638,6 +26611,7 @@
       },
       "PatchConnectionAgentRequest": {
         "type": "object",
+        "description": "At least one field is required.\n",
         "properties": {
           "intents_api_enabled": {
             "type": "boolean"
@@ -23645,6 +26619,10 @@
           "execution_intents_enabled": {
             "type": "boolean"
           },
+          "memory_enabled": {
+            "type": "boolean",
+            "description": "Agent memory, off by default. Until this field existed a\nplatform app had no way to turn it on: a bootstrap template\naccepted `memory_enabled` in its spec and never read it, so\nthe capability was reachable only from the end user's own\ndashboard. Templates now honour the flag too.\n"
+          },
           "system_prompt": {
             "type": "string",
             "nullable": true
@@ -23664,6 +26642,9 @@
           "execution_intents_enabled": {
             "type": "boolean"
           },
+          "memory_enabled": {
+            "type": "boolean"
+          },
           "system_prompt": {
             "type": "string",
             "nullable": true