@1claw/openapi-spec 0.59.9 → 0.59.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +308 -45
- package/openapi.yaml +201 -29
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.59.
|
|
5
|
+
"version": "0.59.10",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -2442,7 +2442,24 @@
|
|
|
2442
2442
|
}
|
|
2443
2443
|
},
|
|
2444
2444
|
"400": {
|
|
2445
|
-
"
|
|
2445
|
+
"description": "The name is empty or longer than 255 characters. Checked before the consensus gate and the quota, so a malformed request consumes neither an approval nor a rate-limit slot.",
|
|
2446
|
+
"content": {
|
|
2447
|
+
"application/json": {
|
|
2448
|
+
"schema": {
|
|
2449
|
+
"$ref": "#/components/schemas/ProblemDetails"
|
|
2450
|
+
}
|
|
2451
|
+
}
|
|
2452
|
+
}
|
|
2453
|
+
},
|
|
2454
|
+
"409": {
|
|
2455
|
+
"description": "A vault with that name already exists in this organization. Names are unique per org; this previously surfaced as a 500.",
|
|
2456
|
+
"content": {
|
|
2457
|
+
"application/json": {
|
|
2458
|
+
"schema": {
|
|
2459
|
+
"$ref": "#/components/schemas/ProblemDetails"
|
|
2460
|
+
}
|
|
2461
|
+
}
|
|
2462
|
+
}
|
|
2446
2463
|
}
|
|
2447
2464
|
}
|
|
2448
2465
|
},
|
|
@@ -11651,6 +11668,40 @@
|
|
|
11651
11668
|
"$ref": "#/components/responses/NotFound"
|
|
11652
11669
|
}
|
|
11653
11670
|
}
|
|
11671
|
+
},
|
|
11672
|
+
"post": {
|
|
11673
|
+
"tags": [
|
|
11674
|
+
"Platform"
|
|
11675
|
+
],
|
|
11676
|
+
"summary": "Create an approval on a platform connection",
|
|
11677
|
+
"operationId": "createConnectionApproval",
|
|
11678
|
+
"security": [
|
|
11679
|
+
{
|
|
11680
|
+
"BearerAuth": []
|
|
11681
|
+
}
|
|
11682
|
+
],
|
|
11683
|
+
"parameters": [
|
|
11684
|
+
{
|
|
11685
|
+
"in": "path",
|
|
11686
|
+
"name": "connectionId",
|
|
11687
|
+
"required": true,
|
|
11688
|
+
"schema": {
|
|
11689
|
+
"type": "string",
|
|
11690
|
+
"format": "uuid"
|
|
11691
|
+
}
|
|
11692
|
+
}
|
|
11693
|
+
],
|
|
11694
|
+
"responses": {
|
|
11695
|
+
"201": {
|
|
11696
|
+
"description": "Approval created"
|
|
11697
|
+
},
|
|
11698
|
+
"403": {
|
|
11699
|
+
"$ref": "#/components/responses/Forbidden"
|
|
11700
|
+
},
|
|
11701
|
+
"404": {
|
|
11702
|
+
"$ref": "#/components/responses/NotFound"
|
|
11703
|
+
}
|
|
11704
|
+
}
|
|
11654
11705
|
}
|
|
11655
11706
|
},
|
|
11656
11707
|
"/v1/platform/connections/{connectionId}/approvals/{approvalId}": {
|
|
@@ -12250,6 +12301,49 @@
|
|
|
12250
12301
|
"$ref": "#/components/responses/NotFound"
|
|
12251
12302
|
}
|
|
12252
12303
|
}
|
|
12304
|
+
},
|
|
12305
|
+
"post": {
|
|
12306
|
+
"tags": [
|
|
12307
|
+
"Platform"
|
|
12308
|
+
],
|
|
12309
|
+
"summary": "Alias for PATCH on this path — same handler, same limited settings. Present because some clients cannot send PATCH.",
|
|
12310
|
+
"operationId": "postConnectionAgent",
|
|
12311
|
+
"security": [
|
|
12312
|
+
{
|
|
12313
|
+
"BearerAuth": []
|
|
12314
|
+
}
|
|
12315
|
+
],
|
|
12316
|
+
"parameters": [
|
|
12317
|
+
{
|
|
12318
|
+
"in": "path",
|
|
12319
|
+
"name": "connectionId",
|
|
12320
|
+
"required": true,
|
|
12321
|
+
"schema": {
|
|
12322
|
+
"type": "string",
|
|
12323
|
+
"format": "uuid"
|
|
12324
|
+
}
|
|
12325
|
+
},
|
|
12326
|
+
{
|
|
12327
|
+
"in": "path",
|
|
12328
|
+
"name": "agentId",
|
|
12329
|
+
"required": true,
|
|
12330
|
+
"schema": {
|
|
12331
|
+
"type": "string",
|
|
12332
|
+
"format": "uuid"
|
|
12333
|
+
}
|
|
12334
|
+
}
|
|
12335
|
+
],
|
|
12336
|
+
"responses": {
|
|
12337
|
+
"200": {
|
|
12338
|
+
"description": "Agent updated"
|
|
12339
|
+
},
|
|
12340
|
+
"403": {
|
|
12341
|
+
"$ref": "#/components/responses/Forbidden"
|
|
12342
|
+
},
|
|
12343
|
+
"404": {
|
|
12344
|
+
"$ref": "#/components/responses/NotFound"
|
|
12345
|
+
}
|
|
12346
|
+
}
|
|
12253
12347
|
}
|
|
12254
12348
|
},
|
|
12255
12349
|
"/v1/platform/connections/{connectionId}/portfolio": {
|
|
@@ -13426,6 +13520,50 @@
|
|
|
13426
13520
|
"$ref": "#/components/responses/Conflict"
|
|
13427
13521
|
}
|
|
13428
13522
|
}
|
|
13523
|
+
},
|
|
13524
|
+
"post": {
|
|
13525
|
+
"tags": [
|
|
13526
|
+
"Approvals"
|
|
13527
|
+
],
|
|
13528
|
+
"summary": "One-click approve or deny, as an API call. The GET on this path is the preview an email link opens; this is the decision itself.",
|
|
13529
|
+
"operationId": "quickDecide",
|
|
13530
|
+
"requestBody": {
|
|
13531
|
+
"required": true,
|
|
13532
|
+
"content": {
|
|
13533
|
+
"application/json": {
|
|
13534
|
+
"schema": {
|
|
13535
|
+
"type": "object",
|
|
13536
|
+
"required": [
|
|
13537
|
+
"token",
|
|
13538
|
+
"decision"
|
|
13539
|
+
],
|
|
13540
|
+
"properties": {
|
|
13541
|
+
"token": {
|
|
13542
|
+
"type": "string"
|
|
13543
|
+
},
|
|
13544
|
+
"decision": {
|
|
13545
|
+
"type": "string",
|
|
13546
|
+
"enum": [
|
|
13547
|
+
"approve",
|
|
13548
|
+
"deny"
|
|
13549
|
+
]
|
|
13550
|
+
}
|
|
13551
|
+
}
|
|
13552
|
+
}
|
|
13553
|
+
}
|
|
13554
|
+
}
|
|
13555
|
+
},
|
|
13556
|
+
"responses": {
|
|
13557
|
+
"200": {
|
|
13558
|
+
"description": "Decision recorded"
|
|
13559
|
+
},
|
|
13560
|
+
"400": {
|
|
13561
|
+
"description": "Malformed or expired token"
|
|
13562
|
+
},
|
|
13563
|
+
"404": {
|
|
13564
|
+
"$ref": "#/components/responses/NotFound"
|
|
13565
|
+
}
|
|
13566
|
+
}
|
|
13429
13567
|
}
|
|
13430
13568
|
},
|
|
13431
13569
|
"/v1/deposit-destinations": {
|
|
@@ -16317,6 +16455,16 @@
|
|
|
16317
16455
|
},
|
|
16318
16456
|
"404": {
|
|
16319
16457
|
"$ref": "#/components/responses/NotFound"
|
|
16458
|
+
},
|
|
16459
|
+
"503": {
|
|
16460
|
+
"description": "The runtime's last start failed less than 120 seconds ago and is not\nbeing retried yet. Chat starts a stopped runtime, so a client that\nretries on failure turns every attempt into another deploy — one\npolling client did exactly that every 8 seconds for days. Wait out\nthe cooldown, or call the start endpoint to see the underlying error.\n",
|
|
16461
|
+
"content": {
|
|
16462
|
+
"application/json": {
|
|
16463
|
+
"schema": {
|
|
16464
|
+
"$ref": "#/components/schemas/ProblemDetails"
|
|
16465
|
+
}
|
|
16466
|
+
}
|
|
16467
|
+
}
|
|
16320
16468
|
}
|
|
16321
16469
|
}
|
|
16322
16470
|
}
|
|
@@ -16391,6 +16539,37 @@
|
|
|
16391
16539
|
"$ref": "#/components/responses/NotFound"
|
|
16392
16540
|
}
|
|
16393
16541
|
}
|
|
16542
|
+
},
|
|
16543
|
+
"delete": {
|
|
16544
|
+
"tags": [
|
|
16545
|
+
"Agent Memory"
|
|
16546
|
+
],
|
|
16547
|
+
"summary": "Delete a memory namespace and every entry in it. Destructive and not reversible; there is no per-entry confirmation.",
|
|
16548
|
+
"operationId": "deleteMemoryNamespace",
|
|
16549
|
+
"parameters": [
|
|
16550
|
+
{
|
|
16551
|
+
"$ref": "#/components/parameters/AgentId"
|
|
16552
|
+
},
|
|
16553
|
+
{
|
|
16554
|
+
"name": "namespace",
|
|
16555
|
+
"in": "path",
|
|
16556
|
+
"required": true,
|
|
16557
|
+
"schema": {
|
|
16558
|
+
"type": "string"
|
|
16559
|
+
}
|
|
16560
|
+
}
|
|
16561
|
+
],
|
|
16562
|
+
"responses": {
|
|
16563
|
+
"204": {
|
|
16564
|
+
"description": "Namespace deleted"
|
|
16565
|
+
},
|
|
16566
|
+
"401": {
|
|
16567
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
16568
|
+
},
|
|
16569
|
+
"404": {
|
|
16570
|
+
"$ref": "#/components/responses/NotFound"
|
|
16571
|
+
}
|
|
16572
|
+
}
|
|
16394
16573
|
}
|
|
16395
16574
|
},
|
|
16396
16575
|
"/v1/agents/{agent_id}/memory/{namespace}/{key}": {
|
|
@@ -19661,45 +19840,6 @@
|
|
|
19661
19840
|
}
|
|
19662
19841
|
}
|
|
19663
19842
|
},
|
|
19664
|
-
"/v1/auth/credential-recovery/requests/{id}": {
|
|
19665
|
-
"delete": {
|
|
19666
|
-
"tags": [
|
|
19667
|
-
"Credential Recovery"
|
|
19668
|
-
],
|
|
19669
|
-
"summary": "Cancel or reject a recovery request",
|
|
19670
|
-
"operationId": "cancelCredentialRecovery",
|
|
19671
|
-
"security": [
|
|
19672
|
-
{
|
|
19673
|
-
"BearerAuth": []
|
|
19674
|
-
}
|
|
19675
|
-
],
|
|
19676
|
-
"parameters": [
|
|
19677
|
-
{
|
|
19678
|
-
"name": "id",
|
|
19679
|
-
"in": "path",
|
|
19680
|
-
"required": true,
|
|
19681
|
-
"schema": {
|
|
19682
|
-
"type": "string",
|
|
19683
|
-
"format": "uuid"
|
|
19684
|
-
}
|
|
19685
|
-
}
|
|
19686
|
-
],
|
|
19687
|
-
"responses": {
|
|
19688
|
-
"204": {
|
|
19689
|
-
"description": "Request cancelled"
|
|
19690
|
-
},
|
|
19691
|
-
"401": {
|
|
19692
|
-
"$ref": "#/components/responses/Unauthorized"
|
|
19693
|
-
},
|
|
19694
|
-
"403": {
|
|
19695
|
-
"$ref": "#/components/responses/Forbidden"
|
|
19696
|
-
},
|
|
19697
|
-
"404": {
|
|
19698
|
-
"$ref": "#/components/responses/NotFound"
|
|
19699
|
-
}
|
|
19700
|
-
}
|
|
19701
|
-
}
|
|
19702
|
-
},
|
|
19703
19843
|
"/v1/org/credential-recovery-policy": {
|
|
19704
19844
|
"get": {
|
|
19705
19845
|
"tags": [
|
|
@@ -22204,6 +22344,99 @@
|
|
|
22204
22344
|
"description": "That label is already pinned to a different key"
|
|
22205
22345
|
}
|
|
22206
22346
|
}
|
|
22347
|
+
},
|
|
22348
|
+
"get": {
|
|
22349
|
+
"tags": [
|
|
22350
|
+
"Browser Bridge"
|
|
22351
|
+
],
|
|
22352
|
+
"summary": "List the browser bridges paired to this organization. Revoked devices are included: 'was this machine ever paired' is the question asked after a laptop goes missing.",
|
|
22353
|
+
"operationId": "list_browser_devices",
|
|
22354
|
+
"responses": {
|
|
22355
|
+
"200": {
|
|
22356
|
+
"description": "The paired devices. No credential material is returned — the row holds an Argon2 hash and a prefix, and neither is exposed.",
|
|
22357
|
+
"content": {
|
|
22358
|
+
"application/json": {
|
|
22359
|
+
"schema": {
|
|
22360
|
+
"type": "object",
|
|
22361
|
+
"properties": {
|
|
22362
|
+
"devices": {
|
|
22363
|
+
"type": "array",
|
|
22364
|
+
"items": {
|
|
22365
|
+
"type": "object",
|
|
22366
|
+
"properties": {
|
|
22367
|
+
"id": {
|
|
22368
|
+
"type": "string",
|
|
22369
|
+
"format": "uuid"
|
|
22370
|
+
},
|
|
22371
|
+
"label": {
|
|
22372
|
+
"type": "string"
|
|
22373
|
+
},
|
|
22374
|
+
"platform": {
|
|
22375
|
+
"type": "string",
|
|
22376
|
+
"nullable": true
|
|
22377
|
+
},
|
|
22378
|
+
"bridge_version": {
|
|
22379
|
+
"type": "string",
|
|
22380
|
+
"nullable": true
|
|
22381
|
+
},
|
|
22382
|
+
"last_seen_at": {
|
|
22383
|
+
"type": "string",
|
|
22384
|
+
"format": "date-time",
|
|
22385
|
+
"nullable": true
|
|
22386
|
+
},
|
|
22387
|
+
"revoked_at": {
|
|
22388
|
+
"type": "string",
|
|
22389
|
+
"format": "date-time",
|
|
22390
|
+
"nullable": true,
|
|
22391
|
+
"description": "Set once revoked. A revoked credential stops resolving."
|
|
22392
|
+
},
|
|
22393
|
+
"created_at": {
|
|
22394
|
+
"type": "string",
|
|
22395
|
+
"format": "date-time"
|
|
22396
|
+
}
|
|
22397
|
+
}
|
|
22398
|
+
}
|
|
22399
|
+
}
|
|
22400
|
+
}
|
|
22401
|
+
}
|
|
22402
|
+
}
|
|
22403
|
+
}
|
|
22404
|
+
},
|
|
22405
|
+
"401": {
|
|
22406
|
+
"description": "Unauthenticated"
|
|
22407
|
+
}
|
|
22408
|
+
}
|
|
22409
|
+
}
|
|
22410
|
+
},
|
|
22411
|
+
"/v1/browser/devices/{id}": {
|
|
22412
|
+
"delete": {
|
|
22413
|
+
"tags": [
|
|
22414
|
+
"Browser Bridge"
|
|
22415
|
+
],
|
|
22416
|
+
"summary": "Revoke a paired bridge. This is what makes a leaked bb_ credential stop working.",
|
|
22417
|
+
"operationId": "revoke_browser_device",
|
|
22418
|
+
"parameters": [
|
|
22419
|
+
{
|
|
22420
|
+
"name": "id",
|
|
22421
|
+
"in": "path",
|
|
22422
|
+
"required": true,
|
|
22423
|
+
"schema": {
|
|
22424
|
+
"type": "string",
|
|
22425
|
+
"format": "uuid"
|
|
22426
|
+
}
|
|
22427
|
+
}
|
|
22428
|
+
],
|
|
22429
|
+
"responses": {
|
|
22430
|
+
"204": {
|
|
22431
|
+
"description": "Revoked. Subsequent use of that credential resolves to nothing."
|
|
22432
|
+
},
|
|
22433
|
+
"401": {
|
|
22434
|
+
"description": "Unauthenticated"
|
|
22435
|
+
},
|
|
22436
|
+
"404": {
|
|
22437
|
+
"description": "No such device in this organization"
|
|
22438
|
+
}
|
|
22439
|
+
}
|
|
22207
22440
|
}
|
|
22208
22441
|
},
|
|
22209
22442
|
"/v1/browser/credentials": {
|
|
@@ -22249,7 +22482,7 @@
|
|
|
22249
22482
|
"items": {
|
|
22250
22483
|
"type": "string"
|
|
22251
22484
|
},
|
|
22252
|
-
"description": "
|
|
22485
|
+
"description": "Hostnames. A bare entry matches only itself; a leading dot ('.example.com') matches that host and any subdomain. URLs, ports and '*' are refused — '*' has no meaning to the matcher, so it would be stored and then match nothing."
|
|
22253
22486
|
},
|
|
22254
22487
|
"sso_hosts": {
|
|
22255
22488
|
"type": "array",
|
|
@@ -22475,7 +22708,11 @@
|
|
|
22475
22708
|
"tab_origin",
|
|
22476
22709
|
"frame_origin",
|
|
22477
22710
|
"frame_id",
|
|
22478
|
-
"generation"
|
|
22711
|
+
"generation",
|
|
22712
|
+
"form_path",
|
|
22713
|
+
"field_names",
|
|
22714
|
+
"redirect_chain",
|
|
22715
|
+
"current_generation"
|
|
22479
22716
|
],
|
|
22480
22717
|
"properties": {
|
|
22481
22718
|
"session_id": {
|
|
@@ -22498,7 +22735,30 @@
|
|
|
22498
22735
|
},
|
|
22499
22736
|
"form_action_origin": {
|
|
22500
22737
|
"type": "string",
|
|
22501
|
-
"description": "Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host."
|
|
22738
|
+
"description": "Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host. Absent is not treated as 'same as the tab'; it denies."
|
|
22739
|
+
},
|
|
22740
|
+
"form_path": {
|
|
22741
|
+
"type": "string",
|
|
22742
|
+
"description": "Path of the form being filled, checked against the binding's fingerprint."
|
|
22743
|
+
},
|
|
22744
|
+
"field_names": {
|
|
22745
|
+
"type": "array",
|
|
22746
|
+
"items": {
|
|
22747
|
+
"type": "string"
|
|
22748
|
+
},
|
|
22749
|
+
"description": "Field names on that form. Every field the fingerprint expects must be present; extra fields are fine, since sites add hidden inputs."
|
|
22750
|
+
},
|
|
22751
|
+
"redirect_chain": {
|
|
22752
|
+
"type": "array",
|
|
22753
|
+
"items": {
|
|
22754
|
+
"type": "string"
|
|
22755
|
+
},
|
|
22756
|
+
"description": "Hosts the login has redirected through, in order. Each is checked against the binding's allowed hosts union its sso hosts."
|
|
22757
|
+
},
|
|
22758
|
+
"current_generation": {
|
|
22759
|
+
"type": "integer",
|
|
22760
|
+
"format": "int64",
|
|
22761
|
+
"description": "The target's generation now. A mismatch with `generation` means the page moved and the fill is denied."
|
|
22502
22762
|
},
|
|
22503
22763
|
"tab_origin": {
|
|
22504
22764
|
"type": "string",
|
|
@@ -23769,7 +24029,10 @@
|
|
|
23769
24029
|
],
|
|
23770
24030
|
"properties": {
|
|
23771
24031
|
"name": {
|
|
23772
|
-
"type": "string"
|
|
24032
|
+
"type": "string",
|
|
24033
|
+
"minLength": 1,
|
|
24034
|
+
"maxLength": 255,
|
|
24035
|
+
"description": "Unique within the organization. Trimmed before it is stored, and the trimmed value is what must be unique. Counted in characters, not bytes."
|
|
23773
24036
|
},
|
|
23774
24037
|
"description": {
|
|
23775
24038
|
"type": "string"
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.59.
|
|
5
|
+
version: "0.59.10"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -1649,7 +1649,17 @@ paths:
|
|
|
1649
1649
|
schema:
|
|
1650
1650
|
$ref: "#/components/schemas/VaultResponse"
|
|
1651
1651
|
"400":
|
|
1652
|
-
|
|
1652
|
+
description: The name is empty or longer than 255 characters. Checked before the consensus gate and the quota, so a malformed request consumes neither an approval nor a rate-limit slot.
|
|
1653
|
+
content:
|
|
1654
|
+
application/json:
|
|
1655
|
+
schema:
|
|
1656
|
+
$ref: "#/components/schemas/ProblemDetails"
|
|
1657
|
+
"409":
|
|
1658
|
+
description: A vault with that name already exists in this organization. Names are unique per org; this previously surfaced as a 500.
|
|
1659
|
+
content:
|
|
1660
|
+
application/json:
|
|
1661
|
+
schema:
|
|
1662
|
+
$ref: "#/components/schemas/ProblemDetails"
|
|
1653
1663
|
get:
|
|
1654
1664
|
tags: [Vaults]
|
|
1655
1665
|
summary: List vaults
|
|
@@ -7504,6 +7514,26 @@ paths:
|
|
|
7504
7514
|
"404":
|
|
7505
7515
|
$ref: "#/components/responses/NotFound"
|
|
7506
7516
|
|
|
7517
|
+
post:
|
|
7518
|
+
tags: [Platform]
|
|
7519
|
+
summary: Create an approval on a platform connection
|
|
7520
|
+
operationId: createConnectionApproval
|
|
7521
|
+
security:
|
|
7522
|
+
- BearerAuth: []
|
|
7523
|
+
parameters:
|
|
7524
|
+
- in: path
|
|
7525
|
+
name: connectionId
|
|
7526
|
+
required: true
|
|
7527
|
+
schema:
|
|
7528
|
+
type: string
|
|
7529
|
+
format: uuid
|
|
7530
|
+
responses:
|
|
7531
|
+
"201":
|
|
7532
|
+
description: Approval created
|
|
7533
|
+
"403":
|
|
7534
|
+
$ref: "#/components/responses/Forbidden"
|
|
7535
|
+
"404":
|
|
7536
|
+
$ref: "#/components/responses/NotFound"
|
|
7507
7537
|
/v1/platform/connections/{connectionId}/approvals/{approvalId}:
|
|
7508
7538
|
get:
|
|
7509
7539
|
tags: [Platform]
|
|
@@ -7896,6 +7926,32 @@ paths:
|
|
|
7896
7926
|
"404":
|
|
7897
7927
|
$ref: "#/components/responses/NotFound"
|
|
7898
7928
|
|
|
7929
|
+
post:
|
|
7930
|
+
tags: [Platform]
|
|
7931
|
+
summary: "Alias for PATCH on this path — same handler, same limited settings. Present because some clients cannot send PATCH."
|
|
7932
|
+
operationId: postConnectionAgent
|
|
7933
|
+
security:
|
|
7934
|
+
- BearerAuth: []
|
|
7935
|
+
parameters:
|
|
7936
|
+
- in: path
|
|
7937
|
+
name: connectionId
|
|
7938
|
+
required: true
|
|
7939
|
+
schema:
|
|
7940
|
+
type: string
|
|
7941
|
+
format: uuid
|
|
7942
|
+
- in: path
|
|
7943
|
+
name: agentId
|
|
7944
|
+
required: true
|
|
7945
|
+
schema:
|
|
7946
|
+
type: string
|
|
7947
|
+
format: uuid
|
|
7948
|
+
responses:
|
|
7949
|
+
"200":
|
|
7950
|
+
description: Agent updated
|
|
7951
|
+
"403":
|
|
7952
|
+
$ref: "#/components/responses/Forbidden"
|
|
7953
|
+
"404":
|
|
7954
|
+
$ref: "#/components/responses/NotFound"
|
|
7899
7955
|
/v1/platform/connections/{connectionId}/portfolio:
|
|
7900
7956
|
get:
|
|
7901
7957
|
tags: [Platform]
|
|
@@ -8713,6 +8769,30 @@ paths:
|
|
|
8713
8769
|
"409":
|
|
8714
8770
|
$ref: "#/components/responses/Conflict"
|
|
8715
8771
|
|
|
8772
|
+
post:
|
|
8773
|
+
tags: [Approvals]
|
|
8774
|
+
summary: "One-click approve or deny, as an API call. The GET on this path is the preview an email link opens; this is the decision itself."
|
|
8775
|
+
operationId: quickDecide
|
|
8776
|
+
requestBody:
|
|
8777
|
+
required: true
|
|
8778
|
+
content:
|
|
8779
|
+
application/json:
|
|
8780
|
+
schema:
|
|
8781
|
+
type: object
|
|
8782
|
+
required: [token, decision]
|
|
8783
|
+
properties:
|
|
8784
|
+
token:
|
|
8785
|
+
type: string
|
|
8786
|
+
decision:
|
|
8787
|
+
type: string
|
|
8788
|
+
enum: [approve, deny]
|
|
8789
|
+
responses:
|
|
8790
|
+
"200":
|
|
8791
|
+
description: Decision recorded
|
|
8792
|
+
"400":
|
|
8793
|
+
description: Malformed or expired token
|
|
8794
|
+
"404":
|
|
8795
|
+
$ref: "#/components/responses/NotFound"
|
|
8716
8796
|
/v1/deposit-destinations:
|
|
8717
8797
|
post:
|
|
8718
8798
|
tags: [Treasury]
|
|
@@ -10516,6 +10596,17 @@ paths:
|
|
|
10516
10596
|
$ref: "#/components/responses/Forbidden"
|
|
10517
10597
|
"404":
|
|
10518
10598
|
$ref: "#/components/responses/NotFound"
|
|
10599
|
+
"503":
|
|
10600
|
+
description: |
|
|
10601
|
+
The runtime's last start failed less than 120 seconds ago and is not
|
|
10602
|
+
being retried yet. Chat starts a stopped runtime, so a client that
|
|
10603
|
+
retries on failure turns every attempt into another deploy — one
|
|
10604
|
+
polling client did exactly that every 8 seconds for days. Wait out
|
|
10605
|
+
the cooldown, or call the start endpoint to see the underlying error.
|
|
10606
|
+
content:
|
|
10607
|
+
application/json:
|
|
10608
|
+
schema:
|
|
10609
|
+
$ref: "#/components/schemas/ProblemDetails"
|
|
10519
10610
|
|
|
10520
10611
|
# ---------------------------------------------------------------------------
|
|
10521
10612
|
# Agent Memory
|
|
@@ -10563,6 +10654,24 @@ paths:
|
|
|
10563
10654
|
$ref: "#/components/responses/Unauthorized"
|
|
10564
10655
|
"404":
|
|
10565
10656
|
$ref: "#/components/responses/NotFound"
|
|
10657
|
+
delete:
|
|
10658
|
+
tags: [Agent Memory]
|
|
10659
|
+
summary: "Delete a memory namespace and every entry in it. Destructive and not reversible; there is no per-entry confirmation."
|
|
10660
|
+
operationId: deleteMemoryNamespace
|
|
10661
|
+
parameters:
|
|
10662
|
+
- $ref: "#/components/parameters/AgentId"
|
|
10663
|
+
- name: namespace
|
|
10664
|
+
in: path
|
|
10665
|
+
required: true
|
|
10666
|
+
schema:
|
|
10667
|
+
type: string
|
|
10668
|
+
responses:
|
|
10669
|
+
"204":
|
|
10670
|
+
description: Namespace deleted
|
|
10671
|
+
"401":
|
|
10672
|
+
$ref: "#/components/responses/Unauthorized"
|
|
10673
|
+
"404":
|
|
10674
|
+
$ref: "#/components/responses/NotFound"
|
|
10566
10675
|
|
|
10567
10676
|
/v1/agents/{agent_id}/memory/{namespace}/{key}:
|
|
10568
10677
|
put:
|
|
@@ -12656,30 +12765,6 @@ paths:
|
|
|
12656
12765
|
"404":
|
|
12657
12766
|
$ref: "#/components/responses/NotFound"
|
|
12658
12767
|
|
|
12659
|
-
/v1/auth/credential-recovery/requests/{id}:
|
|
12660
|
-
delete:
|
|
12661
|
-
tags: [Credential Recovery]
|
|
12662
|
-
summary: Cancel or reject a recovery request
|
|
12663
|
-
operationId: cancelCredentialRecovery
|
|
12664
|
-
security:
|
|
12665
|
-
- BearerAuth: []
|
|
12666
|
-
parameters:
|
|
12667
|
-
- name: id
|
|
12668
|
-
in: path
|
|
12669
|
-
required: true
|
|
12670
|
-
schema:
|
|
12671
|
-
type: string
|
|
12672
|
-
format: uuid
|
|
12673
|
-
responses:
|
|
12674
|
-
"204":
|
|
12675
|
-
description: Request cancelled
|
|
12676
|
-
"401":
|
|
12677
|
-
$ref: "#/components/responses/Unauthorized"
|
|
12678
|
-
"403":
|
|
12679
|
-
$ref: "#/components/responses/Forbidden"
|
|
12680
|
-
"404":
|
|
12681
|
-
$ref: "#/components/responses/NotFound"
|
|
12682
|
-
|
|
12683
12768
|
# ---------------------------------------------------------------------------
|
|
12684
12769
|
# Org Credential Recovery Policy
|
|
12685
12770
|
# ---------------------------------------------------------------------------
|
|
@@ -14241,6 +14326,67 @@ paths:
|
|
|
14241
14326
|
description: Not a human caller — agents and platform keys cannot pair a device
|
|
14242
14327
|
'409':
|
|
14243
14328
|
description: That label is already pinned to a different key
|
|
14329
|
+
get:
|
|
14330
|
+
tags: [Browser Bridge]
|
|
14331
|
+
summary: "List the browser bridges paired to this organization. Revoked devices are included: 'was this machine ever paired' is the question asked after a laptop goes missing."
|
|
14332
|
+
operationId: list_browser_devices
|
|
14333
|
+
responses:
|
|
14334
|
+
'200':
|
|
14335
|
+
description: The paired devices. No credential material is returned — the row holds an Argon2 hash and a prefix, and neither is exposed.
|
|
14336
|
+
content:
|
|
14337
|
+
application/json:
|
|
14338
|
+
schema:
|
|
14339
|
+
type: object
|
|
14340
|
+
properties:
|
|
14341
|
+
devices:
|
|
14342
|
+
type: array
|
|
14343
|
+
items:
|
|
14344
|
+
type: object
|
|
14345
|
+
properties:
|
|
14346
|
+
id:
|
|
14347
|
+
type: string
|
|
14348
|
+
format: uuid
|
|
14349
|
+
label:
|
|
14350
|
+
type: string
|
|
14351
|
+
platform:
|
|
14352
|
+
type: string
|
|
14353
|
+
nullable: true
|
|
14354
|
+
bridge_version:
|
|
14355
|
+
type: string
|
|
14356
|
+
nullable: true
|
|
14357
|
+
last_seen_at:
|
|
14358
|
+
type: string
|
|
14359
|
+
format: date-time
|
|
14360
|
+
nullable: true
|
|
14361
|
+
revoked_at:
|
|
14362
|
+
type: string
|
|
14363
|
+
format: date-time
|
|
14364
|
+
nullable: true
|
|
14365
|
+
description: Set once revoked. A revoked credential stops resolving.
|
|
14366
|
+
created_at:
|
|
14367
|
+
type: string
|
|
14368
|
+
format: date-time
|
|
14369
|
+
'401':
|
|
14370
|
+
description: Unauthenticated
|
|
14371
|
+
/v1/browser/devices/{id}:
|
|
14372
|
+
delete:
|
|
14373
|
+
tags: [Browser Bridge]
|
|
14374
|
+
summary: "Revoke a paired bridge. This is what makes a leaked bb_ credential stop working."
|
|
14375
|
+
operationId: revoke_browser_device
|
|
14376
|
+
parameters:
|
|
14377
|
+
- name: id
|
|
14378
|
+
in: path
|
|
14379
|
+
required: true
|
|
14380
|
+
schema:
|
|
14381
|
+
type: string
|
|
14382
|
+
format: uuid
|
|
14383
|
+
responses:
|
|
14384
|
+
'204':
|
|
14385
|
+
description: Revoked. Subsequent use of that credential resolves to nothing.
|
|
14386
|
+
'401':
|
|
14387
|
+
description: Unauthenticated
|
|
14388
|
+
'404':
|
|
14389
|
+
description: No such device in this organization
|
|
14244
14390
|
/v1/browser/credentials:
|
|
14245
14391
|
post:
|
|
14246
14392
|
tags: [Browser Bridge]
|
|
@@ -14271,7 +14417,7 @@ paths:
|
|
|
14271
14417
|
minItems: 1
|
|
14272
14418
|
items:
|
|
14273
14419
|
type: string
|
|
14274
|
-
description: "
|
|
14420
|
+
description: "Hostnames. A bare entry matches only itself; a leading dot ('.example.com') matches that host and any subdomain. URLs, ports and '*' are refused — '*' has no meaning to the matcher, so it would be stored and then match nothing."
|
|
14275
14421
|
sso_hosts:
|
|
14276
14422
|
type: array
|
|
14277
14423
|
items:
|
|
@@ -14407,7 +14553,13 @@ paths:
|
|
|
14407
14553
|
application/json:
|
|
14408
14554
|
schema:
|
|
14409
14555
|
type: object
|
|
14410
|
-
|
|
14556
|
+
# form_path, field_names, redirect_chain and current_generation are
|
|
14557
|
+
# required, not optional. They were accepted as absent and defaulted
|
|
14558
|
+
# server-side, which turned three of the policy's checks off: the
|
|
14559
|
+
# redirect loop never ran, current_generation was compared against
|
|
14560
|
+
# itself, and form_path defaulted to "", matching no fingerprint
|
|
14561
|
+
# pattern and denying every binding that carried one.
|
|
14562
|
+
required: [session_id, binding_id, tab_origin, frame_origin, frame_id, generation, form_path, field_names, redirect_chain, current_generation]
|
|
14411
14563
|
properties:
|
|
14412
14564
|
session_id:
|
|
14413
14565
|
type: string
|
|
@@ -14425,7 +14577,24 @@ paths:
|
|
|
14425
14577
|
description: "The bridge's navigation counter. Compared again at consume: a navigation in between means the page decided about is no longer the page in front of the bridge."
|
|
14426
14578
|
form_action_origin:
|
|
14427
14579
|
type: string
|
|
14428
|
-
description: "Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host."
|
|
14580
|
+
description: "Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host. Absent is not treated as 'same as the tab'; it denies."
|
|
14581
|
+
form_path:
|
|
14582
|
+
type: string
|
|
14583
|
+
description: Path of the form being filled, checked against the binding's fingerprint.
|
|
14584
|
+
field_names:
|
|
14585
|
+
type: array
|
|
14586
|
+
items:
|
|
14587
|
+
type: string
|
|
14588
|
+
description: "Field names on that form. Every field the fingerprint expects must be present; extra fields are fine, since sites add hidden inputs."
|
|
14589
|
+
redirect_chain:
|
|
14590
|
+
type: array
|
|
14591
|
+
items:
|
|
14592
|
+
type: string
|
|
14593
|
+
description: "Hosts the login has redirected through, in order. Each is checked against the binding's allowed hosts union its sso hosts."
|
|
14594
|
+
current_generation:
|
|
14595
|
+
type: integer
|
|
14596
|
+
format: int64
|
|
14597
|
+
description: The target's generation now. A mismatch with `generation` means the page moved and the fill is denied.
|
|
14429
14598
|
tab_origin:
|
|
14430
14599
|
type: string
|
|
14431
14600
|
description: "Origin of the tab being driven. Checked against the binding's allowed and sso hosts by exact host match."
|
|
@@ -15270,6 +15439,9 @@ components:
|
|
|
15270
15439
|
properties:
|
|
15271
15440
|
name:
|
|
15272
15441
|
type: string
|
|
15442
|
+
minLength: 1
|
|
15443
|
+
maxLength: 255
|
|
15444
|
+
description: Unique within the organization. Trimmed before it is stored, and the trimmed value is what must be unique. Counted in characters, not bytes.
|
|
15273
15445
|
description:
|
|
15274
15446
|
type: string
|
|
15275
15447
|
mpc_custody:
|