@1claw/openapi-spec 0.61.1 → 0.61.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +199 -6
- package/openapi.yaml +154 -4
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.3",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -25057,6 +25057,191 @@
|
|
|
25057
25057
|
}
|
|
25058
25058
|
}
|
|
25059
25059
|
},
|
|
25060
|
+
"/otel/v1/stream": {
|
|
25061
|
+
"get": {
|
|
25062
|
+
"tags": [
|
|
25063
|
+
"Observability"
|
|
25064
|
+
],
|
|
25065
|
+
"summary": "SSE stream of this org's telemetry signals",
|
|
25066
|
+
"description": "Server-sent events carrying spans, metrics and events for the caller's organization. Human users only: an agent must not be able to subscribe to org-wide telemetry.\n\nEvery message carries an `id:` field. On reconnect, send the last one back as the `Last-Event-ID` header to resume. If that id has fallen out of the server's buffer, or came from another replica, the stream opens with an `event: gap` message and the client must refetch topology rather than assume continuity. A `gap` is also emitted, without closing the connection, when a subscriber falls behind.",
|
|
25067
|
+
"operationId": "stream_otel_signals",
|
|
25068
|
+
"parameters": [
|
|
25069
|
+
{
|
|
25070
|
+
"name": "fixture",
|
|
25071
|
+
"in": "query",
|
|
25072
|
+
"required": false,
|
|
25073
|
+
"description": "Set to `1` to request synthetic data. Available only on deployments with fixtures enabled, or to callers in the platform organization; refused with 403 otherwise.",
|
|
25074
|
+
"schema": {
|
|
25075
|
+
"type": "string",
|
|
25076
|
+
"enum": [
|
|
25077
|
+
"1",
|
|
25078
|
+
"true"
|
|
25079
|
+
]
|
|
25080
|
+
}
|
|
25081
|
+
},
|
|
25082
|
+
{
|
|
25083
|
+
"name": "Last-Event-ID",
|
|
25084
|
+
"in": "header",
|
|
25085
|
+
"required": false,
|
|
25086
|
+
"description": "Resume after this event id.",
|
|
25087
|
+
"schema": {
|
|
25088
|
+
"type": "string"
|
|
25089
|
+
}
|
|
25090
|
+
}
|
|
25091
|
+
],
|
|
25092
|
+
"responses": {
|
|
25093
|
+
"200": {
|
|
25094
|
+
"description": "An event stream",
|
|
25095
|
+
"content": {
|
|
25096
|
+
"text/event-stream": {
|
|
25097
|
+
"schema": {
|
|
25098
|
+
"type": "string"
|
|
25099
|
+
}
|
|
25100
|
+
}
|
|
25101
|
+
}
|
|
25102
|
+
},
|
|
25103
|
+
"401": {
|
|
25104
|
+
"description": "Unauthenticated"
|
|
25105
|
+
},
|
|
25106
|
+
"403": {
|
|
25107
|
+
"description": "Not a human user, or fixtures are not available here"
|
|
25108
|
+
},
|
|
25109
|
+
"429": {
|
|
25110
|
+
"description": "Too many concurrent streams for this user"
|
|
25111
|
+
}
|
|
25112
|
+
}
|
|
25113
|
+
}
|
|
25114
|
+
},
|
|
25115
|
+
"/otel/v1/topology": {
|
|
25116
|
+
"get": {
|
|
25117
|
+
"tags": [
|
|
25118
|
+
"Observability"
|
|
25119
|
+
],
|
|
25120
|
+
"summary": "Agent, vault, policy, connector and chain graph for the org",
|
|
25121
|
+
"description": "A snapshot of the organization's resources and how they connect. Human users only.\n\nCapped at 500 nodes. When the cap applies, `truncated` is true and `total_nodes` reports the count before capping — a client must not present a truncated graph as complete. Agents are kept in preference to everything else, and edges that lose an endpoint to the cap are removed.\n\nAgent `status` is derived at request time, never stored, so it cannot go stale.",
|
|
25122
|
+
"operationId": "get_otel_topology",
|
|
25123
|
+
"parameters": [
|
|
25124
|
+
{
|
|
25125
|
+
"name": "fixture",
|
|
25126
|
+
"in": "query",
|
|
25127
|
+
"required": false,
|
|
25128
|
+
"description": "Set to `1` to request a synthetic graph. Same gating as the stream endpoint. A fixture response carries `fixture: true`.",
|
|
25129
|
+
"schema": {
|
|
25130
|
+
"type": "string",
|
|
25131
|
+
"enum": [
|
|
25132
|
+
"1",
|
|
25133
|
+
"true"
|
|
25134
|
+
]
|
|
25135
|
+
}
|
|
25136
|
+
}
|
|
25137
|
+
],
|
|
25138
|
+
"responses": {
|
|
25139
|
+
"200": {
|
|
25140
|
+
"description": "Topology snapshot",
|
|
25141
|
+
"content": {
|
|
25142
|
+
"application/json": {
|
|
25143
|
+
"schema": {
|
|
25144
|
+
"type": "object",
|
|
25145
|
+
"required": [
|
|
25146
|
+
"nodes",
|
|
25147
|
+
"edges",
|
|
25148
|
+
"truncated",
|
|
25149
|
+
"total_nodes"
|
|
25150
|
+
],
|
|
25151
|
+
"properties": {
|
|
25152
|
+
"nodes": {
|
|
25153
|
+
"type": "array",
|
|
25154
|
+
"items": {
|
|
25155
|
+
"type": "object",
|
|
25156
|
+
"required": [
|
|
25157
|
+
"id",
|
|
25158
|
+
"kind",
|
|
25159
|
+
"label"
|
|
25160
|
+
],
|
|
25161
|
+
"properties": {
|
|
25162
|
+
"id": {
|
|
25163
|
+
"type": "string",
|
|
25164
|
+
"description": "Namespaced by kind, e.g. `agent:<uuid>`."
|
|
25165
|
+
},
|
|
25166
|
+
"kind": {
|
|
25167
|
+
"type": "string",
|
|
25168
|
+
"enum": [
|
|
25169
|
+
"agent",
|
|
25170
|
+
"vault",
|
|
25171
|
+
"policy",
|
|
25172
|
+
"connector",
|
|
25173
|
+
"chain"
|
|
25174
|
+
]
|
|
25175
|
+
},
|
|
25176
|
+
"label": {
|
|
25177
|
+
"type": "string"
|
|
25178
|
+
},
|
|
25179
|
+
"status": {
|
|
25180
|
+
"type": "string",
|
|
25181
|
+
"description": "Agents only. Derived, not stored.",
|
|
25182
|
+
"enum": [
|
|
25183
|
+
"compromised",
|
|
25184
|
+
"warn",
|
|
25185
|
+
"suspended",
|
|
25186
|
+
"ok"
|
|
25187
|
+
]
|
|
25188
|
+
}
|
|
25189
|
+
}
|
|
25190
|
+
}
|
|
25191
|
+
},
|
|
25192
|
+
"edges": {
|
|
25193
|
+
"type": "array",
|
|
25194
|
+
"items": {
|
|
25195
|
+
"type": "object",
|
|
25196
|
+
"required": [
|
|
25197
|
+
"from",
|
|
25198
|
+
"to",
|
|
25199
|
+
"kind"
|
|
25200
|
+
],
|
|
25201
|
+
"properties": {
|
|
25202
|
+
"from": {
|
|
25203
|
+
"type": "string"
|
|
25204
|
+
},
|
|
25205
|
+
"to": {
|
|
25206
|
+
"type": "string"
|
|
25207
|
+
},
|
|
25208
|
+
"kind": {
|
|
25209
|
+
"type": "string",
|
|
25210
|
+
"enum": [
|
|
25211
|
+
"calls",
|
|
25212
|
+
"grants",
|
|
25213
|
+
"holds",
|
|
25214
|
+
"signs"
|
|
25215
|
+
]
|
|
25216
|
+
}
|
|
25217
|
+
}
|
|
25218
|
+
}
|
|
25219
|
+
},
|
|
25220
|
+
"truncated": {
|
|
25221
|
+
"type": "boolean"
|
|
25222
|
+
},
|
|
25223
|
+
"total_nodes": {
|
|
25224
|
+
"type": "integer",
|
|
25225
|
+
"description": "Node count before the cap."
|
|
25226
|
+
},
|
|
25227
|
+
"fixture": {
|
|
25228
|
+
"type": "boolean",
|
|
25229
|
+
"description": "Present and true only for synthetic data."
|
|
25230
|
+
}
|
|
25231
|
+
}
|
|
25232
|
+
}
|
|
25233
|
+
}
|
|
25234
|
+
}
|
|
25235
|
+
},
|
|
25236
|
+
"401": {
|
|
25237
|
+
"description": "Unauthenticated"
|
|
25238
|
+
},
|
|
25239
|
+
"403": {
|
|
25240
|
+
"description": "Not a human user, or fixtures are not available here"
|
|
25241
|
+
}
|
|
25242
|
+
}
|
|
25243
|
+
}
|
|
25244
|
+
},
|
|
25060
25245
|
"/v1/runtimes/{runtime_id}/logs/stream": {
|
|
25061
25246
|
"parameters": [
|
|
25062
25247
|
{
|
|
@@ -26896,17 +27081,25 @@
|
|
|
26896
27081
|
},
|
|
26897
27082
|
"AgentTokenRequest": {
|
|
26898
27083
|
"type": "object",
|
|
26899
|
-
"
|
|
26900
|
-
"api_key"
|
|
26901
|
-
],
|
|
27084
|
+
"description": "Exactly one credential, decided by the agent's auth_method: api_key for api_key agents, oidc_token for oidc_client_credentials agents. mTLS agents send neither and present a client certificate through the TLS terminator.",
|
|
26902
27085
|
"properties": {
|
|
26903
27086
|
"agent_id": {
|
|
26904
27087
|
"type": "string",
|
|
26905
27088
|
"format": "uuid",
|
|
26906
|
-
"description": "Optional
|
|
27089
|
+
"description": "Optional for api_key agents (ocv_ keys auto-resolve from their prefix). Required for OIDC and mTLS agents, which have no key to look up by."
|
|
26907
27090
|
},
|
|
26908
27091
|
"api_key": {
|
|
26909
|
-
"type": "string"
|
|
27092
|
+
"type": "string",
|
|
27093
|
+
"description": "The ocv_ key, for auth_method api_key."
|
|
27094
|
+
},
|
|
27095
|
+
"oidc_token": {
|
|
27096
|
+
"type": "string",
|
|
27097
|
+
"description": "Token minted by the agent's OIDC provider, for auth_method oidc_client_credentials. Verified against the issuer and audience on the agent record, so nothing long-lived is stored where the agent runs."
|
|
27098
|
+
},
|
|
27099
|
+
"dpop_jwk": {
|
|
27100
|
+
"type": "object",
|
|
27101
|
+
"additionalProperties": true,
|
|
27102
|
+
"description": "Optional DPoP public key (JWK) binding the issued JWT to a client keypair."
|
|
26910
27103
|
}
|
|
26911
27104
|
}
|
|
26912
27105
|
},
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.3"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -16118,6 +16118,136 @@ paths:
|
|
|
16118
16118
|
description: Forbidden, or the plan does not include this
|
|
16119
16119
|
'404':
|
|
16120
16120
|
description: Not found
|
|
16121
|
+
/otel/v1/stream:
|
|
16122
|
+
get:
|
|
16123
|
+
tags: [Observability]
|
|
16124
|
+
summary: "SSE stream of this org's telemetry signals"
|
|
16125
|
+
description: >-
|
|
16126
|
+
Server-sent events carrying spans, metrics and events for the
|
|
16127
|
+
caller's organization. Human users only: an agent must not be
|
|
16128
|
+
able to subscribe to org-wide telemetry.
|
|
16129
|
+
|
|
16130
|
+
|
|
16131
|
+
Every message carries an `id:` field. On reconnect, send the
|
|
16132
|
+
last one back as the `Last-Event-ID` header to resume. If that
|
|
16133
|
+
id has fallen out of the server's buffer, or came from another
|
|
16134
|
+
replica, the stream opens with an `event: gap` message and the
|
|
16135
|
+
client must refetch topology rather than assume continuity. A
|
|
16136
|
+
`gap` is also emitted, without closing the connection, when a
|
|
16137
|
+
subscriber falls behind.
|
|
16138
|
+
operationId: stream_otel_signals
|
|
16139
|
+
parameters:
|
|
16140
|
+
- name: fixture
|
|
16141
|
+
in: query
|
|
16142
|
+
required: false
|
|
16143
|
+
description: >-
|
|
16144
|
+
Set to `1` to request synthetic data. Available only on
|
|
16145
|
+
deployments with fixtures enabled, or to callers in the
|
|
16146
|
+
platform organization; refused with 403 otherwise.
|
|
16147
|
+
schema:
|
|
16148
|
+
type: string
|
|
16149
|
+
enum: ["1", "true"]
|
|
16150
|
+
- name: Last-Event-ID
|
|
16151
|
+
in: header
|
|
16152
|
+
required: false
|
|
16153
|
+
description: Resume after this event id.
|
|
16154
|
+
schema:
|
|
16155
|
+
type: string
|
|
16156
|
+
responses:
|
|
16157
|
+
'200':
|
|
16158
|
+
description: An event stream
|
|
16159
|
+
content:
|
|
16160
|
+
text/event-stream:
|
|
16161
|
+
schema:
|
|
16162
|
+
type: string
|
|
16163
|
+
'401':
|
|
16164
|
+
description: Unauthenticated
|
|
16165
|
+
'403':
|
|
16166
|
+
description: Not a human user, or fixtures are not available here
|
|
16167
|
+
'429':
|
|
16168
|
+
description: Too many concurrent streams for this user
|
|
16169
|
+
/otel/v1/topology:
|
|
16170
|
+
get:
|
|
16171
|
+
tags: [Observability]
|
|
16172
|
+
summary: "Agent, vault, policy, connector and chain graph for the org"
|
|
16173
|
+
description: >-
|
|
16174
|
+
A snapshot of the organization's resources and how they connect.
|
|
16175
|
+
Human users only.
|
|
16176
|
+
|
|
16177
|
+
|
|
16178
|
+
Capped at 500 nodes. When the cap applies, `truncated` is true
|
|
16179
|
+
and `total_nodes` reports the count before capping — a client
|
|
16180
|
+
must not present a truncated graph as complete. Agents are kept
|
|
16181
|
+
in preference to everything else, and edges that lose an
|
|
16182
|
+
endpoint to the cap are removed.
|
|
16183
|
+
|
|
16184
|
+
|
|
16185
|
+
Agent `status` is derived at request time, never stored, so it
|
|
16186
|
+
cannot go stale.
|
|
16187
|
+
operationId: get_otel_topology
|
|
16188
|
+
parameters:
|
|
16189
|
+
- name: fixture
|
|
16190
|
+
in: query
|
|
16191
|
+
required: false
|
|
16192
|
+
description: >-
|
|
16193
|
+
Set to `1` to request a synthetic graph. Same gating as
|
|
16194
|
+
the stream endpoint. A fixture response carries
|
|
16195
|
+
`fixture: true`.
|
|
16196
|
+
schema:
|
|
16197
|
+
type: string
|
|
16198
|
+
enum: ["1", "true"]
|
|
16199
|
+
responses:
|
|
16200
|
+
'200':
|
|
16201
|
+
description: Topology snapshot
|
|
16202
|
+
content:
|
|
16203
|
+
application/json:
|
|
16204
|
+
schema:
|
|
16205
|
+
type: object
|
|
16206
|
+
required: [nodes, edges, truncated, total_nodes]
|
|
16207
|
+
properties:
|
|
16208
|
+
nodes:
|
|
16209
|
+
type: array
|
|
16210
|
+
items:
|
|
16211
|
+
type: object
|
|
16212
|
+
required: [id, kind, label]
|
|
16213
|
+
properties:
|
|
16214
|
+
id:
|
|
16215
|
+
type: string
|
|
16216
|
+
description: Namespaced by kind, e.g. `agent:<uuid>`.
|
|
16217
|
+
kind:
|
|
16218
|
+
type: string
|
|
16219
|
+
enum: [agent, vault, policy, connector, chain]
|
|
16220
|
+
label:
|
|
16221
|
+
type: string
|
|
16222
|
+
status:
|
|
16223
|
+
type: string
|
|
16224
|
+
description: Agents only. Derived, not stored.
|
|
16225
|
+
enum: [compromised, warn, suspended, ok]
|
|
16226
|
+
edges:
|
|
16227
|
+
type: array
|
|
16228
|
+
items:
|
|
16229
|
+
type: object
|
|
16230
|
+
required: [from, to, kind]
|
|
16231
|
+
properties:
|
|
16232
|
+
from:
|
|
16233
|
+
type: string
|
|
16234
|
+
to:
|
|
16235
|
+
type: string
|
|
16236
|
+
kind:
|
|
16237
|
+
type: string
|
|
16238
|
+
enum: [calls, grants, holds, signs]
|
|
16239
|
+
truncated:
|
|
16240
|
+
type: boolean
|
|
16241
|
+
total_nodes:
|
|
16242
|
+
type: integer
|
|
16243
|
+
description: Node count before the cap.
|
|
16244
|
+
fixture:
|
|
16245
|
+
type: boolean
|
|
16246
|
+
description: Present and true only for synthetic data.
|
|
16247
|
+
'401':
|
|
16248
|
+
description: Unauthenticated
|
|
16249
|
+
'403':
|
|
16250
|
+
description: Not a human user, or fixtures are not available here
|
|
16121
16251
|
/v1/runtimes/{runtime_id}/logs/stream:
|
|
16122
16252
|
parameters:
|
|
16123
16253
|
- name: runtime_id
|
|
@@ -17267,15 +17397,35 @@ components:
|
|
|
17267
17397
|
|
|
17268
17398
|
AgentTokenRequest:
|
|
17269
17399
|
type: object
|
|
17270
|
-
|
|
17400
|
+
description: >-
|
|
17401
|
+
Exactly one credential, decided by the agent's auth_method:
|
|
17402
|
+
api_key for api_key agents, oidc_token for
|
|
17403
|
+
oidc_client_credentials agents. mTLS agents send neither and
|
|
17404
|
+
present a client certificate through the TLS terminator.
|
|
17271
17405
|
properties:
|
|
17272
17406
|
agent_id:
|
|
17273
17407
|
type: string
|
|
17274
17408
|
format: uuid
|
|
17275
|
-
description:
|
|
17409
|
+
description: >-
|
|
17410
|
+
Optional for api_key agents (ocv_ keys auto-resolve from
|
|
17411
|
+
their prefix). Required for OIDC and mTLS agents, which
|
|
17412
|
+
have no key to look up by.
|
|
17276
17413
|
api_key:
|
|
17277
17414
|
type: string
|
|
17278
|
-
|
|
17415
|
+
description: The ocv_ key, for auth_method api_key.
|
|
17416
|
+
oidc_token:
|
|
17417
|
+
type: string
|
|
17418
|
+
description: >-
|
|
17419
|
+
Token minted by the agent's OIDC provider, for
|
|
17420
|
+
auth_method oidc_client_credentials. Verified against the
|
|
17421
|
+
issuer and audience on the agent record, so nothing
|
|
17422
|
+
long-lived is stored where the agent runs.
|
|
17423
|
+
dpop_jwk:
|
|
17424
|
+
type: object
|
|
17425
|
+
additionalProperties: true
|
|
17426
|
+
description: >-
|
|
17427
|
+
Optional DPoP public key (JWK) binding the issued JWT to
|
|
17428
|
+
a client keypair.
|
|
17279
17429
|
UserApiKeyTokenRequest:
|
|
17280
17430
|
type: object
|
|
17281
17431
|
required: [api_key]
|