@1claw/openapi-spec 0.61.11 → 0.61.13

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.11",
+    "version": "0.61.13",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -5886,6 +5886,184 @@
         }
       }
     },
+    "/v1/admin/agents/{agent_id}/reports/dismiss": {
+      "post": {
+        "tags": [
+          "Admin"
+        ],
+        "summary": "Dismiss every open report on a directory listing",
+        "description": "Platform admins only. Clears the listing's report flag and recounts. The review queue is a platform function — an org dismissing reports against its own agent is the abuse the queue exists to catch.\n",
+        "operationId": "adminDismissAgentReports",
+        "parameters": [
+          {
+            "name": "agent_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Reports dismissed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "agent_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "dismissed": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Not a platform admin"
+          },
+          "404": {
+            "description": "Agent not found"
+          }
+        }
+      }
+    },
+    "/v1/admin/agents/{agent_id}/verification-tier": {
+      "put": {
+        "tags": [
+          "Admin"
+        ],
+        "summary": "Set a directory listing's verification tier",
+        "description": "Platform admins only. Unknown tiers are refused rather than demoted to `unverified`.",
+        "operationId": "adminSetAgentVerificationTier",
+        "parameters": [
+          {
+            "name": "agent_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "tier"
+                ],
+                "properties": {
+                  "tier": {
+                    "type": "string",
+                    "enum": [
+                      "unverified",
+                      "platform_reviewed",
+                      "identity_verified",
+                      "enterprise"
+                    ]
+                  },
+                  "notes": {
+                    "type": "string",
+                    "nullable": true,
+                    "description": "Internal review notes",
+                    "never public": null
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Tier set",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "agent_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "tier": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Unknown tier"
+          },
+          "403": {
+            "description": "Not a platform admin"
+          },
+          "404": {
+            "description": "Agent not found"
+          }
+        }
+      }
+    },
+    "/v1/admin/kms/relevel": {
+      "post": {
+        "tags": [
+          "Admin"
+        ],
+        "summary": "Move orgs onto the KEK protection level their tier and payment call for",
+        "description": "Platform admins only. Examines up to `limit` orgs whose stored KEK level disagrees with the target (Pro earns HSM only with an active subscription; Team, Business and Enterprise keep HSM; the platform org is always software) and starts a migration for each: a new key at the right level, every secret and every org-scoped row re-wrapped, the old key released from the keep set 30 days after completion. The nightly consolidation job runs the same pass, 25 orgs at a time.",
+        "operationId": "adminKmsRelevel",
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 500,
+              "default": 25
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Orgs examined and migrations started",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "examined": {
+                      "type": "integer"
+                    },
+                    "migrations_started": {
+                      "type": "integer"
+                    },
+                    "limit": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Not a platform admin"
+          }
+        }
+      }
+    },
     "/v1/admin/chains": {
       "get": {
         "tags": [
@@ -15471,6 +15649,89 @@
         }
       }
     },
+    "/v1/agents/{agent_id}/pay/grants/prepare": {
+      "post": {
+        "tags": [
+          "Pay"
+        ],
+        "summary": "Prepare a spending grant (step one of two)",
+        "description": "Fixes the grant terms and a server-side nonce and returns the `grant_digest` the person must assert over with a passkey (`action=x402_grant`). Then call `POST .../pay/grants` with the same terms, the digest, and the passkey token. Preparations are single-use, bound to the caller and agent, and expire after ten minutes. The nonce never leaves the server, so the digest cannot be recomputed for different terms. Human callers only; terms are validated against the agent's maximum cap and window here as well.\n",
+        "operationId": "preparePayGrant",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AgentId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "cap_usd",
+                  "ttl_secs"
+                ],
+                "properties": {
+                  "cap_usd": {
+                    "type": "string"
+                  },
+                  "ttl_secs": {
+                    "type": "integer"
+                  },
+                  "allowed_paytos": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The digest to assert over",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "grant_digest",
+                    "action",
+                    "expires_in_secs"
+                  ],
+                  "properties": {
+                    "grant_digest": {
+                      "type": "string"
+                    },
+                    "action": {
+                      "type": "string",
+                      "enum": [
+                        "x402_grant"
+                      ]
+                    },
+                    "expires_in_secs": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid terms"
+          },
+          "403": {
+            "description": "Not a human caller",
+            "grant mode disabled": null,
+            "or over the agent's maximum": null
+          }
+        }
+      }
+    },
     "/v1/agents/{agent_id}/pay/grants": {
       "post": {
         "tags": [

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.11"
+    version: "0.61.13"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -3846,6 +3846,97 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/admin/agents/{agent_id}/reports/dismiss:
+        post:
+            tags: [Admin]
+            summary: Dismiss every open report on a directory listing
+            description: >
+                Platform admins only. Clears the listing's report flag and
+                recounts. The review queue is a platform function — an org
+                dismissing reports against its own agent is the abuse the queue
+                exists to catch.
+            operationId: adminDismissAgentReports
+            parameters:
+                - name: agent_id
+                  in: path
+                  required: true
+                  schema: { type: string, format: uuid }
+            responses:
+                '200':
+                    description: Reports dismissed
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    agent_id: { type: string, format: uuid }
+                                    dismissed: { type: integer }
+                '403': { description: Not a platform admin }
+                '404': { description: Agent not found }
+    /v1/admin/agents/{agent_id}/verification-tier:
+        put:
+            tags: [Admin]
+            summary: Set a directory listing's verification tier
+            description: Platform admins only. Unknown tiers are refused rather than demoted to `unverified`.
+            operationId: adminSetAgentVerificationTier
+            parameters:
+                - name: agent_id
+                  in: path
+                  required: true
+                  schema: { type: string, format: uuid }
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [tier]
+                            properties:
+                                tier: { type: string, enum: [unverified, platform_reviewed, identity_verified, enterprise] }
+                                notes: { type: string, nullable: true, description: Internal review notes, never public }
+            responses:
+                '200':
+                    description: Tier set
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    agent_id: { type: string, format: uuid }
+                                    tier: { type: string }
+                '400': { description: Unknown tier }
+                '403': { description: Not a platform admin }
+                '404': { description: Agent not found }
+    /v1/admin/kms/relevel:
+        post:
+            tags: [Admin]
+            summary: Move orgs onto the KEK protection level their tier and payment call for
+            description: >-
+                Platform admins only. Examines up to `limit` orgs whose stored KEK
+                level disagrees with the target (Pro earns HSM only with an active
+                subscription; Team, Business and Enterprise keep HSM; the platform
+                org is always software) and starts a migration for each: a new key
+                at the right level, every secret and every org-scoped row re-wrapped,
+                the old key released from the keep set 30 days after completion.
+                The nightly consolidation job runs the same pass, 25 orgs at a time.
+            operationId: adminKmsRelevel
+            parameters:
+                - name: limit
+                  in: query
+                  required: false
+                  schema: { type: integer, minimum: 1, maximum: 500, default: 25 }
+            responses:
+                '200':
+                    description: Orgs examined and migrations started
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    examined: { type: integer }
+                                    migrations_started: { type: integer }
+                                    limit: { type: integer }
+                '403': { description: Not a platform admin }
     /v1/admin/chains:
         get:
             tags: [Chains]
@@ -9989,6 +10080,50 @@ paths:
                         ChallengeExpired. Re-fetch the resource for a fresh 402 and
                         prepare again — re-preparing from the stored bytes would
                         reproduce the same expired window.
+    /v1/agents/{agent_id}/pay/grants/prepare:
+        post:
+            tags: [Pay]
+            summary: Prepare a spending grant (step one of two)
+            description: >
+                Fixes the grant terms and a server-side nonce and returns the
+                `grant_digest` the person must assert over with a passkey
+                (`action=x402_grant`). Then call `POST .../pay/grants` with the
+                same terms, the digest, and the passkey token. Preparations are
+                single-use, bound to the caller and agent, and expire after ten
+                minutes. The nonce never leaves the server, so the digest cannot
+                be recomputed for different terms. Human callers only; terms are
+                validated against the agent's maximum cap and window here as well.
+            operationId: preparePayGrant
+            parameters:
+                - $ref: "#/components/parameters/AgentId"
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [cap_usd, ttl_secs]
+                            properties:
+                                cap_usd: { type: string }
+                                ttl_secs: { type: integer }
+                                allowed_paytos:
+                                    type: array
+                                    items: { type: string }
+                                    nullable: true
+            responses:
+                '200':
+                    description: The digest to assert over
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                required: [grant_digest, action, expires_in_secs]
+                                properties:
+                                    grant_digest: { type: string }
+                                    action: { type: string, enum: [x402_grant] }
+                                    expires_in_secs: { type: integer }
+                '400': { description: Invalid terms }
+                '403': { description: Not a human caller, grant mode disabled, or over the agent's maximum }
     /v1/agents/{agent_id}/pay/grants:
         post:
             tags: [Pay]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.11",
+  "version": "0.61.13",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {