@1claw/openapi-spec 0.61.13 → 0.61.15

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.13",
+    "version": "0.61.15",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -1318,6 +1318,76 @@
         }
       }
     },
+    "/v1/auth/feature-quota/consume": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Count one call against a per-user feature quota",
+        "description": "Atomic fixed-window counter for metered dashboard features (currently\n`voice_brief`, 30 calls per hour). The limit and window are defined\nserver-side; the caller only names the feature. Users only.\n",
+        "operationId": "consumeFeatureQuota",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "feature"
+                ],
+                "properties": {
+                  "feature": {
+                    "type": "string",
+                    "enum": [
+                      "voice_brief"
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Whether this call is within the window's limit",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "allowed",
+                    "limit",
+                    "remaining",
+                    "reset_at"
+                  ],
+                  "properties": {
+                    "allowed": {
+                      "type": "boolean"
+                    },
+                    "limit": {
+                      "type": "integer"
+                    },
+                    "remaining": {
+                      "type": "integer"
+                    },
+                    "reset_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
     "/v1/auth/me": {
       "get": {
         "tags": [
@@ -13430,6 +13500,47 @@
             "$ref": "#/components/responses/NotFound"
           }
         }
+      },
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Delete a connection runtime (plt_ scoped)",
+        "description": "Removes a runtime the app provisioned on this connection. A running\nruntime is stopped at the provider first and any runtime add-on\nsubscription is cancelled before the record is removed. Scoped like\nthe GET: the connection must belong to the app and list the runtime.\nThis is the cleanup path for a mis-provisioned runtime;\n`DELETE /v1/runtimes/{id}` does not accept a plt_ key.\n",
+        "operationId": "deleteConnectionRuntime",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "in": "path",
+            "name": "runtimeId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Runtime deleted"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
       }
     },
     "/v1/platform/connections/{connectionId}/passkeys/enroll/begin": {

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.13"
+    version: "0.61.15"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -914,6 +914,43 @@ paths:
                 "403":
                     $ref: "#/components/responses/Forbidden"
 
+    /v1/auth/feature-quota/consume:
+        post:
+            tags: [Authentication]
+            summary: Count one call against a per-user feature quota
+            description: |
+                Atomic fixed-window counter for metered dashboard features (currently
+                `voice_brief`, 30 calls per hour). The limit and window are defined
+                server-side; the caller only names the feature. Users only.
+            operationId: consumeFeatureQuota
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [feature]
+                            properties:
+                                feature:
+                                    type: string
+                                    enum: [voice_brief]
+            responses:
+                "200":
+                    description: Whether this call is within the window's limit
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                required: [allowed, limit, remaining, reset_at]
+                                properties:
+                                    allowed: { type: boolean }
+                                    limit: { type: integer }
+                                    remaining: { type: integer }
+                                    reset_at: { type: string, format: date-time }
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
     /v1/auth/me:
         get:
             tags: [Authentication]
@@ -8648,6 +8685,37 @@ paths:
                                 $ref: "#/components/schemas/RuntimeResponse"
                 "404":
                     $ref: "#/components/responses/NotFound"
+        delete:
+            tags: [Platform]
+            summary: Delete a connection runtime (plt_ scoped)
+            description: |
+                Removes a runtime the app provisioned on this connection. A running
+                runtime is stopped at the provider first and any runtime add-on
+                subscription is cancelled before the record is removed. Scoped like
+                the GET: the connection must belong to the app and list the runtime.
+                This is the cleanup path for a mis-provisioned runtime;
+                `DELETE /v1/runtimes/{id}` does not accept a plt_ key.
+            operationId: deleteConnectionRuntime
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+                - in: path
+                  name: runtimeId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            responses:
+                "204":
+                    description: Runtime deleted
+                "404":
+                    $ref: "#/components/responses/NotFound"
 
     /v1/platform/connections/{connectionId}/passkeys/enroll/begin:
         post:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.13",
+  "version": "0.61.15",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {