@1claw/openapi-spec 0.61.16 → 0.61.17

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.16",
+    "version": "0.61.17",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -28410,6 +28410,70 @@
               "totp",
               "passkey"
             ]
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Agent token exchange only — the resolved agent id."
+          },
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "description": "Agent token exchange only — vaults the agent is bound to."
+          },
+          "entitlements": {
+            "$ref": "#/components/schemas/AgentEntitlements"
+          }
+        }
+      },
+      "AgentEntitlements": {
+        "type": "object",
+        "description": "Returned on agent token exchange. The flags a client needs to decide which tools to offer, as of the moment the token was minted. treasury_signer and has_delegations are derived from the agent's treasury signer rows and active delegations and are not present on the agent profile.",
+        "required": [
+          "intents_api",
+          "execution_intents",
+          "execution_require_tee",
+          "intents_require_tee",
+          "cards",
+          "memory",
+          "shroud",
+          "discoverable",
+          "treasury_signer",
+          "has_delegations"
+        ],
+        "properties": {
+          "intents_api": {
+            "type": "boolean"
+          },
+          "execution_intents": {
+            "type": "boolean"
+          },
+          "execution_require_tee": {
+            "type": "boolean"
+          },
+          "intents_require_tee": {
+            "type": "boolean"
+          },
+          "cards": {
+            "type": "boolean"
+          },
+          "memory": {
+            "type": "boolean"
+          },
+          "shroud": {
+            "type": "boolean"
+          },
+          "discoverable": {
+            "type": "boolean"
+          },
+          "treasury_signer": {
+            "type": "boolean"
+          },
+          "has_delegations": {
+            "type": "boolean"
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.16"
+    version: "0.61.17"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -18160,6 +18160,39 @@ components:
                 mfa_method:
                     type: string
                     enum: [totp, passkey]
+                agent_id:
+                    type: string
+                    format: uuid
+                    description: Agent token exchange only — the resolved agent id.
+                vault_ids:
+                    type: array
+                    items: { type: string, format: uuid }
+                    description: Agent token exchange only — vaults the agent is bound to.
+                entitlements:
+                    $ref: "#/components/schemas/AgentEntitlements"
+
+        AgentEntitlements:
+            type: object
+            description: >-
+                Returned on agent token exchange. The flags a client needs to
+                decide which tools to offer, as of the moment the token was
+                minted. treasury_signer and has_delegations are derived from the
+                agent's treasury signer rows and active delegations and are not
+                present on the agent profile.
+            required:
+                [intents_api, execution_intents, execution_require_tee, intents_require_tee,
+                 cards, memory, shroud, discoverable, treasury_signer, has_delegations]
+            properties:
+                intents_api: { type: boolean }
+                execution_intents: { type: boolean }
+                execution_require_tee: { type: boolean }
+                intents_require_tee: { type: boolean }
+                cards: { type: boolean }
+                memory: { type: boolean }
+                shroud: { type: boolean }
+                discoverable: { type: boolean }
+                treasury_signer: { type: boolean }
+                has_delegations: { type: boolean }
 
         AgentTokenRequest:
             type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.16",
+  "version": "0.61.17",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {