@1claw/openapi-spec 0.61.16 → 0.61.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +411 -1
- package/openapi.yaml +279 -1
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.18",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -99,6 +99,10 @@
|
|
|
99
99
|
"name": "Treasury Wallets",
|
|
100
100
|
"description": "Multi-chain wallet generation for human users (replaces CDP embedded wallets)"
|
|
101
101
|
},
|
|
102
|
+
{
|
|
103
|
+
"name": "Key Custody",
|
|
104
|
+
"description": "Customer-held key shares for non-custodial (threshold) signing keys"
|
|
105
|
+
},
|
|
102
106
|
{
|
|
103
107
|
"name": "Admin",
|
|
104
108
|
"description": "Platform administration"
|
|
@@ -1172,6 +1176,11 @@
|
|
|
1172
1176
|
},
|
|
1173
1177
|
"created_at": {
|
|
1174
1178
|
"type": "string"
|
|
1179
|
+
},
|
|
1180
|
+
"prf_supported": {
|
|
1181
|
+
"type": "boolean",
|
|
1182
|
+
"nullable": true,
|
|
1183
|
+
"description": "`true` — can hold a wallet share (WebAuthn PRF).\n`false` — cannot. `null` — registered before this\nwas captured.\n"
|
|
1175
1184
|
}
|
|
1176
1185
|
}
|
|
1177
1186
|
}
|
|
@@ -8413,6 +8422,213 @@
|
|
|
8413
8422
|
}
|
|
8414
8423
|
}
|
|
8415
8424
|
},
|
|
8425
|
+
"/v1/keys/{key_id}/client-share": {
|
|
8426
|
+
"parameters": [
|
|
8427
|
+
{
|
|
8428
|
+
"name": "key_id",
|
|
8429
|
+
"in": "path",
|
|
8430
|
+
"required": true,
|
|
8431
|
+
"description": "A treasury wallet id or an agent signing key id owned by the caller's org",
|
|
8432
|
+
"schema": {
|
|
8433
|
+
"type": "string",
|
|
8434
|
+
"format": "uuid"
|
|
8435
|
+
}
|
|
8436
|
+
}
|
|
8437
|
+
],
|
|
8438
|
+
"put": {
|
|
8439
|
+
"tags": [
|
|
8440
|
+
"Key Custody"
|
|
8441
|
+
],
|
|
8442
|
+
"summary": "Store the customer's wrapped share of a threshold key",
|
|
8443
|
+
"description": "Stores ciphertext the vault cannot open: the customer's share of a\n2-party threshold signing key, wrapped in the browser under the\npasskey's WebAuthn PRF output (`passkey_prf`, one wrap per credential)\nor under a recovery code (`recovery_code`, one per key). The vault\nkeeps the blob and its salt and returns them only to the owning user.\nHuman users only; the passkey must have reported PRF support at\nregistration. Idempotent per (key, credential).\n",
|
|
8444
|
+
"operationId": "putClientKeyShare",
|
|
8445
|
+
"security": [
|
|
8446
|
+
{
|
|
8447
|
+
"BearerAuth": []
|
|
8448
|
+
}
|
|
8449
|
+
],
|
|
8450
|
+
"requestBody": {
|
|
8451
|
+
"required": true,
|
|
8452
|
+
"content": {
|
|
8453
|
+
"application/json": {
|
|
8454
|
+
"schema": {
|
|
8455
|
+
"$ref": "#/components/schemas/PutClientShareRequest"
|
|
8456
|
+
}
|
|
8457
|
+
}
|
|
8458
|
+
}
|
|
8459
|
+
},
|
|
8460
|
+
"responses": {
|
|
8461
|
+
"201": {
|
|
8462
|
+
"description": "Share stored",
|
|
8463
|
+
"content": {
|
|
8464
|
+
"application/json": {
|
|
8465
|
+
"schema": {
|
|
8466
|
+
"$ref": "#/components/schemas/ClientShareResponse"
|
|
8467
|
+
}
|
|
8468
|
+
}
|
|
8469
|
+
}
|
|
8470
|
+
},
|
|
8471
|
+
"400": {
|
|
8472
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8473
|
+
},
|
|
8474
|
+
"401": {
|
|
8475
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8476
|
+
},
|
|
8477
|
+
"403": {
|
|
8478
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8479
|
+
},
|
|
8480
|
+
"404": {
|
|
8481
|
+
"$ref": "#/components/responses/NotFound"
|
|
8482
|
+
}
|
|
8483
|
+
}
|
|
8484
|
+
},
|
|
8485
|
+
"get": {
|
|
8486
|
+
"tags": [
|
|
8487
|
+
"Key Custody"
|
|
8488
|
+
],
|
|
8489
|
+
"summary": "List the caller's wrapped shares for a key",
|
|
8490
|
+
"description": "Returns every wrap on file for this key, unopened, to the user who\nstored them. `custody` tells you whether the key is `server` (1claw\nholds the whole private key) or `client_tss` (threshold; neither party\ncan sign alone). Funding a `client_tss` wallet needs at least two wraps.\n",
|
|
8491
|
+
"operationId": "listClientKeyShares",
|
|
8492
|
+
"security": [
|
|
8493
|
+
{
|
|
8494
|
+
"BearerAuth": []
|
|
8495
|
+
}
|
|
8496
|
+
],
|
|
8497
|
+
"responses": {
|
|
8498
|
+
"200": {
|
|
8499
|
+
"description": "Wraps on file",
|
|
8500
|
+
"content": {
|
|
8501
|
+
"application/json": {
|
|
8502
|
+
"schema": {
|
|
8503
|
+
"$ref": "#/components/schemas/ClientShareListResponse"
|
|
8504
|
+
}
|
|
8505
|
+
}
|
|
8506
|
+
}
|
|
8507
|
+
},
|
|
8508
|
+
"401": {
|
|
8509
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8510
|
+
},
|
|
8511
|
+
"403": {
|
|
8512
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8513
|
+
},
|
|
8514
|
+
"404": {
|
|
8515
|
+
"$ref": "#/components/responses/NotFound"
|
|
8516
|
+
}
|
|
8517
|
+
}
|
|
8518
|
+
}
|
|
8519
|
+
},
|
|
8520
|
+
"/v1/keys/{key_id}/client-share/rewrap": {
|
|
8521
|
+
"parameters": [
|
|
8522
|
+
{
|
|
8523
|
+
"name": "key_id",
|
|
8524
|
+
"in": "path",
|
|
8525
|
+
"required": true,
|
|
8526
|
+
"schema": {
|
|
8527
|
+
"type": "string",
|
|
8528
|
+
"format": "uuid"
|
|
8529
|
+
}
|
|
8530
|
+
}
|
|
8531
|
+
],
|
|
8532
|
+
"post": {
|
|
8533
|
+
"tags": [
|
|
8534
|
+
"Key Custody"
|
|
8535
|
+
],
|
|
8536
|
+
"summary": "Add a wrap for another credential or the recovery code",
|
|
8537
|
+
"description": "Same write as `PUT …/client-share`, for a key that already has at\nleast one wrap: the browser, holding the share in memory during a\npasskey session, re-wraps it under a newly added passkey's PRF\noutput or under the recovery code. 409 if no wrap exists yet.\n",
|
|
8538
|
+
"operationId": "rewrapClientKeyShare",
|
|
8539
|
+
"security": [
|
|
8540
|
+
{
|
|
8541
|
+
"BearerAuth": []
|
|
8542
|
+
}
|
|
8543
|
+
],
|
|
8544
|
+
"requestBody": {
|
|
8545
|
+
"required": true,
|
|
8546
|
+
"content": {
|
|
8547
|
+
"application/json": {
|
|
8548
|
+
"schema": {
|
|
8549
|
+
"$ref": "#/components/schemas/PutClientShareRequest"
|
|
8550
|
+
}
|
|
8551
|
+
}
|
|
8552
|
+
}
|
|
8553
|
+
},
|
|
8554
|
+
"responses": {
|
|
8555
|
+
"201": {
|
|
8556
|
+
"description": "Wrap added",
|
|
8557
|
+
"content": {
|
|
8558
|
+
"application/json": {
|
|
8559
|
+
"schema": {
|
|
8560
|
+
"$ref": "#/components/schemas/ClientShareResponse"
|
|
8561
|
+
}
|
|
8562
|
+
}
|
|
8563
|
+
}
|
|
8564
|
+
},
|
|
8565
|
+
"400": {
|
|
8566
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8567
|
+
},
|
|
8568
|
+
"401": {
|
|
8569
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8570
|
+
},
|
|
8571
|
+
"403": {
|
|
8572
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8573
|
+
},
|
|
8574
|
+
"404": {
|
|
8575
|
+
"$ref": "#/components/responses/NotFound"
|
|
8576
|
+
},
|
|
8577
|
+
"409": {
|
|
8578
|
+
"$ref": "#/components/responses/Conflict"
|
|
8579
|
+
}
|
|
8580
|
+
}
|
|
8581
|
+
}
|
|
8582
|
+
},
|
|
8583
|
+
"/v1/keys/{key_id}/client-share/{share_id}": {
|
|
8584
|
+
"parameters": [
|
|
8585
|
+
{
|
|
8586
|
+
"name": "key_id",
|
|
8587
|
+
"in": "path",
|
|
8588
|
+
"required": true,
|
|
8589
|
+
"schema": {
|
|
8590
|
+
"type": "string",
|
|
8591
|
+
"format": "uuid"
|
|
8592
|
+
}
|
|
8593
|
+
},
|
|
8594
|
+
{
|
|
8595
|
+
"name": "share_id",
|
|
8596
|
+
"in": "path",
|
|
8597
|
+
"required": true,
|
|
8598
|
+
"schema": {
|
|
8599
|
+
"type": "string",
|
|
8600
|
+
"format": "uuid"
|
|
8601
|
+
}
|
|
8602
|
+
}
|
|
8603
|
+
],
|
|
8604
|
+
"delete": {
|
|
8605
|
+
"tags": [
|
|
8606
|
+
"Key Custody"
|
|
8607
|
+
],
|
|
8608
|
+
"summary": "Remove one wrap",
|
|
8609
|
+
"description": "Deletes a single wrap. Wraps tied to a passkey are also removed when\nthat passkey is deleted. Removing the last wrap of a `client_tss` key\nmakes the key unrecoverable — the vault holds only its own share.\n",
|
|
8610
|
+
"operationId": "deleteClientKeyShare",
|
|
8611
|
+
"security": [
|
|
8612
|
+
{
|
|
8613
|
+
"BearerAuth": []
|
|
8614
|
+
}
|
|
8615
|
+
],
|
|
8616
|
+
"responses": {
|
|
8617
|
+
"204": {
|
|
8618
|
+
"description": "Wrap removed"
|
|
8619
|
+
},
|
|
8620
|
+
"401": {
|
|
8621
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8622
|
+
},
|
|
8623
|
+
"403": {
|
|
8624
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8625
|
+
},
|
|
8626
|
+
"404": {
|
|
8627
|
+
"$ref": "#/components/responses/NotFound"
|
|
8628
|
+
}
|
|
8629
|
+
}
|
|
8630
|
+
}
|
|
8631
|
+
},
|
|
8416
8632
|
"/v1/treasury/wallets/generate": {
|
|
8417
8633
|
"post": {
|
|
8418
8634
|
"tags": [
|
|
@@ -28410,6 +28626,70 @@
|
|
|
28410
28626
|
"totp",
|
|
28411
28627
|
"passkey"
|
|
28412
28628
|
]
|
|
28629
|
+
},
|
|
28630
|
+
"agent_id": {
|
|
28631
|
+
"type": "string",
|
|
28632
|
+
"format": "uuid",
|
|
28633
|
+
"description": "Agent token exchange only — the resolved agent id."
|
|
28634
|
+
},
|
|
28635
|
+
"vault_ids": {
|
|
28636
|
+
"type": "array",
|
|
28637
|
+
"items": {
|
|
28638
|
+
"type": "string",
|
|
28639
|
+
"format": "uuid"
|
|
28640
|
+
},
|
|
28641
|
+
"description": "Agent token exchange only — vaults the agent is bound to."
|
|
28642
|
+
},
|
|
28643
|
+
"entitlements": {
|
|
28644
|
+
"$ref": "#/components/schemas/AgentEntitlements"
|
|
28645
|
+
}
|
|
28646
|
+
}
|
|
28647
|
+
},
|
|
28648
|
+
"AgentEntitlements": {
|
|
28649
|
+
"type": "object",
|
|
28650
|
+
"description": "Returned on agent token exchange. The flags a client needs to decide which tools to offer, as of the moment the token was minted. treasury_signer and has_delegations are derived from the agent's treasury signer rows and active delegations and are not present on the agent profile.",
|
|
28651
|
+
"required": [
|
|
28652
|
+
"intents_api",
|
|
28653
|
+
"execution_intents",
|
|
28654
|
+
"execution_require_tee",
|
|
28655
|
+
"intents_require_tee",
|
|
28656
|
+
"cards",
|
|
28657
|
+
"memory",
|
|
28658
|
+
"shroud",
|
|
28659
|
+
"discoverable",
|
|
28660
|
+
"treasury_signer",
|
|
28661
|
+
"has_delegations"
|
|
28662
|
+
],
|
|
28663
|
+
"properties": {
|
|
28664
|
+
"intents_api": {
|
|
28665
|
+
"type": "boolean"
|
|
28666
|
+
},
|
|
28667
|
+
"execution_intents": {
|
|
28668
|
+
"type": "boolean"
|
|
28669
|
+
},
|
|
28670
|
+
"execution_require_tee": {
|
|
28671
|
+
"type": "boolean"
|
|
28672
|
+
},
|
|
28673
|
+
"intents_require_tee": {
|
|
28674
|
+
"type": "boolean"
|
|
28675
|
+
},
|
|
28676
|
+
"cards": {
|
|
28677
|
+
"type": "boolean"
|
|
28678
|
+
},
|
|
28679
|
+
"memory": {
|
|
28680
|
+
"type": "boolean"
|
|
28681
|
+
},
|
|
28682
|
+
"shroud": {
|
|
28683
|
+
"type": "boolean"
|
|
28684
|
+
},
|
|
28685
|
+
"discoverable": {
|
|
28686
|
+
"type": "boolean"
|
|
28687
|
+
},
|
|
28688
|
+
"treasury_signer": {
|
|
28689
|
+
"type": "boolean"
|
|
28690
|
+
},
|
|
28691
|
+
"has_delegations": {
|
|
28692
|
+
"type": "boolean"
|
|
28413
28693
|
}
|
|
28414
28694
|
}
|
|
28415
28695
|
},
|
|
@@ -31893,6 +32173,14 @@
|
|
|
31893
32173
|
"type": "string",
|
|
31894
32174
|
"format": "date-time",
|
|
31895
32175
|
"nullable": true
|
|
32176
|
+
},
|
|
32177
|
+
"custody": {
|
|
32178
|
+
"type": "string",
|
|
32179
|
+
"enum": [
|
|
32180
|
+
"server",
|
|
32181
|
+
"client_tss"
|
|
32182
|
+
],
|
|
32183
|
+
"description": "`server` — 1claw holds the whole private key and can sign alone.\n`client_tss` — 2-party threshold key; the customer's passkey share is required.\n"
|
|
31896
32184
|
}
|
|
31897
32185
|
}
|
|
31898
32186
|
},
|
|
@@ -34396,6 +34684,14 @@
|
|
|
34396
34684
|
"created_at": {
|
|
34397
34685
|
"type": "string",
|
|
34398
34686
|
"format": "date-time"
|
|
34687
|
+
},
|
|
34688
|
+
"custody": {
|
|
34689
|
+
"type": "string",
|
|
34690
|
+
"enum": [
|
|
34691
|
+
"server",
|
|
34692
|
+
"client_tss"
|
|
34693
|
+
],
|
|
34694
|
+
"description": "`server` — 1claw holds the whole private key and can sign alone.\n`client_tss` — 2-party threshold key; the customer's passkey share is required.\n"
|
|
34399
34695
|
}
|
|
34400
34696
|
}
|
|
34401
34697
|
},
|
|
@@ -38097,6 +38393,120 @@
|
|
|
38097
38393
|
},
|
|
38098
38394
|
"name": {
|
|
38099
38395
|
"type": "string"
|
|
38396
|
+
},
|
|
38397
|
+
"prf_supported": {
|
|
38398
|
+
"type": "boolean",
|
|
38399
|
+
"nullable": true,
|
|
38400
|
+
"description": "`prf.enabled` from `credential.getClientExtensionResults()` —\nwhether this authenticator can derive the secret that wraps a\nwallet share. Omit if the client did not request the extension.\n"
|
|
38401
|
+
}
|
|
38402
|
+
}
|
|
38403
|
+
},
|
|
38404
|
+
"PutClientShareRequest": {
|
|
38405
|
+
"type": "object",
|
|
38406
|
+
"required": [
|
|
38407
|
+
"wrap_kind",
|
|
38408
|
+
"wrapped_share",
|
|
38409
|
+
"salt"
|
|
38410
|
+
],
|
|
38411
|
+
"properties": {
|
|
38412
|
+
"wrap_kind": {
|
|
38413
|
+
"type": "string",
|
|
38414
|
+
"enum": [
|
|
38415
|
+
"passkey_prf",
|
|
38416
|
+
"recovery_code"
|
|
38417
|
+
]
|
|
38418
|
+
},
|
|
38419
|
+
"credential_id": {
|
|
38420
|
+
"type": "string",
|
|
38421
|
+
"format": "uuid",
|
|
38422
|
+
"nullable": true,
|
|
38423
|
+
"description": "Required for `passkey_prf`; the passkey id from `GET /v1/auth/passkeys`."
|
|
38424
|
+
},
|
|
38425
|
+
"wrapped_share": {
|
|
38426
|
+
"type": "string",
|
|
38427
|
+
"description": "Base64 ciphertext (≤ 4 KiB). Opaque to the vault."
|
|
38428
|
+
},
|
|
38429
|
+
"salt": {
|
|
38430
|
+
"type": "string",
|
|
38431
|
+
"description": "Base64 PRF salt, 16–64 random bytes, one per key."
|
|
38432
|
+
}
|
|
38433
|
+
}
|
|
38434
|
+
},
|
|
38435
|
+
"ClientShareResponse": {
|
|
38436
|
+
"type": "object",
|
|
38437
|
+
"properties": {
|
|
38438
|
+
"id": {
|
|
38439
|
+
"type": "string",
|
|
38440
|
+
"format": "uuid"
|
|
38441
|
+
},
|
|
38442
|
+
"key_id": {
|
|
38443
|
+
"type": "string",
|
|
38444
|
+
"format": "uuid"
|
|
38445
|
+
},
|
|
38446
|
+
"key_kind": {
|
|
38447
|
+
"type": "string",
|
|
38448
|
+
"enum": [
|
|
38449
|
+
"agent_signing_key",
|
|
38450
|
+
"treasury_wallet"
|
|
38451
|
+
]
|
|
38452
|
+
},
|
|
38453
|
+
"wrap_kind": {
|
|
38454
|
+
"type": "string",
|
|
38455
|
+
"enum": [
|
|
38456
|
+
"passkey_prf",
|
|
38457
|
+
"recovery_code"
|
|
38458
|
+
]
|
|
38459
|
+
},
|
|
38460
|
+
"credential_id": {
|
|
38461
|
+
"type": "string",
|
|
38462
|
+
"format": "uuid",
|
|
38463
|
+
"nullable": true
|
|
38464
|
+
},
|
|
38465
|
+
"wrapped_share": {
|
|
38466
|
+
"type": "string",
|
|
38467
|
+
"description": "Base64, exactly as stored."
|
|
38468
|
+
},
|
|
38469
|
+
"salt": {
|
|
38470
|
+
"type": "string",
|
|
38471
|
+
"description": "Base64."
|
|
38472
|
+
},
|
|
38473
|
+
"created_at": {
|
|
38474
|
+
"type": "string",
|
|
38475
|
+
"format": "date-time"
|
|
38476
|
+
},
|
|
38477
|
+
"updated_at": {
|
|
38478
|
+
"type": "string",
|
|
38479
|
+
"format": "date-time"
|
|
38480
|
+
}
|
|
38481
|
+
}
|
|
38482
|
+
},
|
|
38483
|
+
"ClientShareListResponse": {
|
|
38484
|
+
"type": "object",
|
|
38485
|
+
"properties": {
|
|
38486
|
+
"key_id": {
|
|
38487
|
+
"type": "string",
|
|
38488
|
+
"format": "uuid"
|
|
38489
|
+
},
|
|
38490
|
+
"key_kind": {
|
|
38491
|
+
"type": "string",
|
|
38492
|
+
"enum": [
|
|
38493
|
+
"agent_signing_key",
|
|
38494
|
+
"treasury_wallet"
|
|
38495
|
+
]
|
|
38496
|
+
},
|
|
38497
|
+
"custody": {
|
|
38498
|
+
"type": "string",
|
|
38499
|
+
"enum": [
|
|
38500
|
+
"server",
|
|
38501
|
+
"client_tss"
|
|
38502
|
+
],
|
|
38503
|
+
"description": "`server` — 1claw holds the whole private key and can sign alone.\n`client_tss` — 2-party threshold key; the customer's share is required.\n"
|
|
38504
|
+
},
|
|
38505
|
+
"shares": {
|
|
38506
|
+
"type": "array",
|
|
38507
|
+
"items": {
|
|
38508
|
+
"$ref": "#/components/schemas/ClientShareResponse"
|
|
38509
|
+
}
|
|
38100
38510
|
}
|
|
38101
38511
|
}
|
|
38102
38512
|
},
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.18"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -80,6 +80,8 @@ tags:
|
|
|
80
80
|
description: Multi-sig treasury wallets (Safe) and agent access requests
|
|
81
81
|
- name: Treasury Wallets
|
|
82
82
|
description: Multi-chain wallet generation for human users (replaces CDP embedded wallets)
|
|
83
|
+
- name: Key Custody
|
|
84
|
+
description: Customer-held key shares for non-custodial (threshold) signing keys
|
|
83
85
|
- name: Admin
|
|
84
86
|
description: Platform administration
|
|
85
87
|
- name: Health
|
|
@@ -801,6 +803,13 @@ paths:
|
|
|
801
803
|
type: string
|
|
802
804
|
created_at:
|
|
803
805
|
type: string
|
|
806
|
+
prf_supported:
|
|
807
|
+
type: boolean
|
|
808
|
+
nullable: true
|
|
809
|
+
description: |
|
|
810
|
+
`true` — can hold a wallet share (WebAuthn PRF).
|
|
811
|
+
`false` — cannot. `null` — registered before this
|
|
812
|
+
was captured.
|
|
804
813
|
|
|
805
814
|
/v1/auth/passkeys/{passkey_id}:
|
|
806
815
|
delete:
|
|
@@ -5442,6 +5451,152 @@ paths:
|
|
|
5442
5451
|
# Treasury Wallets (multi-chain key generation for human users)
|
|
5443
5452
|
# ---------------------------------------------------------------------------
|
|
5444
5453
|
|
|
5454
|
+
/v1/keys/{key_id}/client-share:
|
|
5455
|
+
parameters:
|
|
5456
|
+
- name: key_id
|
|
5457
|
+
in: path
|
|
5458
|
+
required: true
|
|
5459
|
+
description: A treasury wallet id or an agent signing key id owned by the caller's org
|
|
5460
|
+
schema:
|
|
5461
|
+
type: string
|
|
5462
|
+
format: uuid
|
|
5463
|
+
put:
|
|
5464
|
+
tags: [Key Custody]
|
|
5465
|
+
summary: Store the customer's wrapped share of a threshold key
|
|
5466
|
+
description: |
|
|
5467
|
+
Stores ciphertext the vault cannot open: the customer's share of a
|
|
5468
|
+
2-party threshold signing key, wrapped in the browser under the
|
|
5469
|
+
passkey's WebAuthn PRF output (`passkey_prf`, one wrap per credential)
|
|
5470
|
+
or under a recovery code (`recovery_code`, one per key). The vault
|
|
5471
|
+
keeps the blob and its salt and returns them only to the owning user.
|
|
5472
|
+
Human users only; the passkey must have reported PRF support at
|
|
5473
|
+
registration. Idempotent per (key, credential).
|
|
5474
|
+
operationId: putClientKeyShare
|
|
5475
|
+
security:
|
|
5476
|
+
- BearerAuth: []
|
|
5477
|
+
requestBody:
|
|
5478
|
+
required: true
|
|
5479
|
+
content:
|
|
5480
|
+
application/json:
|
|
5481
|
+
schema:
|
|
5482
|
+
$ref: "#/components/schemas/PutClientShareRequest"
|
|
5483
|
+
responses:
|
|
5484
|
+
"201":
|
|
5485
|
+
description: Share stored
|
|
5486
|
+
content:
|
|
5487
|
+
application/json:
|
|
5488
|
+
schema:
|
|
5489
|
+
$ref: "#/components/schemas/ClientShareResponse"
|
|
5490
|
+
"400":
|
|
5491
|
+
$ref: "#/components/responses/BadRequest"
|
|
5492
|
+
"401":
|
|
5493
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5494
|
+
"403":
|
|
5495
|
+
$ref: "#/components/responses/Forbidden"
|
|
5496
|
+
"404":
|
|
5497
|
+
$ref: "#/components/responses/NotFound"
|
|
5498
|
+
get:
|
|
5499
|
+
tags: [Key Custody]
|
|
5500
|
+
summary: List the caller's wrapped shares for a key
|
|
5501
|
+
description: |
|
|
5502
|
+
Returns every wrap on file for this key, unopened, to the user who
|
|
5503
|
+
stored them. `custody` tells you whether the key is `server` (1claw
|
|
5504
|
+
holds the whole private key) or `client_tss` (threshold; neither party
|
|
5505
|
+
can sign alone). Funding a `client_tss` wallet needs at least two wraps.
|
|
5506
|
+
operationId: listClientKeyShares
|
|
5507
|
+
security:
|
|
5508
|
+
- BearerAuth: []
|
|
5509
|
+
responses:
|
|
5510
|
+
"200":
|
|
5511
|
+
description: Wraps on file
|
|
5512
|
+
content:
|
|
5513
|
+
application/json:
|
|
5514
|
+
schema:
|
|
5515
|
+
$ref: "#/components/schemas/ClientShareListResponse"
|
|
5516
|
+
"401":
|
|
5517
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5518
|
+
"403":
|
|
5519
|
+
$ref: "#/components/responses/Forbidden"
|
|
5520
|
+
"404":
|
|
5521
|
+
$ref: "#/components/responses/NotFound"
|
|
5522
|
+
|
|
5523
|
+
/v1/keys/{key_id}/client-share/rewrap:
|
|
5524
|
+
parameters:
|
|
5525
|
+
- name: key_id
|
|
5526
|
+
in: path
|
|
5527
|
+
required: true
|
|
5528
|
+
schema:
|
|
5529
|
+
type: string
|
|
5530
|
+
format: uuid
|
|
5531
|
+
post:
|
|
5532
|
+
tags: [Key Custody]
|
|
5533
|
+
summary: Add a wrap for another credential or the recovery code
|
|
5534
|
+
description: |
|
|
5535
|
+
Same write as `PUT …/client-share`, for a key that already has at
|
|
5536
|
+
least one wrap: the browser, holding the share in memory during a
|
|
5537
|
+
passkey session, re-wraps it under a newly added passkey's PRF
|
|
5538
|
+
output or under the recovery code. 409 if no wrap exists yet.
|
|
5539
|
+
operationId: rewrapClientKeyShare
|
|
5540
|
+
security:
|
|
5541
|
+
- BearerAuth: []
|
|
5542
|
+
requestBody:
|
|
5543
|
+
required: true
|
|
5544
|
+
content:
|
|
5545
|
+
application/json:
|
|
5546
|
+
schema:
|
|
5547
|
+
$ref: "#/components/schemas/PutClientShareRequest"
|
|
5548
|
+
responses:
|
|
5549
|
+
"201":
|
|
5550
|
+
description: Wrap added
|
|
5551
|
+
content:
|
|
5552
|
+
application/json:
|
|
5553
|
+
schema:
|
|
5554
|
+
$ref: "#/components/schemas/ClientShareResponse"
|
|
5555
|
+
"400":
|
|
5556
|
+
$ref: "#/components/responses/BadRequest"
|
|
5557
|
+
"401":
|
|
5558
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5559
|
+
"403":
|
|
5560
|
+
$ref: "#/components/responses/Forbidden"
|
|
5561
|
+
"404":
|
|
5562
|
+
$ref: "#/components/responses/NotFound"
|
|
5563
|
+
"409":
|
|
5564
|
+
$ref: "#/components/responses/Conflict"
|
|
5565
|
+
|
|
5566
|
+
/v1/keys/{key_id}/client-share/{share_id}:
|
|
5567
|
+
parameters:
|
|
5568
|
+
- name: key_id
|
|
5569
|
+
in: path
|
|
5570
|
+
required: true
|
|
5571
|
+
schema:
|
|
5572
|
+
type: string
|
|
5573
|
+
format: uuid
|
|
5574
|
+
- name: share_id
|
|
5575
|
+
in: path
|
|
5576
|
+
required: true
|
|
5577
|
+
schema:
|
|
5578
|
+
type: string
|
|
5579
|
+
format: uuid
|
|
5580
|
+
delete:
|
|
5581
|
+
tags: [Key Custody]
|
|
5582
|
+
summary: Remove one wrap
|
|
5583
|
+
description: |
|
|
5584
|
+
Deletes a single wrap. Wraps tied to a passkey are also removed when
|
|
5585
|
+
that passkey is deleted. Removing the last wrap of a `client_tss` key
|
|
5586
|
+
makes the key unrecoverable — the vault holds only its own share.
|
|
5587
|
+
operationId: deleteClientKeyShare
|
|
5588
|
+
security:
|
|
5589
|
+
- BearerAuth: []
|
|
5590
|
+
responses:
|
|
5591
|
+
"204":
|
|
5592
|
+
description: Wrap removed
|
|
5593
|
+
"401":
|
|
5594
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5595
|
+
"403":
|
|
5596
|
+
$ref: "#/components/responses/Forbidden"
|
|
5597
|
+
"404":
|
|
5598
|
+
$ref: "#/components/responses/NotFound"
|
|
5599
|
+
|
|
5445
5600
|
/v1/treasury/wallets/generate:
|
|
5446
5601
|
post:
|
|
5447
5602
|
tags: [Treasury Wallets]
|
|
@@ -18160,6 +18315,39 @@ components:
|
|
|
18160
18315
|
mfa_method:
|
|
18161
18316
|
type: string
|
|
18162
18317
|
enum: [totp, passkey]
|
|
18318
|
+
agent_id:
|
|
18319
|
+
type: string
|
|
18320
|
+
format: uuid
|
|
18321
|
+
description: Agent token exchange only — the resolved agent id.
|
|
18322
|
+
vault_ids:
|
|
18323
|
+
type: array
|
|
18324
|
+
items: { type: string, format: uuid }
|
|
18325
|
+
description: Agent token exchange only — vaults the agent is bound to.
|
|
18326
|
+
entitlements:
|
|
18327
|
+
$ref: "#/components/schemas/AgentEntitlements"
|
|
18328
|
+
|
|
18329
|
+
AgentEntitlements:
|
|
18330
|
+
type: object
|
|
18331
|
+
description: >-
|
|
18332
|
+
Returned on agent token exchange. The flags a client needs to
|
|
18333
|
+
decide which tools to offer, as of the moment the token was
|
|
18334
|
+
minted. treasury_signer and has_delegations are derived from the
|
|
18335
|
+
agent's treasury signer rows and active delegations and are not
|
|
18336
|
+
present on the agent profile.
|
|
18337
|
+
required:
|
|
18338
|
+
[intents_api, execution_intents, execution_require_tee, intents_require_tee,
|
|
18339
|
+
cards, memory, shroud, discoverable, treasury_signer, has_delegations]
|
|
18340
|
+
properties:
|
|
18341
|
+
intents_api: { type: boolean }
|
|
18342
|
+
execution_intents: { type: boolean }
|
|
18343
|
+
execution_require_tee: { type: boolean }
|
|
18344
|
+
intents_require_tee: { type: boolean }
|
|
18345
|
+
cards: { type: boolean }
|
|
18346
|
+
memory: { type: boolean }
|
|
18347
|
+
shroud: { type: boolean }
|
|
18348
|
+
discoverable: { type: boolean }
|
|
18349
|
+
treasury_signer: { type: boolean }
|
|
18350
|
+
has_delegations: { type: boolean }
|
|
18163
18351
|
|
|
18164
18352
|
AgentTokenRequest:
|
|
18165
18353
|
type: object
|
|
@@ -20731,6 +20919,12 @@ components:
|
|
|
20731
20919
|
type: string
|
|
20732
20920
|
format: date-time
|
|
20733
20921
|
nullable: true
|
|
20922
|
+
custody:
|
|
20923
|
+
type: string
|
|
20924
|
+
enum: [server, client_tss]
|
|
20925
|
+
description: |
|
|
20926
|
+
`server` — 1claw holds the whole private key and can sign alone.
|
|
20927
|
+
`client_tss` — 2-party threshold key; the customer's passkey share is required.
|
|
20734
20928
|
|
|
20735
20929
|
SigningKeyListResponse:
|
|
20736
20930
|
type: object
|
|
@@ -22504,6 +22698,12 @@ components:
|
|
|
22504
22698
|
created_at:
|
|
22505
22699
|
type: string
|
|
22506
22700
|
format: date-time
|
|
22701
|
+
custody:
|
|
22702
|
+
type: string
|
|
22703
|
+
enum: [server, client_tss]
|
|
22704
|
+
description: |
|
|
22705
|
+
`server` — 1claw holds the whole private key and can sign alone.
|
|
22706
|
+
`client_tss` — 2-party threshold key; the customer's passkey share is required.
|
|
22507
22707
|
|
|
22508
22708
|
TreasuryWalletListResponse:
|
|
22509
22709
|
type: object
|
|
@@ -24879,6 +25079,84 @@ components:
|
|
|
24879
25079
|
type: string
|
|
24880
25080
|
name:
|
|
24881
25081
|
type: string
|
|
25082
|
+
prf_supported:
|
|
25083
|
+
type: boolean
|
|
25084
|
+
nullable: true
|
|
25085
|
+
description: |
|
|
25086
|
+
`prf.enabled` from `credential.getClientExtensionResults()` —
|
|
25087
|
+
whether this authenticator can derive the secret that wraps a
|
|
25088
|
+
wallet share. Omit if the client did not request the extension.
|
|
25089
|
+
|
|
25090
|
+
PutClientShareRequest:
|
|
25091
|
+
type: object
|
|
25092
|
+
required: [wrap_kind, wrapped_share, salt]
|
|
25093
|
+
properties:
|
|
25094
|
+
wrap_kind:
|
|
25095
|
+
type: string
|
|
25096
|
+
enum: [passkey_prf, recovery_code]
|
|
25097
|
+
credential_id:
|
|
25098
|
+
type: string
|
|
25099
|
+
format: uuid
|
|
25100
|
+
nullable: true
|
|
25101
|
+
description: Required for `passkey_prf`; the passkey id from `GET /v1/auth/passkeys`.
|
|
25102
|
+
wrapped_share:
|
|
25103
|
+
type: string
|
|
25104
|
+
description: Base64 ciphertext (≤ 4 KiB). Opaque to the vault.
|
|
25105
|
+
salt:
|
|
25106
|
+
type: string
|
|
25107
|
+
description: Base64 PRF salt, 16–64 random bytes, one per key.
|
|
25108
|
+
|
|
25109
|
+
ClientShareResponse:
|
|
25110
|
+
type: object
|
|
25111
|
+
properties:
|
|
25112
|
+
id:
|
|
25113
|
+
type: string
|
|
25114
|
+
format: uuid
|
|
25115
|
+
key_id:
|
|
25116
|
+
type: string
|
|
25117
|
+
format: uuid
|
|
25118
|
+
key_kind:
|
|
25119
|
+
type: string
|
|
25120
|
+
enum: [agent_signing_key, treasury_wallet]
|
|
25121
|
+
wrap_kind:
|
|
25122
|
+
type: string
|
|
25123
|
+
enum: [passkey_prf, recovery_code]
|
|
25124
|
+
credential_id:
|
|
25125
|
+
type: string
|
|
25126
|
+
format: uuid
|
|
25127
|
+
nullable: true
|
|
25128
|
+
wrapped_share:
|
|
25129
|
+
type: string
|
|
25130
|
+
description: Base64, exactly as stored.
|
|
25131
|
+
salt:
|
|
25132
|
+
type: string
|
|
25133
|
+
description: Base64.
|
|
25134
|
+
created_at:
|
|
25135
|
+
type: string
|
|
25136
|
+
format: date-time
|
|
25137
|
+
updated_at:
|
|
25138
|
+
type: string
|
|
25139
|
+
format: date-time
|
|
25140
|
+
|
|
25141
|
+
ClientShareListResponse:
|
|
25142
|
+
type: object
|
|
25143
|
+
properties:
|
|
25144
|
+
key_id:
|
|
25145
|
+
type: string
|
|
25146
|
+
format: uuid
|
|
25147
|
+
key_kind:
|
|
25148
|
+
type: string
|
|
25149
|
+
enum: [agent_signing_key, treasury_wallet]
|
|
25150
|
+
custody:
|
|
25151
|
+
type: string
|
|
25152
|
+
enum: [server, client_tss]
|
|
25153
|
+
description: |
|
|
25154
|
+
`server` — 1claw holds the whole private key and can sign alone.
|
|
25155
|
+
`client_tss` — 2-party threshold key; the customer's share is required.
|
|
25156
|
+
shares:
|
|
25157
|
+
type: array
|
|
25158
|
+
items:
|
|
25159
|
+
$ref: "#/components/schemas/ClientShareResponse"
|
|
24882
25160
|
|
|
24883
25161
|
PasskeyRegisterCompleteResponse:
|
|
24884
25162
|
type: object
|