@1claw/openapi-spec 0.61.18 → 0.61.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +635 -1
- package/openapi.yaml +346 -1
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.19",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -8629,6 +8629,640 @@
|
|
|
8629
8629
|
}
|
|
8630
8630
|
}
|
|
8631
8631
|
},
|
|
8632
|
+
"/v1/keys/tss/keygen/begin": {
|
|
8633
|
+
"post": {
|
|
8634
|
+
"tags": [
|
|
8635
|
+
"Key Custody"
|
|
8636
|
+
],
|
|
8637
|
+
"summary": "Start a 2-party threshold key generation",
|
|
8638
|
+
"description": "Begins a distributed key generation between the vault (party 1) and the\ncaller's browser (party 2, `@1claw/tss-wasm`). The result is a\n`custody: client_tss` treasury wallet whose private key never exists\nanywhere: the vault keeps one FROST share, the caller keeps the other,\nwrapped under their passkey's PRF output. Requires a passkey with\n`prf_supported: true` and no active wallet on the chain. Chains: `solana`\n(Ed25519). Sessions expire after 10 minutes.\n",
|
|
8639
|
+
"operationId": "tssKeygenBegin",
|
|
8640
|
+
"security": [
|
|
8641
|
+
{
|
|
8642
|
+
"BearerAuth": []
|
|
8643
|
+
}
|
|
8644
|
+
],
|
|
8645
|
+
"requestBody": {
|
|
8646
|
+
"required": true,
|
|
8647
|
+
"content": {
|
|
8648
|
+
"application/json": {
|
|
8649
|
+
"schema": {
|
|
8650
|
+
"type": "object",
|
|
8651
|
+
"required": [
|
|
8652
|
+
"chain"
|
|
8653
|
+
],
|
|
8654
|
+
"properties": {
|
|
8655
|
+
"chain": {
|
|
8656
|
+
"type": "string",
|
|
8657
|
+
"enum": [
|
|
8658
|
+
"solana"
|
|
8659
|
+
]
|
|
8660
|
+
}
|
|
8661
|
+
}
|
|
8662
|
+
}
|
|
8663
|
+
}
|
|
8664
|
+
}
|
|
8665
|
+
},
|
|
8666
|
+
"responses": {
|
|
8667
|
+
"201": {
|
|
8668
|
+
"description": "Session opened; the vault's round-1 package",
|
|
8669
|
+
"content": {
|
|
8670
|
+
"application/json": {
|
|
8671
|
+
"schema": {
|
|
8672
|
+
"type": "object",
|
|
8673
|
+
"properties": {
|
|
8674
|
+
"session_id": {
|
|
8675
|
+
"type": "string",
|
|
8676
|
+
"format": "uuid"
|
|
8677
|
+
},
|
|
8678
|
+
"chain": {
|
|
8679
|
+
"type": "string"
|
|
8680
|
+
},
|
|
8681
|
+
"curve": {
|
|
8682
|
+
"type": "string"
|
|
8683
|
+
},
|
|
8684
|
+
"server_identifier": {
|
|
8685
|
+
"type": "integer",
|
|
8686
|
+
"example": 1
|
|
8687
|
+
},
|
|
8688
|
+
"client_identifier": {
|
|
8689
|
+
"type": "integer",
|
|
8690
|
+
"example": 2
|
|
8691
|
+
},
|
|
8692
|
+
"server_round1": {
|
|
8693
|
+
"type": "string",
|
|
8694
|
+
"description": "Base64 FROST DKG round-1 package."
|
|
8695
|
+
},
|
|
8696
|
+
"expires_at": {
|
|
8697
|
+
"type": "string",
|
|
8698
|
+
"format": "date-time"
|
|
8699
|
+
}
|
|
8700
|
+
}
|
|
8701
|
+
}
|
|
8702
|
+
}
|
|
8703
|
+
}
|
|
8704
|
+
},
|
|
8705
|
+
"400": {
|
|
8706
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8707
|
+
},
|
|
8708
|
+
"401": {
|
|
8709
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8710
|
+
},
|
|
8711
|
+
"403": {
|
|
8712
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8713
|
+
},
|
|
8714
|
+
"409": {
|
|
8715
|
+
"$ref": "#/components/responses/Conflict"
|
|
8716
|
+
}
|
|
8717
|
+
}
|
|
8718
|
+
}
|
|
8719
|
+
},
|
|
8720
|
+
"/v1/keys/tss/keygen/round2": {
|
|
8721
|
+
"post": {
|
|
8722
|
+
"tags": [
|
|
8723
|
+
"Key Custody"
|
|
8724
|
+
],
|
|
8725
|
+
"summary": "Threshold key generation, round 2",
|
|
8726
|
+
"operationId": "tssKeygenRound2",
|
|
8727
|
+
"security": [
|
|
8728
|
+
{
|
|
8729
|
+
"BearerAuth": []
|
|
8730
|
+
}
|
|
8731
|
+
],
|
|
8732
|
+
"requestBody": {
|
|
8733
|
+
"required": true,
|
|
8734
|
+
"content": {
|
|
8735
|
+
"application/json": {
|
|
8736
|
+
"schema": {
|
|
8737
|
+
"type": "object",
|
|
8738
|
+
"required": [
|
|
8739
|
+
"session_id",
|
|
8740
|
+
"client_round1"
|
|
8741
|
+
],
|
|
8742
|
+
"properties": {
|
|
8743
|
+
"session_id": {
|
|
8744
|
+
"type": "string",
|
|
8745
|
+
"format": "uuid"
|
|
8746
|
+
},
|
|
8747
|
+
"client_round1": {
|
|
8748
|
+
"type": "string",
|
|
8749
|
+
"description": "Base64 FROST DKG round-1 package from the browser."
|
|
8750
|
+
}
|
|
8751
|
+
}
|
|
8752
|
+
}
|
|
8753
|
+
}
|
|
8754
|
+
}
|
|
8755
|
+
},
|
|
8756
|
+
"responses": {
|
|
8757
|
+
"200": {
|
|
8758
|
+
"description": "The vault's round-2 package, addressed to the caller",
|
|
8759
|
+
"content": {
|
|
8760
|
+
"application/json": {
|
|
8761
|
+
"schema": {
|
|
8762
|
+
"type": "object",
|
|
8763
|
+
"properties": {
|
|
8764
|
+
"session_id": {
|
|
8765
|
+
"type": "string",
|
|
8766
|
+
"format": "uuid"
|
|
8767
|
+
},
|
|
8768
|
+
"server_round2": {
|
|
8769
|
+
"type": "string"
|
|
8770
|
+
}
|
|
8771
|
+
}
|
|
8772
|
+
}
|
|
8773
|
+
}
|
|
8774
|
+
}
|
|
8775
|
+
},
|
|
8776
|
+
"400": {
|
|
8777
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8778
|
+
},
|
|
8779
|
+
"401": {
|
|
8780
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8781
|
+
},
|
|
8782
|
+
"404": {
|
|
8783
|
+
"$ref": "#/components/responses/NotFound"
|
|
8784
|
+
},
|
|
8785
|
+
"409": {
|
|
8786
|
+
"$ref": "#/components/responses/Conflict"
|
|
8787
|
+
}
|
|
8788
|
+
}
|
|
8789
|
+
}
|
|
8790
|
+
},
|
|
8791
|
+
"/v1/keys/tss/keygen/complete": {
|
|
8792
|
+
"post": {
|
|
8793
|
+
"tags": [
|
|
8794
|
+
"Key Custody"
|
|
8795
|
+
],
|
|
8796
|
+
"summary": "Threshold key generation, final round",
|
|
8797
|
+
"description": "Needs `X-Passkey-Token` from a tx-assert with `action: tss_keygen` and\n`tx_digest` = hex SHA-256 of the session id. Creates the `client_tss`\nwallet and returns its address. The browser derives the same public key\npackage from the packages it already holds; store your share with\n`PUT /v1/keys/{key_id}/client-share` next.\n",
|
|
8798
|
+
"operationId": "tssKeygenComplete",
|
|
8799
|
+
"security": [
|
|
8800
|
+
{
|
|
8801
|
+
"BearerAuth": []
|
|
8802
|
+
}
|
|
8803
|
+
],
|
|
8804
|
+
"parameters": [
|
|
8805
|
+
{
|
|
8806
|
+
"name": "X-Passkey-Token",
|
|
8807
|
+
"in": "header",
|
|
8808
|
+
"required": true,
|
|
8809
|
+
"schema": {
|
|
8810
|
+
"type": "string"
|
|
8811
|
+
}
|
|
8812
|
+
}
|
|
8813
|
+
],
|
|
8814
|
+
"requestBody": {
|
|
8815
|
+
"required": true,
|
|
8816
|
+
"content": {
|
|
8817
|
+
"application/json": {
|
|
8818
|
+
"schema": {
|
|
8819
|
+
"type": "object",
|
|
8820
|
+
"required": [
|
|
8821
|
+
"session_id",
|
|
8822
|
+
"client_round2"
|
|
8823
|
+
],
|
|
8824
|
+
"properties": {
|
|
8825
|
+
"session_id": {
|
|
8826
|
+
"type": "string",
|
|
8827
|
+
"format": "uuid"
|
|
8828
|
+
},
|
|
8829
|
+
"client_round2": {
|
|
8830
|
+
"type": "string",
|
|
8831
|
+
"description": "Base64 FROST DKG round-2 package from the browser, addressed to the vault."
|
|
8832
|
+
}
|
|
8833
|
+
}
|
|
8834
|
+
}
|
|
8835
|
+
}
|
|
8836
|
+
}
|
|
8837
|
+
},
|
|
8838
|
+
"responses": {
|
|
8839
|
+
"201": {
|
|
8840
|
+
"description": "Wallet created",
|
|
8841
|
+
"content": {
|
|
8842
|
+
"application/json": {
|
|
8843
|
+
"schema": {
|
|
8844
|
+
"type": "object",
|
|
8845
|
+
"properties": {
|
|
8846
|
+
"key_id": {
|
|
8847
|
+
"type": "string",
|
|
8848
|
+
"format": "uuid"
|
|
8849
|
+
},
|
|
8850
|
+
"chain": {
|
|
8851
|
+
"type": "string"
|
|
8852
|
+
},
|
|
8853
|
+
"curve": {
|
|
8854
|
+
"type": "string"
|
|
8855
|
+
},
|
|
8856
|
+
"custody": {
|
|
8857
|
+
"type": "string",
|
|
8858
|
+
"enum": [
|
|
8859
|
+
"client_tss"
|
|
8860
|
+
]
|
|
8861
|
+
},
|
|
8862
|
+
"address": {
|
|
8863
|
+
"type": "string"
|
|
8864
|
+
},
|
|
8865
|
+
"public_key_hex": {
|
|
8866
|
+
"type": "string"
|
|
8867
|
+
},
|
|
8868
|
+
"public_key_package": {
|
|
8869
|
+
"type": "string",
|
|
8870
|
+
"description": "Base64 FROST public key package."
|
|
8871
|
+
}
|
|
8872
|
+
}
|
|
8873
|
+
}
|
|
8874
|
+
}
|
|
8875
|
+
}
|
|
8876
|
+
},
|
|
8877
|
+
"400": {
|
|
8878
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8879
|
+
},
|
|
8880
|
+
"401": {
|
|
8881
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8882
|
+
},
|
|
8883
|
+
"403": {
|
|
8884
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8885
|
+
},
|
|
8886
|
+
"404": {
|
|
8887
|
+
"$ref": "#/components/responses/NotFound"
|
|
8888
|
+
},
|
|
8889
|
+
"409": {
|
|
8890
|
+
"$ref": "#/components/responses/Conflict"
|
|
8891
|
+
}
|
|
8892
|
+
}
|
|
8893
|
+
}
|
|
8894
|
+
},
|
|
8895
|
+
"/v1/keys/{key_id}/tss/sign/begin": {
|
|
8896
|
+
"parameters": [
|
|
8897
|
+
{
|
|
8898
|
+
"name": "key_id",
|
|
8899
|
+
"in": "path",
|
|
8900
|
+
"required": true,
|
|
8901
|
+
"schema": {
|
|
8902
|
+
"type": "string",
|
|
8903
|
+
"format": "uuid"
|
|
8904
|
+
}
|
|
8905
|
+
}
|
|
8906
|
+
],
|
|
8907
|
+
"post": {
|
|
8908
|
+
"tags": [
|
|
8909
|
+
"Key Custody"
|
|
8910
|
+
],
|
|
8911
|
+
"summary": "Threshold signing, round 1",
|
|
8912
|
+
"description": "Needs `X-Passkey-Token` from a tx-assert with `action: tss_sign` and\n`tx_digest` = hex SHA-256 of `message`. The message must be a decodable\nSolana transaction message; every transfer destination in it is checked\nagainst the OFAC SDN list before the vault commits. Returns the vault's\nsigning commitments; nonces are single-use and expire with the session.\n",
|
|
8913
|
+
"operationId": "tssSignBegin",
|
|
8914
|
+
"security": [
|
|
8915
|
+
{
|
|
8916
|
+
"BearerAuth": []
|
|
8917
|
+
}
|
|
8918
|
+
],
|
|
8919
|
+
"parameters": [
|
|
8920
|
+
{
|
|
8921
|
+
"name": "X-Passkey-Token",
|
|
8922
|
+
"in": "header",
|
|
8923
|
+
"required": true,
|
|
8924
|
+
"schema": {
|
|
8925
|
+
"type": "string"
|
|
8926
|
+
}
|
|
8927
|
+
}
|
|
8928
|
+
],
|
|
8929
|
+
"requestBody": {
|
|
8930
|
+
"required": true,
|
|
8931
|
+
"content": {
|
|
8932
|
+
"application/json": {
|
|
8933
|
+
"schema": {
|
|
8934
|
+
"type": "object",
|
|
8935
|
+
"required": [
|
|
8936
|
+
"message"
|
|
8937
|
+
],
|
|
8938
|
+
"properties": {
|
|
8939
|
+
"message": {
|
|
8940
|
+
"type": "string",
|
|
8941
|
+
"description": "Base64 bytes to sign (the serialised transaction message)."
|
|
8942
|
+
}
|
|
8943
|
+
}
|
|
8944
|
+
}
|
|
8945
|
+
}
|
|
8946
|
+
}
|
|
8947
|
+
},
|
|
8948
|
+
"responses": {
|
|
8949
|
+
"201": {
|
|
8950
|
+
"description": "Session opened",
|
|
8951
|
+
"content": {
|
|
8952
|
+
"application/json": {
|
|
8953
|
+
"schema": {
|
|
8954
|
+
"type": "object",
|
|
8955
|
+
"properties": {
|
|
8956
|
+
"session_id": {
|
|
8957
|
+
"type": "string",
|
|
8958
|
+
"format": "uuid"
|
|
8959
|
+
},
|
|
8960
|
+
"key_id": {
|
|
8961
|
+
"type": "string",
|
|
8962
|
+
"format": "uuid"
|
|
8963
|
+
},
|
|
8964
|
+
"message_digest": {
|
|
8965
|
+
"type": "string"
|
|
8966
|
+
},
|
|
8967
|
+
"server_commitments": {
|
|
8968
|
+
"type": "string"
|
|
8969
|
+
},
|
|
8970
|
+
"expires_at": {
|
|
8971
|
+
"type": "string",
|
|
8972
|
+
"format": "date-time"
|
|
8973
|
+
}
|
|
8974
|
+
}
|
|
8975
|
+
}
|
|
8976
|
+
}
|
|
8977
|
+
}
|
|
8978
|
+
},
|
|
8979
|
+
"400": {
|
|
8980
|
+
"$ref": "#/components/responses/BadRequest"
|
|
8981
|
+
},
|
|
8982
|
+
"401": {
|
|
8983
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
8984
|
+
},
|
|
8985
|
+
"403": {
|
|
8986
|
+
"$ref": "#/components/responses/Forbidden"
|
|
8987
|
+
},
|
|
8988
|
+
"404": {
|
|
8989
|
+
"$ref": "#/components/responses/NotFound"
|
|
8990
|
+
}
|
|
8991
|
+
}
|
|
8992
|
+
}
|
|
8993
|
+
},
|
|
8994
|
+
"/v1/keys/{key_id}/tss/sign/complete": {
|
|
8995
|
+
"parameters": [
|
|
8996
|
+
{
|
|
8997
|
+
"name": "key_id",
|
|
8998
|
+
"in": "path",
|
|
8999
|
+
"required": true,
|
|
9000
|
+
"schema": {
|
|
9001
|
+
"type": "string",
|
|
9002
|
+
"format": "uuid"
|
|
9003
|
+
}
|
|
9004
|
+
}
|
|
9005
|
+
],
|
|
9006
|
+
"post": {
|
|
9007
|
+
"tags": [
|
|
9008
|
+
"Key Custody"
|
|
9009
|
+
],
|
|
9010
|
+
"summary": "Threshold signing, round 2 — aggregate and return the signature",
|
|
9011
|
+
"description": "The vault produces its share, verifies the caller's, aggregates, and\nverifies the result under the group key before returning it. A bad\nshare is a `400`, never a published signature.\n",
|
|
9012
|
+
"operationId": "tssSignComplete",
|
|
9013
|
+
"security": [
|
|
9014
|
+
{
|
|
9015
|
+
"BearerAuth": []
|
|
9016
|
+
}
|
|
9017
|
+
],
|
|
9018
|
+
"requestBody": {
|
|
9019
|
+
"required": true,
|
|
9020
|
+
"content": {
|
|
9021
|
+
"application/json": {
|
|
9022
|
+
"schema": {
|
|
9023
|
+
"type": "object",
|
|
9024
|
+
"required": [
|
|
9025
|
+
"session_id",
|
|
9026
|
+
"client_commitments",
|
|
9027
|
+
"client_signature_share"
|
|
9028
|
+
],
|
|
9029
|
+
"properties": {
|
|
9030
|
+
"session_id": {
|
|
9031
|
+
"type": "string",
|
|
9032
|
+
"format": "uuid"
|
|
9033
|
+
},
|
|
9034
|
+
"client_commitments": {
|
|
9035
|
+
"type": "string"
|
|
9036
|
+
},
|
|
9037
|
+
"client_signature_share": {
|
|
9038
|
+
"type": "string"
|
|
9039
|
+
}
|
|
9040
|
+
}
|
|
9041
|
+
}
|
|
9042
|
+
}
|
|
9043
|
+
}
|
|
9044
|
+
},
|
|
9045
|
+
"responses": {
|
|
9046
|
+
"200": {
|
|
9047
|
+
"description": "Signature",
|
|
9048
|
+
"content": {
|
|
9049
|
+
"application/json": {
|
|
9050
|
+
"schema": {
|
|
9051
|
+
"type": "object",
|
|
9052
|
+
"properties": {
|
|
9053
|
+
"key_id": {
|
|
9054
|
+
"type": "string",
|
|
9055
|
+
"format": "uuid"
|
|
9056
|
+
},
|
|
9057
|
+
"message_digest": {
|
|
9058
|
+
"type": "string"
|
|
9059
|
+
},
|
|
9060
|
+
"signature": {
|
|
9061
|
+
"type": "string",
|
|
9062
|
+
"description": "Base64 64-byte Ed25519 signature."
|
|
9063
|
+
},
|
|
9064
|
+
"signature_hex": {
|
|
9065
|
+
"type": "string"
|
|
9066
|
+
}
|
|
9067
|
+
}
|
|
9068
|
+
}
|
|
9069
|
+
}
|
|
9070
|
+
}
|
|
9071
|
+
},
|
|
9072
|
+
"400": {
|
|
9073
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9074
|
+
},
|
|
9075
|
+
"401": {
|
|
9076
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9077
|
+
},
|
|
9078
|
+
"404": {
|
|
9079
|
+
"$ref": "#/components/responses/NotFound"
|
|
9080
|
+
},
|
|
9081
|
+
"409": {
|
|
9082
|
+
"$ref": "#/components/responses/Conflict"
|
|
9083
|
+
}
|
|
9084
|
+
}
|
|
9085
|
+
}
|
|
9086
|
+
},
|
|
9087
|
+
"/v1/treasury/wallets/{chain}/tss/prepare": {
|
|
9088
|
+
"parameters": [
|
|
9089
|
+
{
|
|
9090
|
+
"name": "chain",
|
|
9091
|
+
"in": "path",
|
|
9092
|
+
"required": true,
|
|
9093
|
+
"schema": {
|
|
9094
|
+
"type": "string"
|
|
9095
|
+
}
|
|
9096
|
+
}
|
|
9097
|
+
],
|
|
9098
|
+
"post": {
|
|
9099
|
+
"tags": [
|
|
9100
|
+
"Key Custody"
|
|
9101
|
+
],
|
|
9102
|
+
"summary": "Build the unsigned message for a send from a client_tss wallet",
|
|
9103
|
+
"description": "Runs wallet access, the sanctions screen and spend policies on the\ndeclared destination, fetches a recent blockhash and returns the\nunsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`\nand submit with `…/tss/broadcast`.\n",
|
|
9104
|
+
"operationId": "tssTreasuryPrepare",
|
|
9105
|
+
"security": [
|
|
9106
|
+
{
|
|
9107
|
+
"BearerAuth": []
|
|
9108
|
+
}
|
|
9109
|
+
],
|
|
9110
|
+
"requestBody": {
|
|
9111
|
+
"required": true,
|
|
9112
|
+
"content": {
|
|
9113
|
+
"application/json": {
|
|
9114
|
+
"schema": {
|
|
9115
|
+
"type": "object",
|
|
9116
|
+
"required": [
|
|
9117
|
+
"to",
|
|
9118
|
+
"value"
|
|
9119
|
+
],
|
|
9120
|
+
"properties": {
|
|
9121
|
+
"to": {
|
|
9122
|
+
"type": "string"
|
|
9123
|
+
},
|
|
9124
|
+
"value": {
|
|
9125
|
+
"type": "string",
|
|
9126
|
+
"description": "Major units",
|
|
9127
|
+
"e.g. \"0.5\".": null
|
|
9128
|
+
},
|
|
9129
|
+
"memo": {
|
|
9130
|
+
"type": "string"
|
|
9131
|
+
}
|
|
9132
|
+
}
|
|
9133
|
+
}
|
|
9134
|
+
}
|
|
9135
|
+
}
|
|
9136
|
+
},
|
|
9137
|
+
"responses": {
|
|
9138
|
+
"200": {
|
|
9139
|
+
"description": "Unsigned message",
|
|
9140
|
+
"content": {
|
|
9141
|
+
"application/json": {
|
|
9142
|
+
"schema": {
|
|
9143
|
+
"type": "object",
|
|
9144
|
+
"properties": {
|
|
9145
|
+
"key_id": {
|
|
9146
|
+
"type": "string",
|
|
9147
|
+
"format": "uuid"
|
|
9148
|
+
},
|
|
9149
|
+
"chain": {
|
|
9150
|
+
"type": "string"
|
|
9151
|
+
},
|
|
9152
|
+
"from": {
|
|
9153
|
+
"type": "string"
|
|
9154
|
+
},
|
|
9155
|
+
"to": {
|
|
9156
|
+
"type": "string"
|
|
9157
|
+
},
|
|
9158
|
+
"value_base_units": {
|
|
9159
|
+
"type": "string"
|
|
9160
|
+
},
|
|
9161
|
+
"recent_blockhash": {
|
|
9162
|
+
"type": "string"
|
|
9163
|
+
},
|
|
9164
|
+
"message": {
|
|
9165
|
+
"type": "string"
|
|
9166
|
+
},
|
|
9167
|
+
"message_digest": {
|
|
9168
|
+
"type": "string"
|
|
9169
|
+
}
|
|
9170
|
+
}
|
|
9171
|
+
}
|
|
9172
|
+
}
|
|
9173
|
+
}
|
|
9174
|
+
},
|
|
9175
|
+
"400": {
|
|
9176
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9177
|
+
},
|
|
9178
|
+
"401": {
|
|
9179
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9180
|
+
},
|
|
9181
|
+
"403": {
|
|
9182
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9183
|
+
},
|
|
9184
|
+
"404": {
|
|
9185
|
+
"$ref": "#/components/responses/NotFound"
|
|
9186
|
+
}
|
|
9187
|
+
}
|
|
9188
|
+
}
|
|
9189
|
+
},
|
|
9190
|
+
"/v1/treasury/wallets/{chain}/tss/broadcast": {
|
|
9191
|
+
"parameters": [
|
|
9192
|
+
{
|
|
9193
|
+
"name": "chain",
|
|
9194
|
+
"in": "path",
|
|
9195
|
+
"required": true,
|
|
9196
|
+
"schema": {
|
|
9197
|
+
"type": "string"
|
|
9198
|
+
}
|
|
9199
|
+
}
|
|
9200
|
+
],
|
|
9201
|
+
"post": {
|
|
9202
|
+
"tags": [
|
|
9203
|
+
"Key Custody"
|
|
9204
|
+
],
|
|
9205
|
+
"summary": "Broadcast a threshold-signed send",
|
|
9206
|
+
"description": "Verifies the signature under the wallet's public key over exactly this\nmessage, checks `to` is a transfer destination inside it, assembles the\ntransaction and submits it. Audited as `treasury_wallet.send`.\n",
|
|
9207
|
+
"operationId": "tssTreasuryBroadcast",
|
|
9208
|
+
"security": [
|
|
9209
|
+
{
|
|
9210
|
+
"BearerAuth": []
|
|
9211
|
+
}
|
|
9212
|
+
],
|
|
9213
|
+
"requestBody": {
|
|
9214
|
+
"required": true,
|
|
9215
|
+
"content": {
|
|
9216
|
+
"application/json": {
|
|
9217
|
+
"schema": {
|
|
9218
|
+
"type": "object",
|
|
9219
|
+
"required": [
|
|
9220
|
+
"message",
|
|
9221
|
+
"signature",
|
|
9222
|
+
"to",
|
|
9223
|
+
"value_base_units"
|
|
9224
|
+
],
|
|
9225
|
+
"properties": {
|
|
9226
|
+
"message": {
|
|
9227
|
+
"type": "string"
|
|
9228
|
+
},
|
|
9229
|
+
"signature": {
|
|
9230
|
+
"type": "string"
|
|
9231
|
+
},
|
|
9232
|
+
"to": {
|
|
9233
|
+
"type": "string"
|
|
9234
|
+
},
|
|
9235
|
+
"value_base_units": {
|
|
9236
|
+
"type": "string"
|
|
9237
|
+
}
|
|
9238
|
+
}
|
|
9239
|
+
}
|
|
9240
|
+
}
|
|
9241
|
+
}
|
|
9242
|
+
},
|
|
9243
|
+
"responses": {
|
|
9244
|
+
"200": {
|
|
9245
|
+
"description": "Broadcast",
|
|
9246
|
+
"content": {
|
|
9247
|
+
"application/json": {
|
|
9248
|
+
"schema": {
|
|
9249
|
+
"$ref": "#/components/schemas/TreasuryWalletSendResponse"
|
|
9250
|
+
}
|
|
9251
|
+
}
|
|
9252
|
+
}
|
|
9253
|
+
},
|
|
9254
|
+
"400": {
|
|
9255
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9256
|
+
},
|
|
9257
|
+
"401": {
|
|
9258
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9259
|
+
},
|
|
9260
|
+
"404": {
|
|
9261
|
+
"$ref": "#/components/responses/NotFound"
|
|
9262
|
+
}
|
|
9263
|
+
}
|
|
9264
|
+
}
|
|
9265
|
+
},
|
|
8632
9266
|
"/v1/treasury/wallets/generate": {
|
|
8633
9267
|
"post": {
|
|
8634
9268
|
"tags": [
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.19"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -5597,6 +5597,351 @@ paths:
|
|
|
5597
5597
|
"404":
|
|
5598
5598
|
$ref: "#/components/responses/NotFound"
|
|
5599
5599
|
|
|
5600
|
+
/v1/keys/tss/keygen/begin:
|
|
5601
|
+
post:
|
|
5602
|
+
tags: [Key Custody]
|
|
5603
|
+
summary: Start a 2-party threshold key generation
|
|
5604
|
+
description: |
|
|
5605
|
+
Begins a distributed key generation between the vault (party 1) and the
|
|
5606
|
+
caller's browser (party 2, `@1claw/tss-wasm`). The result is a
|
|
5607
|
+
`custody: client_tss` treasury wallet whose private key never exists
|
|
5608
|
+
anywhere: the vault keeps one FROST share, the caller keeps the other,
|
|
5609
|
+
wrapped under their passkey's PRF output. Requires a passkey with
|
|
5610
|
+
`prf_supported: true` and no active wallet on the chain. Chains: `solana`
|
|
5611
|
+
(Ed25519). Sessions expire after 10 minutes.
|
|
5612
|
+
operationId: tssKeygenBegin
|
|
5613
|
+
security:
|
|
5614
|
+
- BearerAuth: []
|
|
5615
|
+
requestBody:
|
|
5616
|
+
required: true
|
|
5617
|
+
content:
|
|
5618
|
+
application/json:
|
|
5619
|
+
schema:
|
|
5620
|
+
type: object
|
|
5621
|
+
required: [chain]
|
|
5622
|
+
properties:
|
|
5623
|
+
chain:
|
|
5624
|
+
type: string
|
|
5625
|
+
enum: [solana]
|
|
5626
|
+
responses:
|
|
5627
|
+
"201":
|
|
5628
|
+
description: Session opened; the vault's round-1 package
|
|
5629
|
+
content:
|
|
5630
|
+
application/json:
|
|
5631
|
+
schema:
|
|
5632
|
+
type: object
|
|
5633
|
+
properties:
|
|
5634
|
+
session_id: { type: string, format: uuid }
|
|
5635
|
+
chain: { type: string }
|
|
5636
|
+
curve: { type: string }
|
|
5637
|
+
server_identifier: { type: integer, example: 1 }
|
|
5638
|
+
client_identifier: { type: integer, example: 2 }
|
|
5639
|
+
server_round1:
|
|
5640
|
+
type: string
|
|
5641
|
+
description: Base64 FROST DKG round-1 package.
|
|
5642
|
+
expires_at: { type: string, format: date-time }
|
|
5643
|
+
"400":
|
|
5644
|
+
$ref: "#/components/responses/BadRequest"
|
|
5645
|
+
"401":
|
|
5646
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5647
|
+
"403":
|
|
5648
|
+
$ref: "#/components/responses/Forbidden"
|
|
5649
|
+
"409":
|
|
5650
|
+
$ref: "#/components/responses/Conflict"
|
|
5651
|
+
|
|
5652
|
+
/v1/keys/tss/keygen/round2:
|
|
5653
|
+
post:
|
|
5654
|
+
tags: [Key Custody]
|
|
5655
|
+
summary: Threshold key generation, round 2
|
|
5656
|
+
operationId: tssKeygenRound2
|
|
5657
|
+
security:
|
|
5658
|
+
- BearerAuth: []
|
|
5659
|
+
requestBody:
|
|
5660
|
+
required: true
|
|
5661
|
+
content:
|
|
5662
|
+
application/json:
|
|
5663
|
+
schema:
|
|
5664
|
+
type: object
|
|
5665
|
+
required: [session_id, client_round1]
|
|
5666
|
+
properties:
|
|
5667
|
+
session_id: { type: string, format: uuid }
|
|
5668
|
+
client_round1:
|
|
5669
|
+
type: string
|
|
5670
|
+
description: Base64 FROST DKG round-1 package from the browser.
|
|
5671
|
+
responses:
|
|
5672
|
+
"200":
|
|
5673
|
+
description: The vault's round-2 package, addressed to the caller
|
|
5674
|
+
content:
|
|
5675
|
+
application/json:
|
|
5676
|
+
schema:
|
|
5677
|
+
type: object
|
|
5678
|
+
properties:
|
|
5679
|
+
session_id: { type: string, format: uuid }
|
|
5680
|
+
server_round2: { type: string }
|
|
5681
|
+
"400":
|
|
5682
|
+
$ref: "#/components/responses/BadRequest"
|
|
5683
|
+
"401":
|
|
5684
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5685
|
+
"404":
|
|
5686
|
+
$ref: "#/components/responses/NotFound"
|
|
5687
|
+
"409":
|
|
5688
|
+
$ref: "#/components/responses/Conflict"
|
|
5689
|
+
|
|
5690
|
+
/v1/keys/tss/keygen/complete:
|
|
5691
|
+
post:
|
|
5692
|
+
tags: [Key Custody]
|
|
5693
|
+
summary: Threshold key generation, final round
|
|
5694
|
+
description: |
|
|
5695
|
+
Needs `X-Passkey-Token` from a tx-assert with `action: tss_keygen` and
|
|
5696
|
+
`tx_digest` = hex SHA-256 of the session id. Creates the `client_tss`
|
|
5697
|
+
wallet and returns its address. The browser derives the same public key
|
|
5698
|
+
package from the packages it already holds; store your share with
|
|
5699
|
+
`PUT /v1/keys/{key_id}/client-share` next.
|
|
5700
|
+
operationId: tssKeygenComplete
|
|
5701
|
+
security:
|
|
5702
|
+
- BearerAuth: []
|
|
5703
|
+
parameters:
|
|
5704
|
+
- name: X-Passkey-Token
|
|
5705
|
+
in: header
|
|
5706
|
+
required: true
|
|
5707
|
+
schema: { type: string }
|
|
5708
|
+
requestBody:
|
|
5709
|
+
required: true
|
|
5710
|
+
content:
|
|
5711
|
+
application/json:
|
|
5712
|
+
schema:
|
|
5713
|
+
type: object
|
|
5714
|
+
required: [session_id, client_round2]
|
|
5715
|
+
properties:
|
|
5716
|
+
session_id: { type: string, format: uuid }
|
|
5717
|
+
client_round2:
|
|
5718
|
+
type: string
|
|
5719
|
+
description: Base64 FROST DKG round-2 package from the browser, addressed to the vault.
|
|
5720
|
+
responses:
|
|
5721
|
+
"201":
|
|
5722
|
+
description: Wallet created
|
|
5723
|
+
content:
|
|
5724
|
+
application/json:
|
|
5725
|
+
schema:
|
|
5726
|
+
type: object
|
|
5727
|
+
properties:
|
|
5728
|
+
key_id: { type: string, format: uuid }
|
|
5729
|
+
chain: { type: string }
|
|
5730
|
+
curve: { type: string }
|
|
5731
|
+
custody: { type: string, enum: [client_tss] }
|
|
5732
|
+
address: { type: string }
|
|
5733
|
+
public_key_hex: { type: string }
|
|
5734
|
+
public_key_package: { type: string, description: Base64 FROST public key package. }
|
|
5735
|
+
"400":
|
|
5736
|
+
$ref: "#/components/responses/BadRequest"
|
|
5737
|
+
"401":
|
|
5738
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5739
|
+
"403":
|
|
5740
|
+
$ref: "#/components/responses/Forbidden"
|
|
5741
|
+
"404":
|
|
5742
|
+
$ref: "#/components/responses/NotFound"
|
|
5743
|
+
"409":
|
|
5744
|
+
$ref: "#/components/responses/Conflict"
|
|
5745
|
+
|
|
5746
|
+
/v1/keys/{key_id}/tss/sign/begin:
|
|
5747
|
+
parameters:
|
|
5748
|
+
- name: key_id
|
|
5749
|
+
in: path
|
|
5750
|
+
required: true
|
|
5751
|
+
schema: { type: string, format: uuid }
|
|
5752
|
+
post:
|
|
5753
|
+
tags: [Key Custody]
|
|
5754
|
+
summary: Threshold signing, round 1
|
|
5755
|
+
description: |
|
|
5756
|
+
Needs `X-Passkey-Token` from a tx-assert with `action: tss_sign` and
|
|
5757
|
+
`tx_digest` = hex SHA-256 of `message`. The message must be a decodable
|
|
5758
|
+
Solana transaction message; every transfer destination in it is checked
|
|
5759
|
+
against the OFAC SDN list before the vault commits. Returns the vault's
|
|
5760
|
+
signing commitments; nonces are single-use and expire with the session.
|
|
5761
|
+
operationId: tssSignBegin
|
|
5762
|
+
security:
|
|
5763
|
+
- BearerAuth: []
|
|
5764
|
+
parameters:
|
|
5765
|
+
- name: X-Passkey-Token
|
|
5766
|
+
in: header
|
|
5767
|
+
required: true
|
|
5768
|
+
schema: { type: string }
|
|
5769
|
+
requestBody:
|
|
5770
|
+
required: true
|
|
5771
|
+
content:
|
|
5772
|
+
application/json:
|
|
5773
|
+
schema:
|
|
5774
|
+
type: object
|
|
5775
|
+
required: [message]
|
|
5776
|
+
properties:
|
|
5777
|
+
message:
|
|
5778
|
+
type: string
|
|
5779
|
+
description: Base64 bytes to sign (the serialised transaction message).
|
|
5780
|
+
responses:
|
|
5781
|
+
"201":
|
|
5782
|
+
description: Session opened
|
|
5783
|
+
content:
|
|
5784
|
+
application/json:
|
|
5785
|
+
schema:
|
|
5786
|
+
type: object
|
|
5787
|
+
properties:
|
|
5788
|
+
session_id: { type: string, format: uuid }
|
|
5789
|
+
key_id: { type: string, format: uuid }
|
|
5790
|
+
message_digest: { type: string }
|
|
5791
|
+
server_commitments: { type: string }
|
|
5792
|
+
expires_at: { type: string, format: date-time }
|
|
5793
|
+
"400":
|
|
5794
|
+
$ref: "#/components/responses/BadRequest"
|
|
5795
|
+
"401":
|
|
5796
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5797
|
+
"403":
|
|
5798
|
+
$ref: "#/components/responses/Forbidden"
|
|
5799
|
+
"404":
|
|
5800
|
+
$ref: "#/components/responses/NotFound"
|
|
5801
|
+
|
|
5802
|
+
/v1/keys/{key_id}/tss/sign/complete:
|
|
5803
|
+
parameters:
|
|
5804
|
+
- name: key_id
|
|
5805
|
+
in: path
|
|
5806
|
+
required: true
|
|
5807
|
+
schema: { type: string, format: uuid }
|
|
5808
|
+
post:
|
|
5809
|
+
tags: [Key Custody]
|
|
5810
|
+
summary: Threshold signing, round 2 — aggregate and return the signature
|
|
5811
|
+
description: |
|
|
5812
|
+
The vault produces its share, verifies the caller's, aggregates, and
|
|
5813
|
+
verifies the result under the group key before returning it. A bad
|
|
5814
|
+
share is a `400`, never a published signature.
|
|
5815
|
+
operationId: tssSignComplete
|
|
5816
|
+
security:
|
|
5817
|
+
- BearerAuth: []
|
|
5818
|
+
requestBody:
|
|
5819
|
+
required: true
|
|
5820
|
+
content:
|
|
5821
|
+
application/json:
|
|
5822
|
+
schema:
|
|
5823
|
+
type: object
|
|
5824
|
+
required: [session_id, client_commitments, client_signature_share]
|
|
5825
|
+
properties:
|
|
5826
|
+
session_id: { type: string, format: uuid }
|
|
5827
|
+
client_commitments: { type: string }
|
|
5828
|
+
client_signature_share: { type: string }
|
|
5829
|
+
responses:
|
|
5830
|
+
"200":
|
|
5831
|
+
description: Signature
|
|
5832
|
+
content:
|
|
5833
|
+
application/json:
|
|
5834
|
+
schema:
|
|
5835
|
+
type: object
|
|
5836
|
+
properties:
|
|
5837
|
+
key_id: { type: string, format: uuid }
|
|
5838
|
+
message_digest: { type: string }
|
|
5839
|
+
signature: { type: string, description: Base64 64-byte Ed25519 signature. }
|
|
5840
|
+
signature_hex: { type: string }
|
|
5841
|
+
"400":
|
|
5842
|
+
$ref: "#/components/responses/BadRequest"
|
|
5843
|
+
"401":
|
|
5844
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5845
|
+
"404":
|
|
5846
|
+
$ref: "#/components/responses/NotFound"
|
|
5847
|
+
"409":
|
|
5848
|
+
$ref: "#/components/responses/Conflict"
|
|
5849
|
+
|
|
5850
|
+
/v1/treasury/wallets/{chain}/tss/prepare:
|
|
5851
|
+
parameters:
|
|
5852
|
+
- name: chain
|
|
5853
|
+
in: path
|
|
5854
|
+
required: true
|
|
5855
|
+
schema: { type: string }
|
|
5856
|
+
post:
|
|
5857
|
+
tags: [Key Custody]
|
|
5858
|
+
summary: Build the unsigned message for a send from a client_tss wallet
|
|
5859
|
+
description: |
|
|
5860
|
+
Runs wallet access, the sanctions screen and spend policies on the
|
|
5861
|
+
declared destination, fetches a recent blockhash and returns the
|
|
5862
|
+
unsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`
|
|
5863
|
+
and submit with `…/tss/broadcast`.
|
|
5864
|
+
operationId: tssTreasuryPrepare
|
|
5865
|
+
security:
|
|
5866
|
+
- BearerAuth: []
|
|
5867
|
+
requestBody:
|
|
5868
|
+
required: true
|
|
5869
|
+
content:
|
|
5870
|
+
application/json:
|
|
5871
|
+
schema:
|
|
5872
|
+
type: object
|
|
5873
|
+
required: [to, value]
|
|
5874
|
+
properties:
|
|
5875
|
+
to: { type: string }
|
|
5876
|
+
value: { type: string, description: Major units, e.g. "0.5". }
|
|
5877
|
+
memo: { type: string }
|
|
5878
|
+
responses:
|
|
5879
|
+
"200":
|
|
5880
|
+
description: Unsigned message
|
|
5881
|
+
content:
|
|
5882
|
+
application/json:
|
|
5883
|
+
schema:
|
|
5884
|
+
type: object
|
|
5885
|
+
properties:
|
|
5886
|
+
key_id: { type: string, format: uuid }
|
|
5887
|
+
chain: { type: string }
|
|
5888
|
+
from: { type: string }
|
|
5889
|
+
to: { type: string }
|
|
5890
|
+
value_base_units: { type: string }
|
|
5891
|
+
recent_blockhash: { type: string }
|
|
5892
|
+
message: { type: string }
|
|
5893
|
+
message_digest: { type: string }
|
|
5894
|
+
"400":
|
|
5895
|
+
$ref: "#/components/responses/BadRequest"
|
|
5896
|
+
"401":
|
|
5897
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5898
|
+
"403":
|
|
5899
|
+
$ref: "#/components/responses/Forbidden"
|
|
5900
|
+
"404":
|
|
5901
|
+
$ref: "#/components/responses/NotFound"
|
|
5902
|
+
|
|
5903
|
+
/v1/treasury/wallets/{chain}/tss/broadcast:
|
|
5904
|
+
parameters:
|
|
5905
|
+
- name: chain
|
|
5906
|
+
in: path
|
|
5907
|
+
required: true
|
|
5908
|
+
schema: { type: string }
|
|
5909
|
+
post:
|
|
5910
|
+
tags: [Key Custody]
|
|
5911
|
+
summary: Broadcast a threshold-signed send
|
|
5912
|
+
description: |
|
|
5913
|
+
Verifies the signature under the wallet's public key over exactly this
|
|
5914
|
+
message, checks `to` is a transfer destination inside it, assembles the
|
|
5915
|
+
transaction and submits it. Audited as `treasury_wallet.send`.
|
|
5916
|
+
operationId: tssTreasuryBroadcast
|
|
5917
|
+
security:
|
|
5918
|
+
- BearerAuth: []
|
|
5919
|
+
requestBody:
|
|
5920
|
+
required: true
|
|
5921
|
+
content:
|
|
5922
|
+
application/json:
|
|
5923
|
+
schema:
|
|
5924
|
+
type: object
|
|
5925
|
+
required: [message, signature, to, value_base_units]
|
|
5926
|
+
properties:
|
|
5927
|
+
message: { type: string }
|
|
5928
|
+
signature: { type: string }
|
|
5929
|
+
to: { type: string }
|
|
5930
|
+
value_base_units: { type: string }
|
|
5931
|
+
responses:
|
|
5932
|
+
"200":
|
|
5933
|
+
description: Broadcast
|
|
5934
|
+
content:
|
|
5935
|
+
application/json:
|
|
5936
|
+
schema:
|
|
5937
|
+
$ref: "#/components/schemas/TreasuryWalletSendResponse"
|
|
5938
|
+
"400":
|
|
5939
|
+
$ref: "#/components/responses/BadRequest"
|
|
5940
|
+
"401":
|
|
5941
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5942
|
+
"404":
|
|
5943
|
+
$ref: "#/components/responses/NotFound"
|
|
5944
|
+
|
|
5600
5945
|
/v1/treasury/wallets/generate:
|
|
5601
5946
|
post:
|
|
5602
5947
|
tags: [Treasury Wallets]
|