@1claw/openapi-spec 0.61.19 → 0.61.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +420 -1
- package/openapi.yaml +212 -1
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.20",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -9263,6 +9263,378 @@
|
|
|
9263
9263
|
}
|
|
9264
9264
|
}
|
|
9265
9265
|
},
|
|
9266
|
+
"/v1/treasury/passkey-safes": {
|
|
9267
|
+
"post": {
|
|
9268
|
+
"tags": [
|
|
9269
|
+
"Key Custody"
|
|
9270
|
+
],
|
|
9271
|
+
"summary": "Create a Safe owned by your passkey",
|
|
9272
|
+
"description": "An EVM Safe (v1.4.1) whose only owner is Safe's WebAuthn shared signer,\nconfigured with this passkey's P-256 public key. No private key exists\nanywhere: signing a transaction is a WebAuthn assertion whose challenge\nis the SafeTx hash. The address is counterfactual (CREATE2) until the\nfirst `execute` deploys it. Chains: base, optimism, arbitrum, polygon\n(RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.\n",
|
|
9273
|
+
"operationId": "createPasskeySafe",
|
|
9274
|
+
"security": [
|
|
9275
|
+
{
|
|
9276
|
+
"BearerAuth": []
|
|
9277
|
+
}
|
|
9278
|
+
],
|
|
9279
|
+
"requestBody": {
|
|
9280
|
+
"required": true,
|
|
9281
|
+
"content": {
|
|
9282
|
+
"application/json": {
|
|
9283
|
+
"schema": {
|
|
9284
|
+
"type": "object",
|
|
9285
|
+
"required": [
|
|
9286
|
+
"chain",
|
|
9287
|
+
"passkey_id"
|
|
9288
|
+
],
|
|
9289
|
+
"properties": {
|
|
9290
|
+
"chain": {
|
|
9291
|
+
"type": "string"
|
|
9292
|
+
},
|
|
9293
|
+
"passkey_id": {
|
|
9294
|
+
"type": "string",
|
|
9295
|
+
"format": "uuid"
|
|
9296
|
+
}
|
|
9297
|
+
}
|
|
9298
|
+
}
|
|
9299
|
+
}
|
|
9300
|
+
}
|
|
9301
|
+
},
|
|
9302
|
+
"responses": {
|
|
9303
|
+
"201": {
|
|
9304
|
+
"description": "Safe registered (counterfactual)",
|
|
9305
|
+
"content": {
|
|
9306
|
+
"application/json": {
|
|
9307
|
+
"schema": {
|
|
9308
|
+
"$ref": "#/components/schemas/PasskeySafe"
|
|
9309
|
+
}
|
|
9310
|
+
}
|
|
9311
|
+
}
|
|
9312
|
+
},
|
|
9313
|
+
"400": {
|
|
9314
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9315
|
+
},
|
|
9316
|
+
"401": {
|
|
9317
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9318
|
+
},
|
|
9319
|
+
"404": {
|
|
9320
|
+
"$ref": "#/components/responses/NotFound"
|
|
9321
|
+
},
|
|
9322
|
+
"409": {
|
|
9323
|
+
"$ref": "#/components/responses/Conflict"
|
|
9324
|
+
}
|
|
9325
|
+
}
|
|
9326
|
+
},
|
|
9327
|
+
"get": {
|
|
9328
|
+
"tags": [
|
|
9329
|
+
"Key Custody"
|
|
9330
|
+
],
|
|
9331
|
+
"summary": "List your passkey-owned Safes",
|
|
9332
|
+
"operationId": "listPasskeySafes",
|
|
9333
|
+
"security": [
|
|
9334
|
+
{
|
|
9335
|
+
"BearerAuth": []
|
|
9336
|
+
}
|
|
9337
|
+
],
|
|
9338
|
+
"responses": {
|
|
9339
|
+
"200": {
|
|
9340
|
+
"description": "Safes",
|
|
9341
|
+
"content": {
|
|
9342
|
+
"application/json": {
|
|
9343
|
+
"schema": {
|
|
9344
|
+
"type": "object",
|
|
9345
|
+
"properties": {
|
|
9346
|
+
"safes": {
|
|
9347
|
+
"type": "array",
|
|
9348
|
+
"items": {
|
|
9349
|
+
"$ref": "#/components/schemas/PasskeySafe"
|
|
9350
|
+
}
|
|
9351
|
+
}
|
|
9352
|
+
}
|
|
9353
|
+
}
|
|
9354
|
+
}
|
|
9355
|
+
}
|
|
9356
|
+
},
|
|
9357
|
+
"401": {
|
|
9358
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9359
|
+
}
|
|
9360
|
+
}
|
|
9361
|
+
}
|
|
9362
|
+
},
|
|
9363
|
+
"/v1/treasury/passkey-safes/{id}": {
|
|
9364
|
+
"parameters": [
|
|
9365
|
+
{
|
|
9366
|
+
"name": "id",
|
|
9367
|
+
"in": "path",
|
|
9368
|
+
"required": true,
|
|
9369
|
+
"schema": {
|
|
9370
|
+
"type": "string",
|
|
9371
|
+
"format": "uuid"
|
|
9372
|
+
}
|
|
9373
|
+
}
|
|
9374
|
+
],
|
|
9375
|
+
"delete": {
|
|
9376
|
+
"tags": [
|
|
9377
|
+
"Key Custody"
|
|
9378
|
+
],
|
|
9379
|
+
"summary": "Forget a passkey Safe",
|
|
9380
|
+
"description": "Deactivates the record only; the Safe and its funds stay on-chain under the passkey.",
|
|
9381
|
+
"operationId": "deactivatePasskeySafe",
|
|
9382
|
+
"security": [
|
|
9383
|
+
{
|
|
9384
|
+
"BearerAuth": []
|
|
9385
|
+
}
|
|
9386
|
+
],
|
|
9387
|
+
"responses": {
|
|
9388
|
+
"204": {
|
|
9389
|
+
"description": "Deactivated"
|
|
9390
|
+
},
|
|
9391
|
+
"401": {
|
|
9392
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9393
|
+
},
|
|
9394
|
+
"404": {
|
|
9395
|
+
"$ref": "#/components/responses/NotFound"
|
|
9396
|
+
}
|
|
9397
|
+
}
|
|
9398
|
+
}
|
|
9399
|
+
},
|
|
9400
|
+
"/v1/treasury/passkey-safes/{id}/prepare": {
|
|
9401
|
+
"parameters": [
|
|
9402
|
+
{
|
|
9403
|
+
"name": "id",
|
|
9404
|
+
"in": "path",
|
|
9405
|
+
"required": true,
|
|
9406
|
+
"schema": {
|
|
9407
|
+
"type": "string",
|
|
9408
|
+
"format": "uuid"
|
|
9409
|
+
}
|
|
9410
|
+
}
|
|
9411
|
+
],
|
|
9412
|
+
"post": {
|
|
9413
|
+
"tags": [
|
|
9414
|
+
"Key Custody"
|
|
9415
|
+
],
|
|
9416
|
+
"summary": "Compute the SafeTx hash for a call from a passkey Safe",
|
|
9417
|
+
"description": "Runs the sanctions screen and spend policies on the call, reads the\nSafe's on-chain nonce (0 if not yet deployed), and returns the SafeTx\nhash — the raw 32 bytes are the WebAuthn challenge to sign with\n`userVerification: \"required\"`.\n",
|
|
9418
|
+
"operationId": "preparePasskeySafeTx",
|
|
9419
|
+
"security": [
|
|
9420
|
+
{
|
|
9421
|
+
"BearerAuth": []
|
|
9422
|
+
}
|
|
9423
|
+
],
|
|
9424
|
+
"requestBody": {
|
|
9425
|
+
"required": true,
|
|
9426
|
+
"content": {
|
|
9427
|
+
"application/json": {
|
|
9428
|
+
"schema": {
|
|
9429
|
+
"type": "object",
|
|
9430
|
+
"required": [
|
|
9431
|
+
"to",
|
|
9432
|
+
"value_wei"
|
|
9433
|
+
],
|
|
9434
|
+
"properties": {
|
|
9435
|
+
"to": {
|
|
9436
|
+
"type": "string"
|
|
9437
|
+
},
|
|
9438
|
+
"value_wei": {
|
|
9439
|
+
"type": "string"
|
|
9440
|
+
},
|
|
9441
|
+
"data": {
|
|
9442
|
+
"type": "string",
|
|
9443
|
+
"description": "Hex calldata",
|
|
9444
|
+
"optional.": null
|
|
9445
|
+
}
|
|
9446
|
+
}
|
|
9447
|
+
}
|
|
9448
|
+
}
|
|
9449
|
+
}
|
|
9450
|
+
},
|
|
9451
|
+
"responses": {
|
|
9452
|
+
"200": {
|
|
9453
|
+
"description": "What to sign",
|
|
9454
|
+
"content": {
|
|
9455
|
+
"application/json": {
|
|
9456
|
+
"schema": {
|
|
9457
|
+
"type": "object",
|
|
9458
|
+
"properties": {
|
|
9459
|
+
"safe_id": {
|
|
9460
|
+
"type": "string",
|
|
9461
|
+
"format": "uuid"
|
|
9462
|
+
},
|
|
9463
|
+
"safe_address": {
|
|
9464
|
+
"type": "string"
|
|
9465
|
+
},
|
|
9466
|
+
"chain": {
|
|
9467
|
+
"type": "string"
|
|
9468
|
+
},
|
|
9469
|
+
"chain_id": {
|
|
9470
|
+
"type": "integer"
|
|
9471
|
+
},
|
|
9472
|
+
"to": {
|
|
9473
|
+
"type": "string"
|
|
9474
|
+
},
|
|
9475
|
+
"value_wei": {
|
|
9476
|
+
"type": "string"
|
|
9477
|
+
},
|
|
9478
|
+
"data": {
|
|
9479
|
+
"type": "string"
|
|
9480
|
+
},
|
|
9481
|
+
"nonce": {
|
|
9482
|
+
"type": "integer"
|
|
9483
|
+
},
|
|
9484
|
+
"deploy_required": {
|
|
9485
|
+
"type": "boolean"
|
|
9486
|
+
},
|
|
9487
|
+
"safe_tx_hash": {
|
|
9488
|
+
"type": "string"
|
|
9489
|
+
},
|
|
9490
|
+
"credential_id": {
|
|
9491
|
+
"type": "string"
|
|
9492
|
+
},
|
|
9493
|
+
"rp_id": {
|
|
9494
|
+
"type": "string"
|
|
9495
|
+
}
|
|
9496
|
+
}
|
|
9497
|
+
}
|
|
9498
|
+
}
|
|
9499
|
+
}
|
|
9500
|
+
},
|
|
9501
|
+
"400": {
|
|
9502
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9503
|
+
},
|
|
9504
|
+
"401": {
|
|
9505
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9506
|
+
},
|
|
9507
|
+
"403": {
|
|
9508
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9509
|
+
},
|
|
9510
|
+
"404": {
|
|
9511
|
+
"$ref": "#/components/responses/NotFound"
|
|
9512
|
+
}
|
|
9513
|
+
}
|
|
9514
|
+
}
|
|
9515
|
+
},
|
|
9516
|
+
"/v1/treasury/passkey-safes/{id}/execute": {
|
|
9517
|
+
"parameters": [
|
|
9518
|
+
{
|
|
9519
|
+
"name": "id",
|
|
9520
|
+
"in": "path",
|
|
9521
|
+
"required": true,
|
|
9522
|
+
"schema": {
|
|
9523
|
+
"type": "string",
|
|
9524
|
+
"format": "uuid"
|
|
9525
|
+
}
|
|
9526
|
+
}
|
|
9527
|
+
],
|
|
9528
|
+
"post": {
|
|
9529
|
+
"tags": [
|
|
9530
|
+
"Key Custody"
|
|
9531
|
+
],
|
|
9532
|
+
"summary": "Relay a passkey-signed Safe transaction",
|
|
9533
|
+
"description": "Recomputes the SafeTx hash, verifies the WebAuthn assertion locally\n(this passkey, this hash, a dashboard origin, UV flag set), wraps it in\nSafe's contract-signature format and relays `execTransaction` — deploying\nthe Safe first if needed — from your Ethereum treasury wallet, which pays\ngas and is not an owner. Audited as `passkey_safe.executed`.\n",
|
|
9534
|
+
"operationId": "executePasskeySafeTx",
|
|
9535
|
+
"security": [
|
|
9536
|
+
{
|
|
9537
|
+
"BearerAuth": []
|
|
9538
|
+
}
|
|
9539
|
+
],
|
|
9540
|
+
"requestBody": {
|
|
9541
|
+
"required": true,
|
|
9542
|
+
"content": {
|
|
9543
|
+
"application/json": {
|
|
9544
|
+
"schema": {
|
|
9545
|
+
"type": "object",
|
|
9546
|
+
"required": [
|
|
9547
|
+
"to",
|
|
9548
|
+
"value_wei",
|
|
9549
|
+
"nonce",
|
|
9550
|
+
"authenticator_data",
|
|
9551
|
+
"client_data_json",
|
|
9552
|
+
"signature"
|
|
9553
|
+
],
|
|
9554
|
+
"properties": {
|
|
9555
|
+
"to": {
|
|
9556
|
+
"type": "string"
|
|
9557
|
+
},
|
|
9558
|
+
"value_wei": {
|
|
9559
|
+
"type": "string"
|
|
9560
|
+
},
|
|
9561
|
+
"data": {
|
|
9562
|
+
"type": "string"
|
|
9563
|
+
},
|
|
9564
|
+
"nonce": {
|
|
9565
|
+
"type": "integer"
|
|
9566
|
+
},
|
|
9567
|
+
"authenticator_data": {
|
|
9568
|
+
"type": "string",
|
|
9569
|
+
"description": "Base64url."
|
|
9570
|
+
},
|
|
9571
|
+
"client_data_json": {
|
|
9572
|
+
"type": "string",
|
|
9573
|
+
"description": "Base64url."
|
|
9574
|
+
},
|
|
9575
|
+
"signature": {
|
|
9576
|
+
"type": "string",
|
|
9577
|
+
"description": "Base64url DER ECDSA signature."
|
|
9578
|
+
}
|
|
9579
|
+
}
|
|
9580
|
+
}
|
|
9581
|
+
}
|
|
9582
|
+
}
|
|
9583
|
+
},
|
|
9584
|
+
"responses": {
|
|
9585
|
+
"200": {
|
|
9586
|
+
"description": "Relayed",
|
|
9587
|
+
"content": {
|
|
9588
|
+
"application/json": {
|
|
9589
|
+
"schema": {
|
|
9590
|
+
"type": "object",
|
|
9591
|
+
"properties": {
|
|
9592
|
+
"safe_id": {
|
|
9593
|
+
"type": "string",
|
|
9594
|
+
"format": "uuid"
|
|
9595
|
+
},
|
|
9596
|
+
"safe_address": {
|
|
9597
|
+
"type": "string"
|
|
9598
|
+
},
|
|
9599
|
+
"chain": {
|
|
9600
|
+
"type": "string"
|
|
9601
|
+
},
|
|
9602
|
+
"safe_tx_hash": {
|
|
9603
|
+
"type": "string"
|
|
9604
|
+
},
|
|
9605
|
+
"deploy_tx_hash": {
|
|
9606
|
+
"type": "string",
|
|
9607
|
+
"nullable": true
|
|
9608
|
+
},
|
|
9609
|
+
"tx_hash": {
|
|
9610
|
+
"type": "string"
|
|
9611
|
+
},
|
|
9612
|
+
"status": {
|
|
9613
|
+
"type": "string"
|
|
9614
|
+
}
|
|
9615
|
+
}
|
|
9616
|
+
}
|
|
9617
|
+
}
|
|
9618
|
+
}
|
|
9619
|
+
},
|
|
9620
|
+
"400": {
|
|
9621
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9622
|
+
},
|
|
9623
|
+
"401": {
|
|
9624
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9625
|
+
},
|
|
9626
|
+
"403": {
|
|
9627
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9628
|
+
},
|
|
9629
|
+
"404": {
|
|
9630
|
+
"$ref": "#/components/responses/NotFound"
|
|
9631
|
+
},
|
|
9632
|
+
"409": {
|
|
9633
|
+
"$ref": "#/components/responses/Conflict"
|
|
9634
|
+
}
|
|
9635
|
+
}
|
|
9636
|
+
}
|
|
9637
|
+
},
|
|
9266
9638
|
"/v1/treasury/wallets/generate": {
|
|
9267
9639
|
"post": {
|
|
9268
9640
|
"tags": [
|
|
@@ -39114,6 +39486,53 @@
|
|
|
39114
39486
|
}
|
|
39115
39487
|
}
|
|
39116
39488
|
},
|
|
39489
|
+
"PasskeySafe": {
|
|
39490
|
+
"type": "object",
|
|
39491
|
+
"properties": {
|
|
39492
|
+
"id": {
|
|
39493
|
+
"type": "string",
|
|
39494
|
+
"format": "uuid"
|
|
39495
|
+
},
|
|
39496
|
+
"chain": {
|
|
39497
|
+
"type": "string"
|
|
39498
|
+
},
|
|
39499
|
+
"chain_id": {
|
|
39500
|
+
"type": "integer"
|
|
39501
|
+
},
|
|
39502
|
+
"safe_address": {
|
|
39503
|
+
"type": "string"
|
|
39504
|
+
},
|
|
39505
|
+
"passkey_id": {
|
|
39506
|
+
"type": "string",
|
|
39507
|
+
"format": "uuid"
|
|
39508
|
+
},
|
|
39509
|
+
"custody": {
|
|
39510
|
+
"type": "string",
|
|
39511
|
+
"enum": [
|
|
39512
|
+
"passkey_owner"
|
|
39513
|
+
]
|
|
39514
|
+
},
|
|
39515
|
+
"deploy_status": {
|
|
39516
|
+
"type": "string",
|
|
39517
|
+
"enum": [
|
|
39518
|
+
"pending",
|
|
39519
|
+
"deployed"
|
|
39520
|
+
]
|
|
39521
|
+
},
|
|
39522
|
+
"deploy_tx_hash": {
|
|
39523
|
+
"type": "string",
|
|
39524
|
+
"nullable": true
|
|
39525
|
+
},
|
|
39526
|
+
"owner_signer": {
|
|
39527
|
+
"type": "string",
|
|
39528
|
+
"description": "The SafeWebAuthnSharedSigner address listed as the Safe's owner."
|
|
39529
|
+
},
|
|
39530
|
+
"created_at": {
|
|
39531
|
+
"type": "string",
|
|
39532
|
+
"format": "date-time"
|
|
39533
|
+
}
|
|
39534
|
+
}
|
|
39535
|
+
},
|
|
39117
39536
|
"ClientShareListResponse": {
|
|
39118
39537
|
"type": "object",
|
|
39119
39538
|
"properties": {
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.20"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -5942,6 +5942,203 @@ paths:
|
|
|
5942
5942
|
"404":
|
|
5943
5943
|
$ref: "#/components/responses/NotFound"
|
|
5944
5944
|
|
|
5945
|
+
/v1/treasury/passkey-safes:
|
|
5946
|
+
post:
|
|
5947
|
+
tags: [Key Custody]
|
|
5948
|
+
summary: Create a Safe owned by your passkey
|
|
5949
|
+
description: |
|
|
5950
|
+
An EVM Safe (v1.4.1) whose only owner is Safe's WebAuthn shared signer,
|
|
5951
|
+
configured with this passkey's P-256 public key. No private key exists
|
|
5952
|
+
anywhere: signing a transaction is a WebAuthn assertion whose challenge
|
|
5953
|
+
is the SafeTx hash. The address is counterfactual (CREATE2) until the
|
|
5954
|
+
first `execute` deploys it. Chains: base, optimism, arbitrum, polygon
|
|
5955
|
+
(RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.
|
|
5956
|
+
operationId: createPasskeySafe
|
|
5957
|
+
security:
|
|
5958
|
+
- BearerAuth: []
|
|
5959
|
+
requestBody:
|
|
5960
|
+
required: true
|
|
5961
|
+
content:
|
|
5962
|
+
application/json:
|
|
5963
|
+
schema:
|
|
5964
|
+
type: object
|
|
5965
|
+
required: [chain, passkey_id]
|
|
5966
|
+
properties:
|
|
5967
|
+
chain: { type: string }
|
|
5968
|
+
passkey_id: { type: string, format: uuid }
|
|
5969
|
+
responses:
|
|
5970
|
+
"201":
|
|
5971
|
+
description: Safe registered (counterfactual)
|
|
5972
|
+
content:
|
|
5973
|
+
application/json:
|
|
5974
|
+
schema:
|
|
5975
|
+
$ref: "#/components/schemas/PasskeySafe"
|
|
5976
|
+
"400":
|
|
5977
|
+
$ref: "#/components/responses/BadRequest"
|
|
5978
|
+
"401":
|
|
5979
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5980
|
+
"404":
|
|
5981
|
+
$ref: "#/components/responses/NotFound"
|
|
5982
|
+
"409":
|
|
5983
|
+
$ref: "#/components/responses/Conflict"
|
|
5984
|
+
get:
|
|
5985
|
+
tags: [Key Custody]
|
|
5986
|
+
summary: List your passkey-owned Safes
|
|
5987
|
+
operationId: listPasskeySafes
|
|
5988
|
+
security:
|
|
5989
|
+
- BearerAuth: []
|
|
5990
|
+
responses:
|
|
5991
|
+
"200":
|
|
5992
|
+
description: Safes
|
|
5993
|
+
content:
|
|
5994
|
+
application/json:
|
|
5995
|
+
schema:
|
|
5996
|
+
type: object
|
|
5997
|
+
properties:
|
|
5998
|
+
safes:
|
|
5999
|
+
type: array
|
|
6000
|
+
items:
|
|
6001
|
+
$ref: "#/components/schemas/PasskeySafe"
|
|
6002
|
+
"401":
|
|
6003
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6004
|
+
|
|
6005
|
+
/v1/treasury/passkey-safes/{id}:
|
|
6006
|
+
parameters:
|
|
6007
|
+
- name: id
|
|
6008
|
+
in: path
|
|
6009
|
+
required: true
|
|
6010
|
+
schema: { type: string, format: uuid }
|
|
6011
|
+
delete:
|
|
6012
|
+
tags: [Key Custody]
|
|
6013
|
+
summary: Forget a passkey Safe
|
|
6014
|
+
description: Deactivates the record only; the Safe and its funds stay on-chain under the passkey.
|
|
6015
|
+
operationId: deactivatePasskeySafe
|
|
6016
|
+
security:
|
|
6017
|
+
- BearerAuth: []
|
|
6018
|
+
responses:
|
|
6019
|
+
"204":
|
|
6020
|
+
description: Deactivated
|
|
6021
|
+
"401":
|
|
6022
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6023
|
+
"404":
|
|
6024
|
+
$ref: "#/components/responses/NotFound"
|
|
6025
|
+
|
|
6026
|
+
/v1/treasury/passkey-safes/{id}/prepare:
|
|
6027
|
+
parameters:
|
|
6028
|
+
- name: id
|
|
6029
|
+
in: path
|
|
6030
|
+
required: true
|
|
6031
|
+
schema: { type: string, format: uuid }
|
|
6032
|
+
post:
|
|
6033
|
+
tags: [Key Custody]
|
|
6034
|
+
summary: Compute the SafeTx hash for a call from a passkey Safe
|
|
6035
|
+
description: |
|
|
6036
|
+
Runs the sanctions screen and spend policies on the call, reads the
|
|
6037
|
+
Safe's on-chain nonce (0 if not yet deployed), and returns the SafeTx
|
|
6038
|
+
hash — the raw 32 bytes are the WebAuthn challenge to sign with
|
|
6039
|
+
`userVerification: "required"`.
|
|
6040
|
+
operationId: preparePasskeySafeTx
|
|
6041
|
+
security:
|
|
6042
|
+
- BearerAuth: []
|
|
6043
|
+
requestBody:
|
|
6044
|
+
required: true
|
|
6045
|
+
content:
|
|
6046
|
+
application/json:
|
|
6047
|
+
schema:
|
|
6048
|
+
type: object
|
|
6049
|
+
required: [to, value_wei]
|
|
6050
|
+
properties:
|
|
6051
|
+
to: { type: string }
|
|
6052
|
+
value_wei: { type: string }
|
|
6053
|
+
data: { type: string, description: Hex calldata, optional. }
|
|
6054
|
+
responses:
|
|
6055
|
+
"200":
|
|
6056
|
+
description: What to sign
|
|
6057
|
+
content:
|
|
6058
|
+
application/json:
|
|
6059
|
+
schema:
|
|
6060
|
+
type: object
|
|
6061
|
+
properties:
|
|
6062
|
+
safe_id: { type: string, format: uuid }
|
|
6063
|
+
safe_address: { type: string }
|
|
6064
|
+
chain: { type: string }
|
|
6065
|
+
chain_id: { type: integer }
|
|
6066
|
+
to: { type: string }
|
|
6067
|
+
value_wei: { type: string }
|
|
6068
|
+
data: { type: string }
|
|
6069
|
+
nonce: { type: integer }
|
|
6070
|
+
deploy_required: { type: boolean }
|
|
6071
|
+
safe_tx_hash: { type: string }
|
|
6072
|
+
credential_id: { type: string }
|
|
6073
|
+
rp_id: { type: string }
|
|
6074
|
+
"400":
|
|
6075
|
+
$ref: "#/components/responses/BadRequest"
|
|
6076
|
+
"401":
|
|
6077
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6078
|
+
"403":
|
|
6079
|
+
$ref: "#/components/responses/Forbidden"
|
|
6080
|
+
"404":
|
|
6081
|
+
$ref: "#/components/responses/NotFound"
|
|
6082
|
+
|
|
6083
|
+
/v1/treasury/passkey-safes/{id}/execute:
|
|
6084
|
+
parameters:
|
|
6085
|
+
- name: id
|
|
6086
|
+
in: path
|
|
6087
|
+
required: true
|
|
6088
|
+
schema: { type: string, format: uuid }
|
|
6089
|
+
post:
|
|
6090
|
+
tags: [Key Custody]
|
|
6091
|
+
summary: Relay a passkey-signed Safe transaction
|
|
6092
|
+
description: |
|
|
6093
|
+
Recomputes the SafeTx hash, verifies the WebAuthn assertion locally
|
|
6094
|
+
(this passkey, this hash, a dashboard origin, UV flag set), wraps it in
|
|
6095
|
+
Safe's contract-signature format and relays `execTransaction` — deploying
|
|
6096
|
+
the Safe first if needed — from your Ethereum treasury wallet, which pays
|
|
6097
|
+
gas and is not an owner. Audited as `passkey_safe.executed`.
|
|
6098
|
+
operationId: executePasskeySafeTx
|
|
6099
|
+
security:
|
|
6100
|
+
- BearerAuth: []
|
|
6101
|
+
requestBody:
|
|
6102
|
+
required: true
|
|
6103
|
+
content:
|
|
6104
|
+
application/json:
|
|
6105
|
+
schema:
|
|
6106
|
+
type: object
|
|
6107
|
+
required: [to, value_wei, nonce, authenticator_data, client_data_json, signature]
|
|
6108
|
+
properties:
|
|
6109
|
+
to: { type: string }
|
|
6110
|
+
value_wei: { type: string }
|
|
6111
|
+
data: { type: string }
|
|
6112
|
+
nonce: { type: integer }
|
|
6113
|
+
authenticator_data: { type: string, description: Base64url. }
|
|
6114
|
+
client_data_json: { type: string, description: Base64url. }
|
|
6115
|
+
signature: { type: string, description: Base64url DER ECDSA signature. }
|
|
6116
|
+
responses:
|
|
6117
|
+
"200":
|
|
6118
|
+
description: Relayed
|
|
6119
|
+
content:
|
|
6120
|
+
application/json:
|
|
6121
|
+
schema:
|
|
6122
|
+
type: object
|
|
6123
|
+
properties:
|
|
6124
|
+
safe_id: { type: string, format: uuid }
|
|
6125
|
+
safe_address: { type: string }
|
|
6126
|
+
chain: { type: string }
|
|
6127
|
+
safe_tx_hash: { type: string }
|
|
6128
|
+
deploy_tx_hash: { type: string, nullable: true }
|
|
6129
|
+
tx_hash: { type: string }
|
|
6130
|
+
status: { type: string }
|
|
6131
|
+
"400":
|
|
6132
|
+
$ref: "#/components/responses/BadRequest"
|
|
6133
|
+
"401":
|
|
6134
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6135
|
+
"403":
|
|
6136
|
+
$ref: "#/components/responses/Forbidden"
|
|
6137
|
+
"404":
|
|
6138
|
+
$ref: "#/components/responses/NotFound"
|
|
6139
|
+
"409":
|
|
6140
|
+
$ref: "#/components/responses/Conflict"
|
|
6141
|
+
|
|
5945
6142
|
/v1/treasury/wallets/generate:
|
|
5946
6143
|
post:
|
|
5947
6144
|
tags: [Treasury Wallets]
|
|
@@ -25483,6 +25680,20 @@ components:
|
|
|
25483
25680
|
type: string
|
|
25484
25681
|
format: date-time
|
|
25485
25682
|
|
|
25683
|
+
PasskeySafe:
|
|
25684
|
+
type: object
|
|
25685
|
+
properties:
|
|
25686
|
+
id: { type: string, format: uuid }
|
|
25687
|
+
chain: { type: string }
|
|
25688
|
+
chain_id: { type: integer }
|
|
25689
|
+
safe_address: { type: string }
|
|
25690
|
+
passkey_id: { type: string, format: uuid }
|
|
25691
|
+
custody: { type: string, enum: [passkey_owner] }
|
|
25692
|
+
deploy_status: { type: string, enum: [pending, deployed] }
|
|
25693
|
+
deploy_tx_hash: { type: string, nullable: true }
|
|
25694
|
+
owner_signer: { type: string, description: The SafeWebAuthnSharedSigner address listed as the Safe's owner. }
|
|
25695
|
+
created_at: { type: string, format: date-time }
|
|
25696
|
+
|
|
25486
25697
|
ClientShareListResponse:
|
|
25487
25698
|
type: object
|
|
25488
25699
|
properties:
|