@1claw/openapi-spec 0.61.19 → 0.61.21

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.19",
+    "version": "0.61.21",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -8657,6 +8657,11 @@
                     "enum": [
                       "solana"
                     ]
+                  },
+                  "replace_existing": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Re-key ceremony: replace the active server-custody wallet on\nthis chain. On `complete` its balance is swept to the new\naddress by the old key's last signature and the old wallet is\ndeactivated (audit `treasury_wallet.rekeyed`).\n"
                   }
                 }
               }
@@ -8991,10 +8996,1037 @@
         }
       }
     },
-    "/v1/keys/{key_id}/tss/sign/complete": {
+    "/v1/keys/{key_id}/tss/sign/complete": {
+      "parameters": [
+        {
+          "name": "key_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Threshold signing, round 2 — aggregate and return the signature",
+        "description": "The vault produces its share, verifies the caller's, aggregates, and\nverifies the result under the group key before returning it. A bad\nshare is a `400`, never a published signature.\n",
+        "operationId": "tssSignComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "session_id",
+                  "client_commitments",
+                  "client_signature_share"
+                ],
+                "properties": {
+                  "session_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "client_commitments": {
+                    "type": "string"
+                  },
+                  "client_signature_share": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Signature",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "message_digest": {
+                      "type": "string"
+                    },
+                    "signature": {
+                      "type": "string",
+                      "description": "Base64 64-byte Ed25519 signature."
+                    },
+                    "signature_hex": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
+    "/v1/treasury/wallets/{chain}/tss/prepare": {
+      "parameters": [
+        {
+          "name": "chain",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Build the unsigned message for a send from a client_tss wallet",
+        "description": "Runs wallet access, the sanctions screen and spend policies on the\ndeclared destination, fetches a recent blockhash and returns the\nunsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`\nand submit with `…/tss/broadcast`.\n",
+        "operationId": "tssTreasuryPrepare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "to",
+                  "value"
+                ],
+                "properties": {
+                  "to": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string",
+                    "description": "Major units",
+                    "e.g. \"0.5\".": null
+                  },
+                  "memo": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Unsigned message",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "chain": {
+                      "type": "string"
+                    },
+                    "from": {
+                      "type": "string"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "value_base_units": {
+                      "type": "string"
+                    },
+                    "recent_blockhash": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    },
+                    "message_digest": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/treasury/wallets/{chain}/tss/broadcast": {
+      "parameters": [
+        {
+          "name": "chain",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Broadcast a threshold-signed send",
+        "description": "Verifies the signature under the wallet's public key over exactly this\nmessage, checks `to` is a transfer destination inside it, assembles the\ntransaction and submits it. Audited as `treasury_wallet.send`.\n",
+        "operationId": "tssTreasuryBroadcast",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "message",
+                  "signature",
+                  "to",
+                  "value_base_units"
+                ],
+                "properties": {
+                  "message": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  },
+                  "to": {
+                    "type": "string"
+                  },
+                  "value_base_units": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Broadcast",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TreasuryWalletSendResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/tss/holder": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Register the runtime's sidecar as a share holder",
+        "description": "Called by the runtime's agent (the Shroud sidecar, at boot) with the P-256\npublic key it generated. The owner can then provision a threshold-key\nshare to this runtime, letting the agent co-sign below-cap sends\nunattended. Re-registering replaces the key; deleting the runtime revokes\nevery share held by it.\n",
+        "operationId": "registerTssHolder",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "public_key"
+                ],
+                "properties": {
+                  "public_key": {
+                    "type": "string",
+                    "description": "Base64 SEC1 uncompressed P-256 point (65 bytes)."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Registered",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TssHolder"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "The runtime's registered share holder",
+        "operationId": "getTssHolder",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Holder",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TssHolder"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/keys/{key_id}/client-share/holder": {
+      "parameters": [
+        {
+          "name": "key_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "put": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Provision a threshold-key share to a runtime holder",
+        "description": "The owner's browser unlocks its share with the passkey PRF and re-wraps\nit to the holder's P-256 key (ECIES: ephemeral point ‖ iv ‖ AES-GCM). The\nvault stores the ciphertext unopened. The wallet must be delegated to the\nholder's agent. Audited as `client_share.provisioned_to_runtime`.\n",
+        "operationId": "provisionTssHolderShare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "holder_id",
+                  "wrapped_share",
+                  "salt"
+                ],
+                "properties": {
+                  "holder_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "wrapped_share": {
+                    "type": "string"
+                  },
+                  "salt": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Stored"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "The sidecar fetches the wrap made for it",
+        "description": "Agent-only; returns the wrap whose holder was registered by the calling agent.",
+        "operationId": "getTssHolderShare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Wrapped share (opaque)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "holder_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "wrap_kind": {
+                      "type": "string",
+                      "enum": [
+                        "sidecar"
+                      ]
+                    },
+                    "wrapped_share": {
+                      "type": "string"
+                    },
+                    "salt": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/prepare": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent declares a send from a delegated client_tss wallet",
+        "description": "Runs the agent's guardrails (chains, allowlists, caps, daily limits,\napproval policy) and the sanctions screen on the declared call, builds\nthe unsigned message and records it as a prepared intent. Only a\nprepared message can enter `/tss/sign/begin`. Requires a treasury\ndelegation and a share provisioned to the agent's runtime.\n",
+        "operationId": "agentTssPrepare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key_id",
+                  "to",
+                  "value"
+                ],
+                "properties": {
+                  "key_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "to": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string",
+                    "description": "Major units."
+                  },
+                  "memo": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Unsigned message"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/sign/begin": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent threshold signing, round 1",
+        "description": "The message must be a live prepared intent for this agent and key; its transfers are screened again.",
+        "operationId": "agentTssSignBegin",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key_id",
+                  "message"
+                ],
+                "properties": {
+                  "key_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "message": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Session opened"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/sign/complete": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent threshold signing, round 2",
+        "operationId": "agentTssSignComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "session_id",
+                  "client_commitments",
+                  "client_signature_share"
+                ],
+                "properties": {
+                  "session_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "client_commitments": {
+                    "type": "string"
+                  },
+                  "client_signature_share": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Signature"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/broadcast": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Broadcast an agent's threshold-signed send",
+        "description": "Verifies the signature under the wallet key, checks the message is the\nprepared one, re-runs the agent's guardrails, records the transaction\n(daily limits count it) and submits. Audited as `treasury_wallet.send`\nwith `via: runtime_share_holder`.\n",
+        "operationId": "agentTssBroadcast",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key_id",
+                  "message",
+                  "signature"
+                ],
+                "properties": {
+                  "key_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "message": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Broadcast",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TreasuryWalletSendResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        }
+      }
+    },
+    "/v1/treasury/passkey-safes": {
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Create a Safe owned by your passkey",
+        "description": "An EVM Safe (v1.4.1) whose only owner is Safe's WebAuthn shared signer,\nconfigured with this passkey's P-256 public key. No private key exists\nanywhere: signing a transaction is a WebAuthn assertion whose challenge\nis the SafeTx hash. The address is counterfactual (CREATE2) until the\nfirst `execute` deploys it. Chains: base, optimism, arbitrum, polygon\n(RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.\n",
+        "operationId": "createPasskeySafe",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "chain",
+                  "passkey_id"
+                ],
+                "properties": {
+                  "chain": {
+                    "type": "string"
+                  },
+                  "passkey_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Safe registered (counterfactual)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeySafe"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "List your passkey-owned Safes",
+        "operationId": "listPasskeySafes",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Safes",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "safes": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/PasskeySafe"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          }
+        }
+      }
+    },
+    "/v1/treasury/passkey-safes/{id}": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "delete": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Forget a passkey Safe",
+        "description": "Deactivates the record only; the Safe and its funds stay on-chain under the passkey.",
+        "operationId": "deactivatePasskeySafe",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deactivated"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/treasury/passkey-safes/{id}/prepare": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Compute the SafeTx hash for a call from a passkey Safe",
+        "description": "Runs the sanctions screen and spend policies on the call, reads the\nSafe's on-chain nonce (0 if not yet deployed), and returns the SafeTx\nhash — the raw 32 bytes are the WebAuthn challenge to sign with\n`userVerification: \"required\"`.\n",
+        "operationId": "preparePasskeySafeTx",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "to",
+                  "value_wei"
+                ],
+                "properties": {
+                  "to": {
+                    "type": "string"
+                  },
+                  "value_wei": {
+                    "type": "string"
+                  },
+                  "data": {
+                    "type": "string",
+                    "description": "Hex calldata",
+                    "optional.": null
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "What to sign",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "safe_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "safe_address": {
+                      "type": "string"
+                    },
+                    "chain": {
+                      "type": "string"
+                    },
+                    "chain_id": {
+                      "type": "integer"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "value_wei": {
+                      "type": "string"
+                    },
+                    "data": {
+                      "type": "string"
+                    },
+                    "nonce": {
+                      "type": "integer"
+                    },
+                    "deploy_required": {
+                      "type": "boolean"
+                    },
+                    "safe_tx_hash": {
+                      "type": "string"
+                    },
+                    "credential_id": {
+                      "type": "string"
+                    },
+                    "rp_id": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/treasury/passkey-safes/{id}/execute": {
       "parameters": [
         {
-          "name": "key_id",
+          "name": "id",
           "in": "path",
           "required": true,
           "schema": {
@@ -9007,9 +10039,9 @@
         "tags": [
           "Key Custody"
         ],
-        "summary": "Threshold signing, round 2 — aggregate and return the signature",
-        "description": "The vault produces its share, verifies the caller's, aggregates, and\nverifies the result under the group key before returning it. A bad\nshare is a `400`, never a published signature.\n",
-        "operationId": "tssSignComplete",
+        "summary": "Relay a passkey-signed Safe transaction",
+        "description": "Recomputes the SafeTx hash, verifies the WebAuthn assertion locally\n(this passkey, this hash, a dashboard origin, UV flag set), wraps it in\nSafe's contract-signature format and relays `execTransaction` — deploying\nthe Safe first if needed — from your Ethereum treasury wallet, which pays\ngas and is not an owner. Audited as `passkey_safe.executed`.\n",
+        "operationId": "executePasskeySafeTx",
         "security": [
           {
             "BearerAuth": []
@@ -9022,112 +10054,37 @@
               "schema": {
                 "type": "object",
                 "required": [
-                  "session_id",
-                  "client_commitments",
-                  "client_signature_share"
+                  "to",
+                  "value_wei",
+                  "nonce",
+                  "authenticator_data",
+                  "client_data_json",
+                  "signature"
                 ],
                 "properties": {
-                  "session_id": {
-                    "type": "string",
-                    "format": "uuid"
-                  },
-                  "client_commitments": {
+                  "to": {
                     "type": "string"
                   },
-                  "client_signature_share": {
+                  "value_wei": {
                     "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Signature",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "key_id": {
-                      "type": "string",
-                      "format": "uuid"
-                    },
-                    "message_digest": {
-                      "type": "string"
-                    },
-                    "signature": {
-                      "type": "string",
-                      "description": "Base64 64-byte Ed25519 signature."
-                    },
-                    "signature_hex": {
-                      "type": "string"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          },
-          "409": {
-            "$ref": "#/components/responses/Conflict"
-          }
-        }
-      }
-    },
-    "/v1/treasury/wallets/{chain}/tss/prepare": {
-      "parameters": [
-        {
-          "name": "chain",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "post": {
-        "tags": [
-          "Key Custody"
-        ],
-        "summary": "Build the unsigned message for a send from a client_tss wallet",
-        "description": "Runs wallet access, the sanctions screen and spend policies on the\ndeclared destination, fetches a recent blockhash and returns the\nunsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`\nand submit with `…/tss/broadcast`.\n",
-        "operationId": "tssTreasuryPrepare",
-        "security": [
-          {
-            "BearerAuth": []
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "to",
-                  "value"
-                ],
-                "properties": {
-                  "to": {
+                  },
+                  "data": {
                     "type": "string"
                   },
-                  "value": {
+                  "nonce": {
+                    "type": "integer"
+                  },
+                  "authenticator_data": {
                     "type": "string",
-                    "description": "Major units",
-                    "e.g. \"0.5\".": null
+                    "description": "Base64url."
                   },
-                  "memo": {
-                    "type": "string"
+                  "client_data_json": {
+                    "type": "string",
+                    "description": "Base64url."
+                  },
+                  "signature": {
+                    "type": "string",
+                    "description": "Base64url DER ECDSA signature."
                   }
                 }
               }
@@ -9136,35 +10093,33 @@
         },
         "responses": {
           "200": {
-            "description": "Unsigned message",
+            "description": "Relayed",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "properties": {
-                    "key_id": {
+                    "safe_id": {
                       "type": "string",
                       "format": "uuid"
                     },
-                    "chain": {
+                    "safe_address": {
                       "type": "string"
                     },
-                    "from": {
-                      "type": "string"
-                    },
-                    "to": {
+                    "chain": {
                       "type": "string"
                     },
-                    "value_base_units": {
+                    "safe_tx_hash": {
                       "type": "string"
                     },
-                    "recent_blockhash": {
-                      "type": "string"
+                    "deploy_tx_hash": {
+                      "type": "string",
+                      "nullable": true
                     },
-                    "message": {
+                    "tx_hash": {
                       "type": "string"
                     },
-                    "message_digest": {
+                    "status": {
                       "type": "string"
                     }
                   }
@@ -9183,82 +10138,9 @@
           },
           "404": {
             "$ref": "#/components/responses/NotFound"
-          }
-        }
-      }
-    },
-    "/v1/treasury/wallets/{chain}/tss/broadcast": {
-      "parameters": [
-        {
-          "name": "chain",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "post": {
-        "tags": [
-          "Key Custody"
-        ],
-        "summary": "Broadcast a threshold-signed send",
-        "description": "Verifies the signature under the wallet's public key over exactly this\nmessage, checks `to` is a transfer destination inside it, assembles the\ntransaction and submits it. Audited as `treasury_wallet.send`.\n",
-        "operationId": "tssTreasuryBroadcast",
-        "security": [
-          {
-            "BearerAuth": []
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "message",
-                  "signature",
-                  "to",
-                  "value_base_units"
-                ],
-                "properties": {
-                  "message": {
-                    "type": "string"
-                  },
-                  "signature": {
-                    "type": "string"
-                  },
-                  "to": {
-                    "type": "string"
-                  },
-                  "value_base_units": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Broadcast",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/TreasuryWalletSendResponse"
-                }
-              }
-            }
           },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
+          "409": {
+            "$ref": "#/components/responses/Conflict"
           }
         }
       }
@@ -39048,7 +39930,8 @@
             "enum": [
               "passkey_prf",
               "recovery_code"
-            ]
+            ],
+            "description": "Sidecar wraps are stored through `PUT /v1/keys/{key_id}/client-share/holder`."
           },
           "credential_id": {
             "type": "string",
@@ -39088,7 +39971,8 @@
             "type": "string",
             "enum": [
               "passkey_prf",
-              "recovery_code"
+              "recovery_code",
+              "sidecar"
             ]
           },
           "credential_id": {
@@ -39096,6 +39980,11 @@
             "format": "uuid",
             "nullable": true
           },
+          "holder_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          },
           "wrapped_share": {
             "type": "string",
             "description": "Base64, exactly as stored."
@@ -39114,6 +40003,81 @@
           }
         }
       },
+      "TssHolder": {
+        "type": "object",
+        "properties": {
+          "holder_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "runtime_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "public_key": {
+            "type": "string"
+          },
+          "registered_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "last_seen_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "PasskeySafe": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "chain_id": {
+            "type": "integer"
+          },
+          "safe_address": {
+            "type": "string"
+          },
+          "passkey_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "custody": {
+            "type": "string",
+            "enum": [
+              "passkey_owner"
+            ]
+          },
+          "deploy_status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "deployed"
+            ]
+          },
+          "deploy_tx_hash": {
+            "type": "string",
+            "nullable": true
+          },
+          "owner_signer": {
+            "type": "string",
+            "description": "The SafeWebAuthnSharedSigner address listed as the Safe's owner."
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
       "ClientShareListResponse": {
         "type": "object",
         "properties": {