@1claw/openapi-spec 0.61.20 → 0.61.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +548 -3
- package/openapi.yaml +303 -2
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.21",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -8657,6 +8657,11 @@
|
|
|
8657
8657
|
"enum": [
|
|
8658
8658
|
"solana"
|
|
8659
8659
|
]
|
|
8660
|
+
},
|
|
8661
|
+
"replace_existing": {
|
|
8662
|
+
"type": "boolean",
|
|
8663
|
+
"default": false,
|
|
8664
|
+
"description": "Re-key ceremony: replace the active server-custody wallet on\nthis chain. On `complete` its balance is swept to the new\naddress by the old key's last signature and the old wallet is\ndeactivated (audit `treasury_wallet.rekeyed`).\n"
|
|
8660
8665
|
}
|
|
8661
8666
|
}
|
|
8662
8667
|
}
|
|
@@ -9263,6 +9268,511 @@
|
|
|
9263
9268
|
}
|
|
9264
9269
|
}
|
|
9265
9270
|
},
|
|
9271
|
+
"/v1/runtimes/{runtime_id}/tss/holder": {
|
|
9272
|
+
"parameters": [
|
|
9273
|
+
{
|
|
9274
|
+
"name": "runtime_id",
|
|
9275
|
+
"in": "path",
|
|
9276
|
+
"required": true,
|
|
9277
|
+
"schema": {
|
|
9278
|
+
"type": "string",
|
|
9279
|
+
"format": "uuid"
|
|
9280
|
+
}
|
|
9281
|
+
}
|
|
9282
|
+
],
|
|
9283
|
+
"post": {
|
|
9284
|
+
"tags": [
|
|
9285
|
+
"Key Custody"
|
|
9286
|
+
],
|
|
9287
|
+
"summary": "Register the runtime's sidecar as a share holder",
|
|
9288
|
+
"description": "Called by the runtime's agent (the Shroud sidecar, at boot) with the P-256\npublic key it generated. The owner can then provision a threshold-key\nshare to this runtime, letting the agent co-sign below-cap sends\nunattended. Re-registering replaces the key; deleting the runtime revokes\nevery share held by it.\n",
|
|
9289
|
+
"operationId": "registerTssHolder",
|
|
9290
|
+
"security": [
|
|
9291
|
+
{
|
|
9292
|
+
"BearerAuth": []
|
|
9293
|
+
}
|
|
9294
|
+
],
|
|
9295
|
+
"requestBody": {
|
|
9296
|
+
"required": true,
|
|
9297
|
+
"content": {
|
|
9298
|
+
"application/json": {
|
|
9299
|
+
"schema": {
|
|
9300
|
+
"type": "object",
|
|
9301
|
+
"required": [
|
|
9302
|
+
"public_key"
|
|
9303
|
+
],
|
|
9304
|
+
"properties": {
|
|
9305
|
+
"public_key": {
|
|
9306
|
+
"type": "string",
|
|
9307
|
+
"description": "Base64 SEC1 uncompressed P-256 point (65 bytes)."
|
|
9308
|
+
}
|
|
9309
|
+
}
|
|
9310
|
+
}
|
|
9311
|
+
}
|
|
9312
|
+
}
|
|
9313
|
+
},
|
|
9314
|
+
"responses": {
|
|
9315
|
+
"201": {
|
|
9316
|
+
"description": "Registered",
|
|
9317
|
+
"content": {
|
|
9318
|
+
"application/json": {
|
|
9319
|
+
"schema": {
|
|
9320
|
+
"$ref": "#/components/schemas/TssHolder"
|
|
9321
|
+
}
|
|
9322
|
+
}
|
|
9323
|
+
}
|
|
9324
|
+
},
|
|
9325
|
+
"400": {
|
|
9326
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9327
|
+
},
|
|
9328
|
+
"401": {
|
|
9329
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9330
|
+
},
|
|
9331
|
+
"403": {
|
|
9332
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9333
|
+
},
|
|
9334
|
+
"404": {
|
|
9335
|
+
"$ref": "#/components/responses/NotFound"
|
|
9336
|
+
}
|
|
9337
|
+
}
|
|
9338
|
+
},
|
|
9339
|
+
"get": {
|
|
9340
|
+
"tags": [
|
|
9341
|
+
"Key Custody"
|
|
9342
|
+
],
|
|
9343
|
+
"summary": "The runtime's registered share holder",
|
|
9344
|
+
"operationId": "getTssHolder",
|
|
9345
|
+
"security": [
|
|
9346
|
+
{
|
|
9347
|
+
"BearerAuth": []
|
|
9348
|
+
}
|
|
9349
|
+
],
|
|
9350
|
+
"responses": {
|
|
9351
|
+
"200": {
|
|
9352
|
+
"description": "Holder",
|
|
9353
|
+
"content": {
|
|
9354
|
+
"application/json": {
|
|
9355
|
+
"schema": {
|
|
9356
|
+
"$ref": "#/components/schemas/TssHolder"
|
|
9357
|
+
}
|
|
9358
|
+
}
|
|
9359
|
+
}
|
|
9360
|
+
},
|
|
9361
|
+
"401": {
|
|
9362
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9363
|
+
},
|
|
9364
|
+
"404": {
|
|
9365
|
+
"$ref": "#/components/responses/NotFound"
|
|
9366
|
+
}
|
|
9367
|
+
}
|
|
9368
|
+
}
|
|
9369
|
+
},
|
|
9370
|
+
"/v1/keys/{key_id}/client-share/holder": {
|
|
9371
|
+
"parameters": [
|
|
9372
|
+
{
|
|
9373
|
+
"name": "key_id",
|
|
9374
|
+
"in": "path",
|
|
9375
|
+
"required": true,
|
|
9376
|
+
"schema": {
|
|
9377
|
+
"type": "string",
|
|
9378
|
+
"format": "uuid"
|
|
9379
|
+
}
|
|
9380
|
+
}
|
|
9381
|
+
],
|
|
9382
|
+
"put": {
|
|
9383
|
+
"tags": [
|
|
9384
|
+
"Key Custody"
|
|
9385
|
+
],
|
|
9386
|
+
"summary": "Provision a threshold-key share to a runtime holder",
|
|
9387
|
+
"description": "The owner's browser unlocks its share with the passkey PRF and re-wraps\nit to the holder's P-256 key (ECIES: ephemeral point ‖ iv ‖ AES-GCM). The\nvault stores the ciphertext unopened. The wallet must be delegated to the\nholder's agent. Audited as `client_share.provisioned_to_runtime`.\n",
|
|
9388
|
+
"operationId": "provisionTssHolderShare",
|
|
9389
|
+
"security": [
|
|
9390
|
+
{
|
|
9391
|
+
"BearerAuth": []
|
|
9392
|
+
}
|
|
9393
|
+
],
|
|
9394
|
+
"requestBody": {
|
|
9395
|
+
"required": true,
|
|
9396
|
+
"content": {
|
|
9397
|
+
"application/json": {
|
|
9398
|
+
"schema": {
|
|
9399
|
+
"type": "object",
|
|
9400
|
+
"required": [
|
|
9401
|
+
"holder_id",
|
|
9402
|
+
"wrapped_share",
|
|
9403
|
+
"salt"
|
|
9404
|
+
],
|
|
9405
|
+
"properties": {
|
|
9406
|
+
"holder_id": {
|
|
9407
|
+
"type": "string",
|
|
9408
|
+
"format": "uuid"
|
|
9409
|
+
},
|
|
9410
|
+
"wrapped_share": {
|
|
9411
|
+
"type": "string"
|
|
9412
|
+
},
|
|
9413
|
+
"salt": {
|
|
9414
|
+
"type": "string"
|
|
9415
|
+
}
|
|
9416
|
+
}
|
|
9417
|
+
}
|
|
9418
|
+
}
|
|
9419
|
+
}
|
|
9420
|
+
},
|
|
9421
|
+
"responses": {
|
|
9422
|
+
"201": {
|
|
9423
|
+
"description": "Stored"
|
|
9424
|
+
},
|
|
9425
|
+
"400": {
|
|
9426
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9427
|
+
},
|
|
9428
|
+
"401": {
|
|
9429
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9430
|
+
},
|
|
9431
|
+
"403": {
|
|
9432
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9433
|
+
},
|
|
9434
|
+
"404": {
|
|
9435
|
+
"$ref": "#/components/responses/NotFound"
|
|
9436
|
+
}
|
|
9437
|
+
}
|
|
9438
|
+
},
|
|
9439
|
+
"get": {
|
|
9440
|
+
"tags": [
|
|
9441
|
+
"Key Custody"
|
|
9442
|
+
],
|
|
9443
|
+
"summary": "The sidecar fetches the wrap made for it",
|
|
9444
|
+
"description": "Agent-only; returns the wrap whose holder was registered by the calling agent.",
|
|
9445
|
+
"operationId": "getTssHolderShare",
|
|
9446
|
+
"security": [
|
|
9447
|
+
{
|
|
9448
|
+
"BearerAuth": []
|
|
9449
|
+
}
|
|
9450
|
+
],
|
|
9451
|
+
"responses": {
|
|
9452
|
+
"200": {
|
|
9453
|
+
"description": "Wrapped share (opaque)",
|
|
9454
|
+
"content": {
|
|
9455
|
+
"application/json": {
|
|
9456
|
+
"schema": {
|
|
9457
|
+
"type": "object",
|
|
9458
|
+
"properties": {
|
|
9459
|
+
"key_id": {
|
|
9460
|
+
"type": "string",
|
|
9461
|
+
"format": "uuid"
|
|
9462
|
+
},
|
|
9463
|
+
"holder_id": {
|
|
9464
|
+
"type": "string",
|
|
9465
|
+
"format": "uuid"
|
|
9466
|
+
},
|
|
9467
|
+
"wrap_kind": {
|
|
9468
|
+
"type": "string",
|
|
9469
|
+
"enum": [
|
|
9470
|
+
"sidecar"
|
|
9471
|
+
]
|
|
9472
|
+
},
|
|
9473
|
+
"wrapped_share": {
|
|
9474
|
+
"type": "string"
|
|
9475
|
+
},
|
|
9476
|
+
"salt": {
|
|
9477
|
+
"type": "string"
|
|
9478
|
+
}
|
|
9479
|
+
}
|
|
9480
|
+
}
|
|
9481
|
+
}
|
|
9482
|
+
}
|
|
9483
|
+
},
|
|
9484
|
+
"401": {
|
|
9485
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9486
|
+
},
|
|
9487
|
+
"403": {
|
|
9488
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9489
|
+
},
|
|
9490
|
+
"404": {
|
|
9491
|
+
"$ref": "#/components/responses/NotFound"
|
|
9492
|
+
}
|
|
9493
|
+
}
|
|
9494
|
+
}
|
|
9495
|
+
},
|
|
9496
|
+
"/v1/agents/{agent_id}/tss/prepare": {
|
|
9497
|
+
"parameters": [
|
|
9498
|
+
{
|
|
9499
|
+
"name": "agent_id",
|
|
9500
|
+
"in": "path",
|
|
9501
|
+
"required": true,
|
|
9502
|
+
"schema": {
|
|
9503
|
+
"type": "string",
|
|
9504
|
+
"format": "uuid"
|
|
9505
|
+
}
|
|
9506
|
+
}
|
|
9507
|
+
],
|
|
9508
|
+
"post": {
|
|
9509
|
+
"tags": [
|
|
9510
|
+
"Key Custody"
|
|
9511
|
+
],
|
|
9512
|
+
"summary": "Agent declares a send from a delegated client_tss wallet",
|
|
9513
|
+
"description": "Runs the agent's guardrails (chains, allowlists, caps, daily limits,\napproval policy) and the sanctions screen on the declared call, builds\nthe unsigned message and records it as a prepared intent. Only a\nprepared message can enter `/tss/sign/begin`. Requires a treasury\ndelegation and a share provisioned to the agent's runtime.\n",
|
|
9514
|
+
"operationId": "agentTssPrepare",
|
|
9515
|
+
"security": [
|
|
9516
|
+
{
|
|
9517
|
+
"BearerAuth": []
|
|
9518
|
+
}
|
|
9519
|
+
],
|
|
9520
|
+
"requestBody": {
|
|
9521
|
+
"required": true,
|
|
9522
|
+
"content": {
|
|
9523
|
+
"application/json": {
|
|
9524
|
+
"schema": {
|
|
9525
|
+
"type": "object",
|
|
9526
|
+
"required": [
|
|
9527
|
+
"key_id",
|
|
9528
|
+
"to",
|
|
9529
|
+
"value"
|
|
9530
|
+
],
|
|
9531
|
+
"properties": {
|
|
9532
|
+
"key_id": {
|
|
9533
|
+
"type": "string",
|
|
9534
|
+
"format": "uuid"
|
|
9535
|
+
},
|
|
9536
|
+
"to": {
|
|
9537
|
+
"type": "string"
|
|
9538
|
+
},
|
|
9539
|
+
"value": {
|
|
9540
|
+
"type": "string",
|
|
9541
|
+
"description": "Major units."
|
|
9542
|
+
},
|
|
9543
|
+
"memo": {
|
|
9544
|
+
"type": "string"
|
|
9545
|
+
}
|
|
9546
|
+
}
|
|
9547
|
+
}
|
|
9548
|
+
}
|
|
9549
|
+
}
|
|
9550
|
+
},
|
|
9551
|
+
"responses": {
|
|
9552
|
+
"200": {
|
|
9553
|
+
"description": "Unsigned message"
|
|
9554
|
+
},
|
|
9555
|
+
"400": {
|
|
9556
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9557
|
+
},
|
|
9558
|
+
"401": {
|
|
9559
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9560
|
+
},
|
|
9561
|
+
"403": {
|
|
9562
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9563
|
+
},
|
|
9564
|
+
"404": {
|
|
9565
|
+
"$ref": "#/components/responses/NotFound"
|
|
9566
|
+
}
|
|
9567
|
+
}
|
|
9568
|
+
}
|
|
9569
|
+
},
|
|
9570
|
+
"/v1/agents/{agent_id}/tss/sign/begin": {
|
|
9571
|
+
"parameters": [
|
|
9572
|
+
{
|
|
9573
|
+
"name": "agent_id",
|
|
9574
|
+
"in": "path",
|
|
9575
|
+
"required": true,
|
|
9576
|
+
"schema": {
|
|
9577
|
+
"type": "string",
|
|
9578
|
+
"format": "uuid"
|
|
9579
|
+
}
|
|
9580
|
+
}
|
|
9581
|
+
],
|
|
9582
|
+
"post": {
|
|
9583
|
+
"tags": [
|
|
9584
|
+
"Key Custody"
|
|
9585
|
+
],
|
|
9586
|
+
"summary": "Agent threshold signing, round 1",
|
|
9587
|
+
"description": "The message must be a live prepared intent for this agent and key; its transfers are screened again.",
|
|
9588
|
+
"operationId": "agentTssSignBegin",
|
|
9589
|
+
"security": [
|
|
9590
|
+
{
|
|
9591
|
+
"BearerAuth": []
|
|
9592
|
+
}
|
|
9593
|
+
],
|
|
9594
|
+
"requestBody": {
|
|
9595
|
+
"required": true,
|
|
9596
|
+
"content": {
|
|
9597
|
+
"application/json": {
|
|
9598
|
+
"schema": {
|
|
9599
|
+
"type": "object",
|
|
9600
|
+
"required": [
|
|
9601
|
+
"key_id",
|
|
9602
|
+
"message"
|
|
9603
|
+
],
|
|
9604
|
+
"properties": {
|
|
9605
|
+
"key_id": {
|
|
9606
|
+
"type": "string",
|
|
9607
|
+
"format": "uuid"
|
|
9608
|
+
},
|
|
9609
|
+
"message": {
|
|
9610
|
+
"type": "string"
|
|
9611
|
+
}
|
|
9612
|
+
}
|
|
9613
|
+
}
|
|
9614
|
+
}
|
|
9615
|
+
}
|
|
9616
|
+
},
|
|
9617
|
+
"responses": {
|
|
9618
|
+
"201": {
|
|
9619
|
+
"description": "Session opened"
|
|
9620
|
+
},
|
|
9621
|
+
"401": {
|
|
9622
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9623
|
+
},
|
|
9624
|
+
"403": {
|
|
9625
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9626
|
+
},
|
|
9627
|
+
"404": {
|
|
9628
|
+
"$ref": "#/components/responses/NotFound"
|
|
9629
|
+
}
|
|
9630
|
+
}
|
|
9631
|
+
}
|
|
9632
|
+
},
|
|
9633
|
+
"/v1/agents/{agent_id}/tss/sign/complete": {
|
|
9634
|
+
"parameters": [
|
|
9635
|
+
{
|
|
9636
|
+
"name": "agent_id",
|
|
9637
|
+
"in": "path",
|
|
9638
|
+
"required": true,
|
|
9639
|
+
"schema": {
|
|
9640
|
+
"type": "string",
|
|
9641
|
+
"format": "uuid"
|
|
9642
|
+
}
|
|
9643
|
+
}
|
|
9644
|
+
],
|
|
9645
|
+
"post": {
|
|
9646
|
+
"tags": [
|
|
9647
|
+
"Key Custody"
|
|
9648
|
+
],
|
|
9649
|
+
"summary": "Agent threshold signing, round 2",
|
|
9650
|
+
"operationId": "agentTssSignComplete",
|
|
9651
|
+
"security": [
|
|
9652
|
+
{
|
|
9653
|
+
"BearerAuth": []
|
|
9654
|
+
}
|
|
9655
|
+
],
|
|
9656
|
+
"requestBody": {
|
|
9657
|
+
"required": true,
|
|
9658
|
+
"content": {
|
|
9659
|
+
"application/json": {
|
|
9660
|
+
"schema": {
|
|
9661
|
+
"type": "object",
|
|
9662
|
+
"required": [
|
|
9663
|
+
"session_id",
|
|
9664
|
+
"client_commitments",
|
|
9665
|
+
"client_signature_share"
|
|
9666
|
+
],
|
|
9667
|
+
"properties": {
|
|
9668
|
+
"session_id": {
|
|
9669
|
+
"type": "string",
|
|
9670
|
+
"format": "uuid"
|
|
9671
|
+
},
|
|
9672
|
+
"client_commitments": {
|
|
9673
|
+
"type": "string"
|
|
9674
|
+
},
|
|
9675
|
+
"client_signature_share": {
|
|
9676
|
+
"type": "string"
|
|
9677
|
+
}
|
|
9678
|
+
}
|
|
9679
|
+
}
|
|
9680
|
+
}
|
|
9681
|
+
}
|
|
9682
|
+
},
|
|
9683
|
+
"responses": {
|
|
9684
|
+
"200": {
|
|
9685
|
+
"description": "Signature"
|
|
9686
|
+
},
|
|
9687
|
+
"400": {
|
|
9688
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9689
|
+
},
|
|
9690
|
+
"401": {
|
|
9691
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9692
|
+
},
|
|
9693
|
+
"404": {
|
|
9694
|
+
"$ref": "#/components/responses/NotFound"
|
|
9695
|
+
},
|
|
9696
|
+
"409": {
|
|
9697
|
+
"$ref": "#/components/responses/Conflict"
|
|
9698
|
+
}
|
|
9699
|
+
}
|
|
9700
|
+
}
|
|
9701
|
+
},
|
|
9702
|
+
"/v1/agents/{agent_id}/tss/broadcast": {
|
|
9703
|
+
"parameters": [
|
|
9704
|
+
{
|
|
9705
|
+
"name": "agent_id",
|
|
9706
|
+
"in": "path",
|
|
9707
|
+
"required": true,
|
|
9708
|
+
"schema": {
|
|
9709
|
+
"type": "string",
|
|
9710
|
+
"format": "uuid"
|
|
9711
|
+
}
|
|
9712
|
+
}
|
|
9713
|
+
],
|
|
9714
|
+
"post": {
|
|
9715
|
+
"tags": [
|
|
9716
|
+
"Key Custody"
|
|
9717
|
+
],
|
|
9718
|
+
"summary": "Broadcast an agent's threshold-signed send",
|
|
9719
|
+
"description": "Verifies the signature under the wallet key, checks the message is the\nprepared one, re-runs the agent's guardrails, records the transaction\n(daily limits count it) and submits. Audited as `treasury_wallet.send`\nwith `via: runtime_share_holder`.\n",
|
|
9720
|
+
"operationId": "agentTssBroadcast",
|
|
9721
|
+
"security": [
|
|
9722
|
+
{
|
|
9723
|
+
"BearerAuth": []
|
|
9724
|
+
}
|
|
9725
|
+
],
|
|
9726
|
+
"requestBody": {
|
|
9727
|
+
"required": true,
|
|
9728
|
+
"content": {
|
|
9729
|
+
"application/json": {
|
|
9730
|
+
"schema": {
|
|
9731
|
+
"type": "object",
|
|
9732
|
+
"required": [
|
|
9733
|
+
"key_id",
|
|
9734
|
+
"message",
|
|
9735
|
+
"signature"
|
|
9736
|
+
],
|
|
9737
|
+
"properties": {
|
|
9738
|
+
"key_id": {
|
|
9739
|
+
"type": "string",
|
|
9740
|
+
"format": "uuid"
|
|
9741
|
+
},
|
|
9742
|
+
"message": {
|
|
9743
|
+
"type": "string"
|
|
9744
|
+
},
|
|
9745
|
+
"signature": {
|
|
9746
|
+
"type": "string"
|
|
9747
|
+
}
|
|
9748
|
+
}
|
|
9749
|
+
}
|
|
9750
|
+
}
|
|
9751
|
+
}
|
|
9752
|
+
},
|
|
9753
|
+
"responses": {
|
|
9754
|
+
"200": {
|
|
9755
|
+
"description": "Broadcast",
|
|
9756
|
+
"content": {
|
|
9757
|
+
"application/json": {
|
|
9758
|
+
"schema": {
|
|
9759
|
+
"$ref": "#/components/schemas/TreasuryWalletSendResponse"
|
|
9760
|
+
}
|
|
9761
|
+
}
|
|
9762
|
+
}
|
|
9763
|
+
},
|
|
9764
|
+
"400": {
|
|
9765
|
+
"$ref": "#/components/responses/BadRequest"
|
|
9766
|
+
},
|
|
9767
|
+
"401": {
|
|
9768
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
9769
|
+
},
|
|
9770
|
+
"403": {
|
|
9771
|
+
"$ref": "#/components/responses/Forbidden"
|
|
9772
|
+
}
|
|
9773
|
+
}
|
|
9774
|
+
}
|
|
9775
|
+
},
|
|
9266
9776
|
"/v1/treasury/passkey-safes": {
|
|
9267
9777
|
"post": {
|
|
9268
9778
|
"tags": [
|
|
@@ -39420,7 +39930,8 @@
|
|
|
39420
39930
|
"enum": [
|
|
39421
39931
|
"passkey_prf",
|
|
39422
39932
|
"recovery_code"
|
|
39423
|
-
]
|
|
39933
|
+
],
|
|
39934
|
+
"description": "Sidecar wraps are stored through `PUT /v1/keys/{key_id}/client-share/holder`."
|
|
39424
39935
|
},
|
|
39425
39936
|
"credential_id": {
|
|
39426
39937
|
"type": "string",
|
|
@@ -39460,7 +39971,8 @@
|
|
|
39460
39971
|
"type": "string",
|
|
39461
39972
|
"enum": [
|
|
39462
39973
|
"passkey_prf",
|
|
39463
|
-
"recovery_code"
|
|
39974
|
+
"recovery_code",
|
|
39975
|
+
"sidecar"
|
|
39464
39976
|
]
|
|
39465
39977
|
},
|
|
39466
39978
|
"credential_id": {
|
|
@@ -39468,6 +39980,11 @@
|
|
|
39468
39980
|
"format": "uuid",
|
|
39469
39981
|
"nullable": true
|
|
39470
39982
|
},
|
|
39983
|
+
"holder_id": {
|
|
39984
|
+
"type": "string",
|
|
39985
|
+
"format": "uuid",
|
|
39986
|
+
"nullable": true
|
|
39987
|
+
},
|
|
39471
39988
|
"wrapped_share": {
|
|
39472
39989
|
"type": "string",
|
|
39473
39990
|
"description": "Base64, exactly as stored."
|
|
@@ -39486,6 +40003,34 @@
|
|
|
39486
40003
|
}
|
|
39487
40004
|
}
|
|
39488
40005
|
},
|
|
40006
|
+
"TssHolder": {
|
|
40007
|
+
"type": "object",
|
|
40008
|
+
"properties": {
|
|
40009
|
+
"holder_id": {
|
|
40010
|
+
"type": "string",
|
|
40011
|
+
"format": "uuid"
|
|
40012
|
+
},
|
|
40013
|
+
"runtime_id": {
|
|
40014
|
+
"type": "string",
|
|
40015
|
+
"format": "uuid"
|
|
40016
|
+
},
|
|
40017
|
+
"agent_id": {
|
|
40018
|
+
"type": "string",
|
|
40019
|
+
"format": "uuid"
|
|
40020
|
+
},
|
|
40021
|
+
"public_key": {
|
|
40022
|
+
"type": "string"
|
|
40023
|
+
},
|
|
40024
|
+
"registered_at": {
|
|
40025
|
+
"type": "string",
|
|
40026
|
+
"format": "date-time"
|
|
40027
|
+
},
|
|
40028
|
+
"last_seen_at": {
|
|
40029
|
+
"type": "string",
|
|
40030
|
+
"format": "date-time"
|
|
40031
|
+
}
|
|
40032
|
+
}
|
|
40033
|
+
},
|
|
39489
40034
|
"PasskeySafe": {
|
|
39490
40035
|
"type": "object",
|
|
39491
40036
|
"properties": {
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.21"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -5623,6 +5623,14 @@ paths:
|
|
|
5623
5623
|
chain:
|
|
5624
5624
|
type: string
|
|
5625
5625
|
enum: [solana]
|
|
5626
|
+
replace_existing:
|
|
5627
|
+
type: boolean
|
|
5628
|
+
default: false
|
|
5629
|
+
description: |
|
|
5630
|
+
Re-key ceremony: replace the active server-custody wallet on
|
|
5631
|
+
this chain. On `complete` its balance is swept to the new
|
|
5632
|
+
address by the old key's last signature and the old wallet is
|
|
5633
|
+
deactivated (audit `treasury_wallet.rekeyed`).
|
|
5626
5634
|
responses:
|
|
5627
5635
|
"201":
|
|
5628
5636
|
description: Session opened; the vault's round-1 package
|
|
@@ -5942,6 +5950,284 @@ paths:
|
|
|
5942
5950
|
"404":
|
|
5943
5951
|
$ref: "#/components/responses/NotFound"
|
|
5944
5952
|
|
|
5953
|
+
/v1/runtimes/{runtime_id}/tss/holder:
|
|
5954
|
+
parameters:
|
|
5955
|
+
- name: runtime_id
|
|
5956
|
+
in: path
|
|
5957
|
+
required: true
|
|
5958
|
+
schema: { type: string, format: uuid }
|
|
5959
|
+
post:
|
|
5960
|
+
tags: [Key Custody]
|
|
5961
|
+
summary: Register the runtime's sidecar as a share holder
|
|
5962
|
+
description: |
|
|
5963
|
+
Called by the runtime's agent (the Shroud sidecar, at boot) with the P-256
|
|
5964
|
+
public key it generated. The owner can then provision a threshold-key
|
|
5965
|
+
share to this runtime, letting the agent co-sign below-cap sends
|
|
5966
|
+
unattended. Re-registering replaces the key; deleting the runtime revokes
|
|
5967
|
+
every share held by it.
|
|
5968
|
+
operationId: registerTssHolder
|
|
5969
|
+
security:
|
|
5970
|
+
- BearerAuth: []
|
|
5971
|
+
requestBody:
|
|
5972
|
+
required: true
|
|
5973
|
+
content:
|
|
5974
|
+
application/json:
|
|
5975
|
+
schema:
|
|
5976
|
+
type: object
|
|
5977
|
+
required: [public_key]
|
|
5978
|
+
properties:
|
|
5979
|
+
public_key: { type: string, description: Base64 SEC1 uncompressed P-256 point (65 bytes). }
|
|
5980
|
+
responses:
|
|
5981
|
+
"201":
|
|
5982
|
+
description: Registered
|
|
5983
|
+
content:
|
|
5984
|
+
application/json:
|
|
5985
|
+
schema:
|
|
5986
|
+
$ref: "#/components/schemas/TssHolder"
|
|
5987
|
+
"400":
|
|
5988
|
+
$ref: "#/components/responses/BadRequest"
|
|
5989
|
+
"401":
|
|
5990
|
+
$ref: "#/components/responses/Unauthorized"
|
|
5991
|
+
"403":
|
|
5992
|
+
$ref: "#/components/responses/Forbidden"
|
|
5993
|
+
"404":
|
|
5994
|
+
$ref: "#/components/responses/NotFound"
|
|
5995
|
+
get:
|
|
5996
|
+
tags: [Key Custody]
|
|
5997
|
+
summary: The runtime's registered share holder
|
|
5998
|
+
operationId: getTssHolder
|
|
5999
|
+
security:
|
|
6000
|
+
- BearerAuth: []
|
|
6001
|
+
responses:
|
|
6002
|
+
"200":
|
|
6003
|
+
description: Holder
|
|
6004
|
+
content:
|
|
6005
|
+
application/json:
|
|
6006
|
+
schema:
|
|
6007
|
+
$ref: "#/components/schemas/TssHolder"
|
|
6008
|
+
"401":
|
|
6009
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6010
|
+
"404":
|
|
6011
|
+
$ref: "#/components/responses/NotFound"
|
|
6012
|
+
|
|
6013
|
+
/v1/keys/{key_id}/client-share/holder:
|
|
6014
|
+
parameters:
|
|
6015
|
+
- name: key_id
|
|
6016
|
+
in: path
|
|
6017
|
+
required: true
|
|
6018
|
+
schema: { type: string, format: uuid }
|
|
6019
|
+
put:
|
|
6020
|
+
tags: [Key Custody]
|
|
6021
|
+
summary: Provision a threshold-key share to a runtime holder
|
|
6022
|
+
description: |
|
|
6023
|
+
The owner's browser unlocks its share with the passkey PRF and re-wraps
|
|
6024
|
+
it to the holder's P-256 key (ECIES: ephemeral point ‖ iv ‖ AES-GCM). The
|
|
6025
|
+
vault stores the ciphertext unopened. The wallet must be delegated to the
|
|
6026
|
+
holder's agent. Audited as `client_share.provisioned_to_runtime`.
|
|
6027
|
+
operationId: provisionTssHolderShare
|
|
6028
|
+
security:
|
|
6029
|
+
- BearerAuth: []
|
|
6030
|
+
requestBody:
|
|
6031
|
+
required: true
|
|
6032
|
+
content:
|
|
6033
|
+
application/json:
|
|
6034
|
+
schema:
|
|
6035
|
+
type: object
|
|
6036
|
+
required: [holder_id, wrapped_share, salt]
|
|
6037
|
+
properties:
|
|
6038
|
+
holder_id: { type: string, format: uuid }
|
|
6039
|
+
wrapped_share: { type: string }
|
|
6040
|
+
salt: { type: string }
|
|
6041
|
+
responses:
|
|
6042
|
+
"201":
|
|
6043
|
+
description: Stored
|
|
6044
|
+
"400":
|
|
6045
|
+
$ref: "#/components/responses/BadRequest"
|
|
6046
|
+
"401":
|
|
6047
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6048
|
+
"403":
|
|
6049
|
+
$ref: "#/components/responses/Forbidden"
|
|
6050
|
+
"404":
|
|
6051
|
+
$ref: "#/components/responses/NotFound"
|
|
6052
|
+
get:
|
|
6053
|
+
tags: [Key Custody]
|
|
6054
|
+
summary: The sidecar fetches the wrap made for it
|
|
6055
|
+
description: Agent-only; returns the wrap whose holder was registered by the calling agent.
|
|
6056
|
+
operationId: getTssHolderShare
|
|
6057
|
+
security:
|
|
6058
|
+
- BearerAuth: []
|
|
6059
|
+
responses:
|
|
6060
|
+
"200":
|
|
6061
|
+
description: Wrapped share (opaque)
|
|
6062
|
+
content:
|
|
6063
|
+
application/json:
|
|
6064
|
+
schema:
|
|
6065
|
+
type: object
|
|
6066
|
+
properties:
|
|
6067
|
+
key_id: { type: string, format: uuid }
|
|
6068
|
+
holder_id: { type: string, format: uuid }
|
|
6069
|
+
wrap_kind: { type: string, enum: [sidecar] }
|
|
6070
|
+
wrapped_share: { type: string }
|
|
6071
|
+
salt: { type: string }
|
|
6072
|
+
"401":
|
|
6073
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6074
|
+
"403":
|
|
6075
|
+
$ref: "#/components/responses/Forbidden"
|
|
6076
|
+
"404":
|
|
6077
|
+
$ref: "#/components/responses/NotFound"
|
|
6078
|
+
|
|
6079
|
+
/v1/agents/{agent_id}/tss/prepare:
|
|
6080
|
+
parameters:
|
|
6081
|
+
- name: agent_id
|
|
6082
|
+
in: path
|
|
6083
|
+
required: true
|
|
6084
|
+
schema: { type: string, format: uuid }
|
|
6085
|
+
post:
|
|
6086
|
+
tags: [Key Custody]
|
|
6087
|
+
summary: Agent declares a send from a delegated client_tss wallet
|
|
6088
|
+
description: |
|
|
6089
|
+
Runs the agent's guardrails (chains, allowlists, caps, daily limits,
|
|
6090
|
+
approval policy) and the sanctions screen on the declared call, builds
|
|
6091
|
+
the unsigned message and records it as a prepared intent. Only a
|
|
6092
|
+
prepared message can enter `/tss/sign/begin`. Requires a treasury
|
|
6093
|
+
delegation and a share provisioned to the agent's runtime.
|
|
6094
|
+
operationId: agentTssPrepare
|
|
6095
|
+
security:
|
|
6096
|
+
- BearerAuth: []
|
|
6097
|
+
requestBody:
|
|
6098
|
+
required: true
|
|
6099
|
+
content:
|
|
6100
|
+
application/json:
|
|
6101
|
+
schema:
|
|
6102
|
+
type: object
|
|
6103
|
+
required: [key_id, to, value]
|
|
6104
|
+
properties:
|
|
6105
|
+
key_id: { type: string, format: uuid }
|
|
6106
|
+
to: { type: string }
|
|
6107
|
+
value: { type: string, description: Major units. }
|
|
6108
|
+
memo: { type: string }
|
|
6109
|
+
responses:
|
|
6110
|
+
"200":
|
|
6111
|
+
description: Unsigned message
|
|
6112
|
+
"400":
|
|
6113
|
+
$ref: "#/components/responses/BadRequest"
|
|
6114
|
+
"401":
|
|
6115
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6116
|
+
"403":
|
|
6117
|
+
$ref: "#/components/responses/Forbidden"
|
|
6118
|
+
"404":
|
|
6119
|
+
$ref: "#/components/responses/NotFound"
|
|
6120
|
+
|
|
6121
|
+
/v1/agents/{agent_id}/tss/sign/begin:
|
|
6122
|
+
parameters:
|
|
6123
|
+
- name: agent_id
|
|
6124
|
+
in: path
|
|
6125
|
+
required: true
|
|
6126
|
+
schema: { type: string, format: uuid }
|
|
6127
|
+
post:
|
|
6128
|
+
tags: [Key Custody]
|
|
6129
|
+
summary: Agent threshold signing, round 1
|
|
6130
|
+
description: The message must be a live prepared intent for this agent and key; its transfers are screened again.
|
|
6131
|
+
operationId: agentTssSignBegin
|
|
6132
|
+
security:
|
|
6133
|
+
- BearerAuth: []
|
|
6134
|
+
requestBody:
|
|
6135
|
+
required: true
|
|
6136
|
+
content:
|
|
6137
|
+
application/json:
|
|
6138
|
+
schema:
|
|
6139
|
+
type: object
|
|
6140
|
+
required: [key_id, message]
|
|
6141
|
+
properties:
|
|
6142
|
+
key_id: { type: string, format: uuid }
|
|
6143
|
+
message: { type: string }
|
|
6144
|
+
responses:
|
|
6145
|
+
"201":
|
|
6146
|
+
description: Session opened
|
|
6147
|
+
"401":
|
|
6148
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6149
|
+
"403":
|
|
6150
|
+
$ref: "#/components/responses/Forbidden"
|
|
6151
|
+
"404":
|
|
6152
|
+
$ref: "#/components/responses/NotFound"
|
|
6153
|
+
|
|
6154
|
+
/v1/agents/{agent_id}/tss/sign/complete:
|
|
6155
|
+
parameters:
|
|
6156
|
+
- name: agent_id
|
|
6157
|
+
in: path
|
|
6158
|
+
required: true
|
|
6159
|
+
schema: { type: string, format: uuid }
|
|
6160
|
+
post:
|
|
6161
|
+
tags: [Key Custody]
|
|
6162
|
+
summary: Agent threshold signing, round 2
|
|
6163
|
+
operationId: agentTssSignComplete
|
|
6164
|
+
security:
|
|
6165
|
+
- BearerAuth: []
|
|
6166
|
+
requestBody:
|
|
6167
|
+
required: true
|
|
6168
|
+
content:
|
|
6169
|
+
application/json:
|
|
6170
|
+
schema:
|
|
6171
|
+
type: object
|
|
6172
|
+
required: [session_id, client_commitments, client_signature_share]
|
|
6173
|
+
properties:
|
|
6174
|
+
session_id: { type: string, format: uuid }
|
|
6175
|
+
client_commitments: { type: string }
|
|
6176
|
+
client_signature_share: { type: string }
|
|
6177
|
+
responses:
|
|
6178
|
+
"200":
|
|
6179
|
+
description: Signature
|
|
6180
|
+
"400":
|
|
6181
|
+
$ref: "#/components/responses/BadRequest"
|
|
6182
|
+
"401":
|
|
6183
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6184
|
+
"404":
|
|
6185
|
+
$ref: "#/components/responses/NotFound"
|
|
6186
|
+
"409":
|
|
6187
|
+
$ref: "#/components/responses/Conflict"
|
|
6188
|
+
|
|
6189
|
+
/v1/agents/{agent_id}/tss/broadcast:
|
|
6190
|
+
parameters:
|
|
6191
|
+
- name: agent_id
|
|
6192
|
+
in: path
|
|
6193
|
+
required: true
|
|
6194
|
+
schema: { type: string, format: uuid }
|
|
6195
|
+
post:
|
|
6196
|
+
tags: [Key Custody]
|
|
6197
|
+
summary: Broadcast an agent's threshold-signed send
|
|
6198
|
+
description: |
|
|
6199
|
+
Verifies the signature under the wallet key, checks the message is the
|
|
6200
|
+
prepared one, re-runs the agent's guardrails, records the transaction
|
|
6201
|
+
(daily limits count it) and submits. Audited as `treasury_wallet.send`
|
|
6202
|
+
with `via: runtime_share_holder`.
|
|
6203
|
+
operationId: agentTssBroadcast
|
|
6204
|
+
security:
|
|
6205
|
+
- BearerAuth: []
|
|
6206
|
+
requestBody:
|
|
6207
|
+
required: true
|
|
6208
|
+
content:
|
|
6209
|
+
application/json:
|
|
6210
|
+
schema:
|
|
6211
|
+
type: object
|
|
6212
|
+
required: [key_id, message, signature]
|
|
6213
|
+
properties:
|
|
6214
|
+
key_id: { type: string, format: uuid }
|
|
6215
|
+
message: { type: string }
|
|
6216
|
+
signature: { type: string }
|
|
6217
|
+
responses:
|
|
6218
|
+
"200":
|
|
6219
|
+
description: Broadcast
|
|
6220
|
+
content:
|
|
6221
|
+
application/json:
|
|
6222
|
+
schema:
|
|
6223
|
+
$ref: "#/components/schemas/TreasuryWalletSendResponse"
|
|
6224
|
+
"400":
|
|
6225
|
+
$ref: "#/components/responses/BadRequest"
|
|
6226
|
+
"401":
|
|
6227
|
+
$ref: "#/components/responses/Unauthorized"
|
|
6228
|
+
"403":
|
|
6229
|
+
$ref: "#/components/responses/Forbidden"
|
|
6230
|
+
|
|
5945
6231
|
/v1/treasury/passkey-safes:
|
|
5946
6232
|
post:
|
|
5947
6233
|
tags: [Key Custody]
|
|
@@ -25636,6 +25922,7 @@ components:
|
|
|
25636
25922
|
wrap_kind:
|
|
25637
25923
|
type: string
|
|
25638
25924
|
enum: [passkey_prf, recovery_code]
|
|
25925
|
+
description: Sidecar wraps are stored through `PUT /v1/keys/{key_id}/client-share/holder`.
|
|
25639
25926
|
credential_id:
|
|
25640
25927
|
type: string
|
|
25641
25928
|
format: uuid
|
|
@@ -25662,11 +25949,15 @@ components:
|
|
|
25662
25949
|
enum: [agent_signing_key, treasury_wallet]
|
|
25663
25950
|
wrap_kind:
|
|
25664
25951
|
type: string
|
|
25665
|
-
enum: [passkey_prf, recovery_code]
|
|
25952
|
+
enum: [passkey_prf, recovery_code, sidecar]
|
|
25666
25953
|
credential_id:
|
|
25667
25954
|
type: string
|
|
25668
25955
|
format: uuid
|
|
25669
25956
|
nullable: true
|
|
25957
|
+
holder_id:
|
|
25958
|
+
type: string
|
|
25959
|
+
format: uuid
|
|
25960
|
+
nullable: true
|
|
25670
25961
|
wrapped_share:
|
|
25671
25962
|
type: string
|
|
25672
25963
|
description: Base64, exactly as stored.
|
|
@@ -25680,6 +25971,16 @@ components:
|
|
|
25680
25971
|
type: string
|
|
25681
25972
|
format: date-time
|
|
25682
25973
|
|
|
25974
|
+
TssHolder:
|
|
25975
|
+
type: object
|
|
25976
|
+
properties:
|
|
25977
|
+
holder_id: { type: string, format: uuid }
|
|
25978
|
+
runtime_id: { type: string, format: uuid }
|
|
25979
|
+
agent_id: { type: string, format: uuid }
|
|
25980
|
+
public_key: { type: string }
|
|
25981
|
+
registered_at: { type: string, format: date-time }
|
|
25982
|
+
last_seen_at: { type: string, format: date-time }
|
|
25983
|
+
|
|
25683
25984
|
PasskeySafe:
|
|
25684
25985
|
type: object
|
|
25685
25986
|
properties:
|