@1claw/openapi-spec 0.61.20 → 0.61.22

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.20",
+    "version": "0.61.22",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -8657,6 +8657,11 @@
                     "enum": [
                       "solana"
                     ]
+                  },
+                  "replace_existing": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Re-key ceremony: replace the active server-custody wallet on\nthis chain. On `complete` its balance is swept to the new\naddress by the old key's last signature and the old wallet is\ndeactivated (audit `treasury_wallet.rekeyed`).\n"
                   }
                 }
               }
@@ -9044,30 +9049,640 @@
         },
         "responses": {
           "200": {
-            "description": "Signature",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "key_id": {
-                      "type": "string",
-                      "format": "uuid"
-                    },
-                    "message_digest": {
-                      "type": "string"
-                    },
-                    "signature": {
-                      "type": "string",
-                      "description": "Base64 64-byte Ed25519 signature."
-                    },
-                    "signature_hex": {
-                      "type": "string"
-                    }
-                  }
-                }
-              }
-            }
+            "description": "Signature",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "message_digest": {
+                      "type": "string"
+                    },
+                    "signature": {
+                      "type": "string",
+                      "description": "Base64 64-byte Ed25519 signature."
+                    },
+                    "signature_hex": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
+    "/v1/treasury/wallets/{chain}/tss/prepare": {
+      "parameters": [
+        {
+          "name": "chain",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Build the unsigned message for a send from a client_tss wallet",
+        "description": "Runs wallet access, the sanctions screen and spend policies on the\ndeclared destination, fetches a recent blockhash and returns the\nunsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`\nand submit with `…/tss/broadcast`.\n",
+        "operationId": "tssTreasuryPrepare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "to",
+                  "value"
+                ],
+                "properties": {
+                  "to": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string",
+                    "description": "Major units",
+                    "e.g. \"0.5\".": null
+                  },
+                  "memo": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Unsigned message",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "chain": {
+                      "type": "string"
+                    },
+                    "from": {
+                      "type": "string"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "value_base_units": {
+                      "type": "string"
+                    },
+                    "recent_blockhash": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    },
+                    "message_digest": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/treasury/wallets/{chain}/tss/broadcast": {
+      "parameters": [
+        {
+          "name": "chain",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Broadcast a threshold-signed send",
+        "description": "Verifies the signature under the wallet's public key over exactly this\nmessage, checks `to` is a transfer destination inside it, assembles the\ntransaction and submits it. Audited as `treasury_wallet.send`.\n",
+        "operationId": "tssTreasuryBroadcast",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "message",
+                  "signature",
+                  "to",
+                  "value_base_units"
+                ],
+                "properties": {
+                  "message": {
+                    "type": "string"
+                  },
+                  "signature": {
+                    "type": "string"
+                  },
+                  "to": {
+                    "type": "string"
+                  },
+                  "value_base_units": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Broadcast",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TreasuryWalletSendResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/runtimes/{runtime_id}/tss/holder": {
+      "parameters": [
+        {
+          "name": "runtime_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Register the runtime's sidecar as a share holder",
+        "description": "Called by the runtime's agent (the Shroud sidecar, at boot) with the P-256\npublic key it generated. The owner can then provision a threshold-key\nshare to this runtime, letting the agent co-sign below-cap sends\nunattended. Re-registering replaces the key; deleting the runtime revokes\nevery share held by it.\n",
+        "operationId": "registerTssHolder",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "public_key"
+                ],
+                "properties": {
+                  "public_key": {
+                    "type": "string",
+                    "description": "Base64 SEC1 uncompressed P-256 point (65 bytes)."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Registered",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TssHolder"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "The runtime's registered share holder",
+        "operationId": "getTssHolder",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Holder",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TssHolder"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/keys/{key_id}/client-share/holder": {
+      "parameters": [
+        {
+          "name": "key_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "put": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Provision a threshold-key share to a runtime holder",
+        "description": "The owner's browser unlocks its share with the passkey PRF and re-wraps\nit to the holder's P-256 key (ECIES: ephemeral point ‖ iv ‖ AES-GCM). The\nvault stores the ciphertext unopened. The wallet must be delegated to the\nholder's agent. Audited as `client_share.provisioned_to_runtime`.\n",
+        "operationId": "provisionTssHolderShare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "holder_id",
+                  "wrapped_share",
+                  "salt"
+                ],
+                "properties": {
+                  "holder_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "wrapped_share": {
+                    "type": "string"
+                  },
+                  "salt": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Stored"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "The sidecar fetches the wrap made for it",
+        "description": "Agent-only; returns the wrap whose holder was registered by the calling agent.",
+        "operationId": "getTssHolderShare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Wrapped share (opaque)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "holder_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "wrap_kind": {
+                      "type": "string",
+                      "enum": [
+                        "sidecar"
+                      ]
+                    },
+                    "wrapped_share": {
+                      "type": "string"
+                    },
+                    "salt": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/prepare": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent declares a send from a delegated client_tss wallet",
+        "description": "Runs the agent's guardrails (chains, allowlists, caps, daily limits,\napproval policy) and the sanctions screen on the declared call, builds\nthe unsigned message and records it as a prepared intent. Only a\nprepared message can enter `/tss/sign/begin`. Requires a treasury\ndelegation and a share provisioned to the agent's runtime.\n",
+        "operationId": "agentTssPrepare",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key_id",
+                  "to",
+                  "value"
+                ],
+                "properties": {
+                  "key_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "to": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "string",
+                    "description": "Major units."
+                  },
+                  "memo": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Unsigned message"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/sign/begin": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent threshold signing, round 1",
+        "description": "The message must be a live prepared intent for this agent and key; its transfers are screened again.",
+        "operationId": "agentTssSignBegin",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "key_id",
+                  "message"
+                ],
+                "properties": {
+                  "key_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "message": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Session opened"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/tss/sign/complete": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Agent threshold signing, round 2",
+        "operationId": "agentTssSignComplete",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "session_id",
+                  "client_commitments",
+                  "client_signature_share"
+                ],
+                "properties": {
+                  "session_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "client_commitments": {
+                    "type": "string"
+                  },
+                  "client_signature_share": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Signature"
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -9084,14 +9699,15 @@
         }
       }
     },
-    "/v1/treasury/wallets/{chain}/tss/prepare": {
+    "/v1/agents/{agent_id}/tss/broadcast": {
       "parameters": [
         {
-          "name": "chain",
+          "name": "agent_id",
           "in": "path",
           "required": true,
           "schema": {
-            "type": "string"
+            "type": "string",
+            "format": "uuid"
           }
         }
       ],
@@ -9099,9 +9715,9 @@
         "tags": [
           "Key Custody"
         ],
-        "summary": "Build the unsigned message for a send from a client_tss wallet",
-        "description": "Runs wallet access, the sanctions screen and spend policies on the\ndeclared destination, fetches a recent blockhash and returns the\nunsigned transaction message. Sign it with `/v1/keys/{key_id}/tss/sign/*`\nand submit with `…/tss/broadcast`.\n",
-        "operationId": "tssTreasuryPrepare",
+        "summary": "Broadcast an agent's threshold-signed send",
+        "description": "Verifies the signature under the wallet key, checks the message is the\nprepared one, re-runs the agent's guardrails, records the transaction\n(daily limits count it) and submits. Audited as `treasury_wallet.send`\nwith `via: runtime_share_holder`.\n",
+        "operationId": "agentTssBroadcast",
         "security": [
           {
             "BearerAuth": []
@@ -9114,126 +9730,20 @@
               "schema": {
                 "type": "object",
                 "required": [
-                  "to",
-                  "value"
+                  "key_id",
+                  "message",
+                  "signature"
                 ],
                 "properties": {
-                  "to": {
-                    "type": "string"
-                  },
-                  "value": {
+                  "key_id": {
                     "type": "string",
-                    "description": "Major units",
-                    "e.g. \"0.5\".": null
+                    "format": "uuid"
                   },
-                  "memo": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Unsigned message",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "key_id": {
-                      "type": "string",
-                      "format": "uuid"
-                    },
-                    "chain": {
-                      "type": "string"
-                    },
-                    "from": {
-                      "type": "string"
-                    },
-                    "to": {
-                      "type": "string"
-                    },
-                    "value_base_units": {
-                      "type": "string"
-                    },
-                    "recent_blockhash": {
-                      "type": "string"
-                    },
-                    "message": {
-                      "type": "string"
-                    },
-                    "message_digest": {
-                      "type": "string"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        }
-      }
-    },
-    "/v1/treasury/wallets/{chain}/tss/broadcast": {
-      "parameters": [
-        {
-          "name": "chain",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "post": {
-        "tags": [
-          "Key Custody"
-        ],
-        "summary": "Broadcast a threshold-signed send",
-        "description": "Verifies the signature under the wallet's public key over exactly this\nmessage, checks `to` is a transfer destination inside it, assembles the\ntransaction and submits it. Audited as `treasury_wallet.send`.\n",
-        "operationId": "tssTreasuryBroadcast",
-        "security": [
-          {
-            "BearerAuth": []
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "message",
-                  "signature",
-                  "to",
-                  "value_base_units"
-                ],
-                "properties": {
                   "message": {
                     "type": "string"
                   },
                   "signature": {
                     "type": "string"
-                  },
-                  "to": {
-                    "type": "string"
-                  },
-                  "value_base_units": {
-                    "type": "string"
                   }
                 }
               }
@@ -9257,8 +9767,8 @@
           "401": {
             "$ref": "#/components/responses/Unauthorized"
           },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         }
       }
@@ -24792,6 +25302,54 @@
         }
       }
     },
+    "/v1/agents/enroll/{pairing_id}/status": {
+      "parameters": [
+        {
+          "name": "pairing_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        },
+        {
+          "name": "poll",
+          "in": "query",
+          "required": true,
+          "schema": {
+            "type": "string"
+          },
+          "description": "The `poll_token` from the enrol response."
+        }
+      ],
+      "get": {
+        "tags": [
+          "Agents"
+        ],
+        "summary": "Public: pairing status — the agent learns the decision and collects its key once",
+        "operationId": "getEnrollmentStatus",
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EnrollmentStatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/agents/enroll/pending": {
       "get": {
         "tags": [
@@ -24802,7 +25360,30 @@
         "security": [],
         "responses": {
           "200": {
-            "description": "Success"
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "agent_name": {
+                      "type": "string"
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "fingerprint": {
+                      "type": "string",
+                      "description": "Pairing only — the agent key's `SHA256:` fingerprint to verify visually."
+                    },
+                    "description": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
           },
           "404": {
             "description": "Not found"
@@ -30834,6 +31415,10 @@
           "description": {
             "type": "string",
             "description": "Optional agent description"
+          },
+          "public_key": {
+            "type": "string",
+            "description": "Pairing ceremony. The agent's own Ed25519 public key (`ssh-ed25519 AAAA…`\nor base64 of the raw 32 bytes). Its `SHA256:` fingerprint is shown to the\nhuman on the approval page for visual verification, and the agent\ncollects its API key itself by polling\n`GET /v1/agents/enroll/{pairing_id}/status?poll=<poll_token>` — no key\nin an email, nothing to copy. `1claw agent enroll --pair` does all of this.\n"
           }
         }
       },
@@ -30853,6 +31438,62 @@
             "type": "string",
             "format": "uri",
             "description": "Present when a pending enrollment was created and the client should show\nthis link (email flow includes it as a fallback; name-only flow requires it).\n"
+          },
+          "pairing_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Pairing only."
+          },
+          "fingerprint": {
+            "type": "string",
+            "description": "Pairing only. `SHA256:<base64>` of the key, as `ssh-keygen -lf` prints it. Show it to the human."
+          },
+          "poll_token": {
+            "type": "string",
+            "description": "Pairing only. Presented as `?poll=` on the status endpoint. Shown once."
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "EnrollmentStatusResponse": {
+        "type": "object",
+        "properties": {
+          "pairing_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "approved",
+              "denied",
+              "expired"
+            ]
+          },
+          "agent_name": {
+            "type": "string"
+          },
+          "fingerprint": {
+            "type": "string",
+            "nullable": true
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "api_key": {
+            "type": "string",
+            "description": "Present exactly once, on the first poll after approval; the pairing is then closed."
+          },
+          "vault_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           }
         }
       },
@@ -39420,7 +40061,8 @@
             "enum": [
               "passkey_prf",
               "recovery_code"
-            ]
+            ],
+            "description": "Sidecar wraps are stored through `PUT /v1/keys/{key_id}/client-share/holder`."
           },
           "credential_id": {
             "type": "string",
@@ -39460,7 +40102,8 @@
             "type": "string",
             "enum": [
               "passkey_prf",
-              "recovery_code"
+              "recovery_code",
+              "sidecar"
             ]
           },
           "credential_id": {
@@ -39468,6 +40111,11 @@
             "format": "uuid",
             "nullable": true
           },
+          "holder_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true
+          },
           "wrapped_share": {
             "type": "string",
             "description": "Base64, exactly as stored."
@@ -39486,6 +40134,34 @@
           }
         }
       },
+      "TssHolder": {
+        "type": "object",
+        "properties": {
+          "holder_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "runtime_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "public_key": {
+            "type": "string"
+          },
+          "registered_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "last_seen_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
       "PasskeySafe": {
         "type": "object",
         "properties": {