@1claw/openapi-spec 0.61.23 → 0.61.25

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.23",
+    "version": "0.61.25",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -9779,7 +9779,7 @@
           "Key Custody"
         ],
         "summary": "Create a Safe owned by your passkey",
-        "description": "An EVM Safe (v1.4.1) whose only owner is Safe's WebAuthn shared signer,\nconfigured with this passkey's P-256 public key. No private key exists\nanywhere: signing a transaction is a WebAuthn assertion whose challenge\nis the SafeTx hash. The address is counterfactual (CREATE2) until the\nfirst `execute` deploys it. Chains: base, optimism, arbitrum, polygon\n(RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.\n",
+        "description": "An EVM Safe (v1.4.1) whose only owner is Safe's WebAuthn shared signer,\nconfigured with this passkey's P-256 public key. No private key exists\nanywhere: signing a transaction is a WebAuthn assertion whose challenge\nis the SafeTx hash. The address is counterfactual (CREATE2) until the\nfirst `execute` deploys it. Chains: base, optimism, arbitrum, polygon\n(RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.\nThe passkey must have been registered on the domain making this\nrequest (its rpId): a credential from `1claw.xyz` cannot sign on\n`1claw.co`, so such a passkey is refused here (400) rather than\nproducing a Safe no browser here can sign for.\n",
         "operationId": "createPasskeySafe",
         "security": [
           {
@@ -9964,46 +9964,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "safe_id": {
-                      "type": "string",
-                      "format": "uuid"
-                    },
-                    "safe_address": {
-                      "type": "string"
-                    },
-                    "chain": {
-                      "type": "string"
-                    },
-                    "chain_id": {
-                      "type": "integer"
-                    },
-                    "to": {
-                      "type": "string"
-                    },
-                    "value_wei": {
-                      "type": "string"
-                    },
-                    "data": {
-                      "type": "string"
-                    },
-                    "nonce": {
-                      "type": "integer"
-                    },
-                    "deploy_required": {
-                      "type": "boolean"
-                    },
-                    "safe_tx_hash": {
-                      "type": "string"
-                    },
-                    "credential_id": {
-                      "type": "string"
-                    },
-                    "rp_id": {
-                      "type": "string"
-                    }
-                  }
+                  "$ref": "#/components/schemas/PasskeySafePrepare"
                 }
               }
             }
@@ -10074,6 +10035,16 @@
                   "nonce": {
                     "type": "integer"
                   },
+                  "operation": {
+                    "type": "integer",
+                    "default": 0,
+                    "description": "0 = call. 1 = delegatecall, accepted only with a `grant_id` whose\nprepared setup calldata this is, and only to the pinned\nMultiSendCallOnly — the API cannot delegatecall arbitrary code.\n"
+                  },
+                  "grant_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Pass back from a grant or revoke prepare; activates / revokes the grant on success."
+                  },
                   "authenticator_data": {
                     "type": "string",
                     "description": "Base64url."
@@ -10145,6 +10116,313 @@
         }
       }
     },
+    "/v1/treasury/passkey-safes/{id}/grants": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "get": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "List agent spending grants on a passkey Safe",
+        "operationId": "listPasskeySafeGrants",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Grants",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "grants": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/PasskeySafeGrant"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Prepare an agent spending grant (Allowance Module)",
+        "description": "Gives one agent's server-custody Ethereum signing key a bounded, on-chain\nallowance from this Safe through Safe's Allowance Module v1.0.0: one Safe\ntransaction (delegatecall into MultiSendCallOnly) that enables the module if\nneeded, adds the agent's key as a delegate and sets the allowance per reset\nperiod. Returns the grant (`pending`) and the SafeTx for the owner's passkey\nto sign; pass `operation` and `grant_id` from `prepare` to `execute`. The cap\nis enforced by the module on-chain — 1claw holding the delegate key gives it\nexactly the allowance and nothing more. Audited as `passkey_safe.grant_activated`.\n",
+        "operationId": "createPasskeySafeGrant",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "agent_id",
+                  "allowance_amount"
+                ],
+                "properties": {
+                  "agent_id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "token": {
+                    "type": "string",
+                    "description": "ERC-20 contract; omit for the native token."
+                  },
+                  "allowance_amount": {
+                    "type": "string",
+                    "description": "Base units",
+                    "decimal string": null,
+                    "≤ 2^96-1.": null
+                  },
+                  "reset_time_min": {
+                    "type": "integer",
+                    "default": 1440,
+                    "description": "Reset period in minutes."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Grant and what to sign",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeySafeGrantPrepare"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
+    "/v1/treasury/passkey-safes/{id}/grants/{grant_id}/revoke": {
+      "parameters": [
+        {
+          "name": "id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        },
+        {
+          "name": "grant_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Prepare a grant revocation",
+        "description": "Prepares `AllowanceModule.removeDelegate(delegate, true)` for the owner's\npasskey to sign; `execute` with `grant_id` relays it and marks the grant\n`revoked`. Audited as `passkey_safe.grant_revoked`.\n",
+        "operationId": "revokePasskeySafeGrant",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Grant and what to sign",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasskeySafeGrantPrepare"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
+    "/v1/agents/{agent_id}/passkey-safes/{safe_id}/spend": {
+      "parameters": [
+        {
+          "name": "agent_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        },
+        {
+          "name": "safe_id",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      ],
+      "post": {
+        "tags": [
+          "Key Custody"
+        ],
+        "summary": "Spend from a passkey-owned Safe under an active grant",
+        "description": "Agent credential only. Runs the agent's guardrails (chains, allowlists, caps,\ndaily limits, approval policy) and the sanctions screen, reads the module's\ncurrent allowance and nonce, signs the Allowance Module transfer hash with the\nagent's Ethereum signing key, and relays `executeAllowanceTransfer` from the\nSafe owner's Ethereum treasury wallet. Above the on-chain remaining allowance\nthe request is refused before any gas is spent; the module would refuse it\nanyway. Counts as one signature. Audited as `passkey_safe.allowance_spent`.\n",
+        "operationId": "spendFromPasskeySafeGrant",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "to",
+                  "amount"
+                ],
+                "properties": {
+                  "to": {
+                    "type": "string"
+                  },
+                  "amount": {
+                    "type": "string",
+                    "description": "Base units",
+                    "decimal string.": null
+                  },
+                  "token": {
+                    "type": "string",
+                    "description": "ERC-20 contract; omit for the native token."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Broadcast",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "grant_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "safe_address": {
+                      "type": "string"
+                    },
+                    "chain": {
+                      "type": "string"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "amount": {
+                      "type": "string"
+                    },
+                    "token_address": {
+                      "type": "string"
+                    },
+                    "remaining_after": {
+                      "type": "string",
+                      "description": "Allowance left in this period after this transfer."
+                    },
+                    "nonce": {
+                      "type": "integer",
+                      "description": "The module's delegate nonce used."
+                    },
+                    "tx_hash": {
+                      "type": "string"
+                    },
+                    "status": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "402": {
+            "$ref": "#/components/responses/PaymentRequired"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          }
+        }
+      }
+    },
     "/v1/treasury/wallets/generate": {
       "post": {
         "tags": [
@@ -15669,8 +15947,8 @@
         "tags": [
           "Approvals"
         ],
-        "summary": "List pending approvals",
-        "description": "Returns approvals for the authenticated user's organization.\nHuman-only. Supports filtering by status and pagination.\n",
+        "summary": "List approvals",
+        "description": "Humans get their own approval queue. An agent caller gets only the\napprovals it created (`agent_id` = caller) — enough to recover one whose\nid was lost across a restart, never the organization's queue. Supports\nfiltering by status and pagination.\n",
         "operationId": "listApprovals",
         "parameters": [
           {
@@ -15683,7 +15961,8 @@
                 "pending",
                 "approved",
                 "rejected",
-                "expired"
+                "expired",
+                "cancelled"
               ]
             },
             "description": "Filter by approval status"
@@ -15768,6 +16047,61 @@
         }
       }
     },
+    "/v1/approvals/{approval_id}/cancel": {
+      "post": {
+        "tags": [
+          "Approvals"
+        ],
+        "summary": "Cancel a pending approval (requester)",
+        "description": "Withdraws a pending approval. Callable by the agent that requested it or\nthe human it was addressed to. First answer wins: if the approval was\nalready decided or expired, the existing record is returned unchanged\n(200) rather than an error — the caller's next question is what the\nanswer was. A cancellation is delivered to webhook subscribers as\n`approval.decided` with `decision: \"cancelled\"`, and audited as\n`approval.cancelled`.\n",
+        "operationId": "cancelApproval",
+        "parameters": [
+          {
+            "name": "approval_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "reason": {
+                    "type": "string",
+                    "maxLength": 500
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The approval — `cancelled`, or the decision that landed first",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApprovalResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/approvals/{approval_id}/status": {
       "get": {
         "tags": [
@@ -39110,7 +39444,8 @@
               "pending",
               "approved",
               "rejected",
-              "expired"
+              "expired",
+              "cancelled"
             ]
           },
           "summary": {
@@ -39176,7 +39511,8 @@
               "pending",
               "approved",
               "rejected",
-              "expired"
+              "expired",
+              "cancelled"
             ]
           },
           "expires_at": {
@@ -40186,6 +40522,16 @@
             "type": "string",
             "format": "uuid"
           },
+          "passkey_name": {
+            "type": "string",
+            "nullable": true,
+            "description": "The owning passkey's name — only that credential can sign for the Safe."
+          },
+          "passkey_rp_id": {
+            "type": "string",
+            "nullable": true,
+            "description": "The domain the owning passkey was registered under (WebAuthn rpId); a browser on another domain cannot use it."
+          },
           "custody": {
             "type": "string",
             "enum": [
@@ -40213,6 +40559,137 @@
           }
         }
       },
+      "PasskeySafePrepare": {
+        "type": "object",
+        "properties": {
+          "safe_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "safe_address": {
+            "type": "string"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "chain_id": {
+            "type": "integer"
+          },
+          "to": {
+            "type": "string"
+          },
+          "value_wei": {
+            "type": "string"
+          },
+          "data": {
+            "type": "string"
+          },
+          "nonce": {
+            "type": "integer"
+          },
+          "operation": {
+            "type": "integer",
+            "description": "Pass back to `execute` unchanged."
+          },
+          "grant_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Present for grant setup / revoke; pass back to `execute`."
+          },
+          "deploy_required": {
+            "type": "boolean"
+          },
+          "safe_tx_hash": {
+            "type": "string",
+            "description": "Hex SafeTx hash — the WebAuthn challenge (raw 32 bytes)."
+          },
+          "credential_id": {
+            "type": "string"
+          },
+          "transports": {
+            "type": "array",
+            "nullable": true,
+            "items": {
+              "type": "string"
+            },
+            "description": "The passkey's registered transports (`internal`, `hybrid`, `usb`…) — pass as the `allowCredentials` hint so the browser asks the right authenticator."
+          },
+          "passkey_name": {
+            "type": "string",
+            "nullable": true
+          },
+          "rp_id": {
+            "type": "string"
+          }
+        }
+      },
+      "PasskeySafeGrant": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "safe_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "agent_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "chain": {
+            "type": "string"
+          },
+          "delegate_address": {
+            "type": "string",
+            "description": "The agent's Ethereum signing key at grant time."
+          },
+          "token_address": {
+            "type": "string",
+            "description": "0x000…0 for the native token."
+          },
+          "allowance_amount": {
+            "type": "string",
+            "description": "Base units per reset period."
+          },
+          "reset_time_min": {
+            "type": "integer"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "pending",
+              "active",
+              "revoking",
+              "revoked"
+            ]
+          },
+          "setup_tx_hash": {
+            "type": "string",
+            "nullable": true
+          },
+          "revoke_tx_hash": {
+            "type": "string",
+            "nullable": true
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "PasskeySafeGrantPrepare": {
+        "type": "object",
+        "properties": {
+          "grant": {
+            "$ref": "#/components/schemas/PasskeySafeGrant"
+          },
+          "prepare": {
+            "$ref": "#/components/schemas/PasskeySafePrepare"
+          }
+        }
+      },
       "ClientShareListResponse": {
         "type": "object",
         "properties": {
@@ -41892,6 +42369,19 @@
             "type": "number",
             "nullable": true
           },
+          "has_paid_addon": {
+            "type": "boolean",
+            "description": "Whether this runtime has a paid Stripe add-on (unlimited hours)."
+          },
+          "billing_kind": {
+            "type": "string",
+            "enum": [
+              "pool",
+              "included",
+              "addon"
+            ],
+            "description": "`pool` — counts against the plan's monthly runtime hours. `included` — the plan's\nfree runtime (every plan from Pro up includes one small or medium runtime, no hour\ncap, no charge). `addon` — paid Stripe subscription item (no hour cap).\n"
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -41913,6 +42403,27 @@
             "items": {
               "$ref": "#/components/schemas/RuntimeResponse"
             }
+          },
+          "included_runtime": {
+            "type": "object",
+            "description": "The plan's included-runtime allowance (human callers only).",
+            "properties": {
+              "allowance": {
+                "type": "integer",
+                "description": "Runtimes the plan includes at no charge."
+              },
+              "used": {
+                "type": "integer",
+                "description": "Included slots currently in use."
+              },
+              "presets": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Presets an included runtime may use (up to 1 vCPU / 2 GB)."
+              }
+            }
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.23"
+    version: "0.61.25"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -6239,6 +6239,10 @@ paths:
                 is the SafeTx hash. The address is counterfactual (CREATE2) until the
                 first `execute` deploys it. Chains: base, optimism, arbitrum, polygon
                 (RIP-7212 precompile + fallback verifier), ethereum, sepolia, base-sepolia.
+                The passkey must have been registered on the domain making this
+                request (its rpId): a credential from `1claw.xyz` cannot sign on
+                `1claw.co`, so such a passkey is refused here (400) rather than
+                producing a Safe no browser here can sign for.
             operationId: createPasskeySafe
             security:
                 - BearerAuth: []
@@ -6343,20 +6347,7 @@ paths:
                     content:
                         application/json:
                             schema:
-                                type: object
-                                properties:
-                                    safe_id: { type: string, format: uuid }
-                                    safe_address: { type: string }
-                                    chain: { type: string }
-                                    chain_id: { type: integer }
-                                    to: { type: string }
-                                    value_wei: { type: string }
-                                    data: { type: string }
-                                    nonce: { type: integer }
-                                    deploy_required: { type: boolean }
-                                    safe_tx_hash: { type: string }
-                                    credential_id: { type: string }
-                                    rp_id: { type: string }
+                                $ref: "#/components/schemas/PasskeySafePrepare"
                 "400":
                     $ref: "#/components/responses/BadRequest"
                 "401":
@@ -6396,6 +6387,17 @@ paths:
                                 value_wei: { type: string }
                                 data: { type: string }
                                 nonce: { type: integer }
+                                operation:
+                                    type: integer
+                                    default: 0
+                                    description: |
+                                        0 = call. 1 = delegatecall, accepted only with a `grant_id` whose
+                                        prepared setup calldata this is, and only to the pinned
+                                        MultiSendCallOnly — the API cannot delegatecall arbitrary code.
+                                grant_id:
+                                    type: string
+                                    format: uuid
+                                    description: Pass back from a grant or revoke prepare; activates / revokes the grant on success.
                                 authenticator_data: { type: string, description: Base64url. }
                                 client_data_json: { type: string, description: Base64url. }
                                 signature: { type: string, description: Base64url DER ECDSA signature. }
@@ -6425,6 +6427,177 @@ paths:
                 "409":
                     $ref: "#/components/responses/Conflict"
 
+    /v1/treasury/passkey-safes/{id}/grants:
+        parameters:
+            - name: id
+              in: path
+              required: true
+              schema: { type: string, format: uuid }
+        get:
+            tags: [Key Custody]
+            summary: List agent spending grants on a passkey Safe
+            operationId: listPasskeySafeGrants
+            security:
+                - BearerAuth: []
+            responses:
+                "200":
+                    description: Grants
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    grants:
+                                        type: array
+                                        items:
+                                            $ref: "#/components/schemas/PasskeySafeGrant"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+        post:
+            tags: [Key Custody]
+            summary: Prepare an agent spending grant (Allowance Module)
+            description: |
+                Gives one agent's server-custody Ethereum signing key a bounded, on-chain
+                allowance from this Safe through Safe's Allowance Module v1.0.0: one Safe
+                transaction (delegatecall into MultiSendCallOnly) that enables the module if
+                needed, adds the agent's key as a delegate and sets the allowance per reset
+                period. Returns the grant (`pending`) and the SafeTx for the owner's passkey
+                to sign; pass `operation` and `grant_id` from `prepare` to `execute`. The cap
+                is enforced by the module on-chain — 1claw holding the delegate key gives it
+                exactly the allowance and nothing more. Audited as `passkey_safe.grant_activated`.
+            operationId: createPasskeySafeGrant
+            security:
+                - BearerAuth: []
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [agent_id, allowance_amount]
+                            properties:
+                                agent_id: { type: string, format: uuid }
+                                token: { type: string, description: ERC-20 contract; omit for the native token. }
+                                allowance_amount: { type: string, description: Base units, decimal string, ≤ 2^96-1. }
+                                reset_time_min: { type: integer, default: 1440, description: Reset period in minutes. }
+            responses:
+                "200":
+                    description: Grant and what to sign
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PasskeySafeGrantPrepare"
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    $ref: "#/components/responses/Conflict"
+
+    /v1/treasury/passkey-safes/{id}/grants/{grant_id}/revoke:
+        parameters:
+            - name: id
+              in: path
+              required: true
+              schema: { type: string, format: uuid }
+            - name: grant_id
+              in: path
+              required: true
+              schema: { type: string, format: uuid }
+        post:
+            tags: [Key Custody]
+            summary: Prepare a grant revocation
+            description: |
+                Prepares `AllowanceModule.removeDelegate(delegate, true)` for the owner's
+                passkey to sign; `execute` with `grant_id` relays it and marks the grant
+                `revoked`. Audited as `passkey_safe.grant_revoked`.
+            operationId: revokePasskeySafeGrant
+            security:
+                - BearerAuth: []
+            responses:
+                "200":
+                    description: Grant and what to sign
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/PasskeySafeGrantPrepare"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    $ref: "#/components/responses/Conflict"
+
+    /v1/agents/{agent_id}/passkey-safes/{safe_id}/spend:
+        parameters:
+            - name: agent_id
+              in: path
+              required: true
+              schema: { type: string, format: uuid }
+            - name: safe_id
+              in: path
+              required: true
+              schema: { type: string, format: uuid }
+        post:
+            tags: [Key Custody]
+            summary: Spend from a passkey-owned Safe under an active grant
+            description: |
+                Agent credential only. Runs the agent's guardrails (chains, allowlists, caps,
+                daily limits, approval policy) and the sanctions screen, reads the module's
+                current allowance and nonce, signs the Allowance Module transfer hash with the
+                agent's Ethereum signing key, and relays `executeAllowanceTransfer` from the
+                Safe owner's Ethereum treasury wallet. Above the on-chain remaining allowance
+                the request is refused before any gas is spent; the module would refuse it
+                anyway. Counts as one signature. Audited as `passkey_safe.allowance_spent`.
+            operationId: spendFromPasskeySafeGrant
+            security:
+                - BearerAuth: []
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            required: [to, amount]
+                            properties:
+                                to: { type: string }
+                                amount: { type: string, description: Base units, decimal string. }
+                                token: { type: string, description: ERC-20 contract; omit for the native token. }
+            responses:
+                "200":
+                    description: Broadcast
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                properties:
+                                    grant_id: { type: string, format: uuid }
+                                    safe_address: { type: string }
+                                    chain: { type: string }
+                                    to: { type: string }
+                                    amount: { type: string }
+                                    token_address: { type: string }
+                                    remaining_after: { type: string, description: Allowance left in this period after this transfer. }
+                                    nonce: { type: integer, description: The module's delegate nonce used. }
+                                    tx_hash: { type: string }
+                                    status: { type: string }
+                "400":
+                    $ref: "#/components/responses/BadRequest"
+                "401":
+                    $ref: "#/components/responses/Unauthorized"
+                "402":
+                    $ref: "#/components/responses/PaymentRequired"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+                "409":
+                    $ref: "#/components/responses/Conflict"
+
     /v1/treasury/wallets/generate:
         post:
             tags: [Treasury Wallets]
@@ -10011,10 +10184,12 @@ paths:
     /v1/approvals:
         get:
             tags: [Approvals]
-            summary: List pending approvals
+            summary: List approvals
             description: |
-                Returns approvals for the authenticated user's organization.
-                Human-only. Supports filtering by status and pagination.
+                Humans get their own approval queue. An agent caller gets only the
+                approvals it created (`agent_id` = caller) — enough to recover one whose
+                id was lost across a restart, never the organization's queue. Supports
+                filtering by status and pagination.
             operationId: listApprovals
             parameters:
                 - name: status
@@ -10022,7 +10197,7 @@ paths:
                   required: false
                   schema:
                       type: string
-                      enum: [pending, approved, rejected, expired]
+                      enum: [pending, approved, rejected, expired, cancelled]
                   description: Filter by approval status
                 - name: limit
                   in: query
@@ -10073,6 +10248,46 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/approvals/{approval_id}/cancel:
+        post:
+            tags: [Approvals]
+            summary: Cancel a pending approval (requester)
+            description: |
+                Withdraws a pending approval. Callable by the agent that requested it or
+                the human it was addressed to. First answer wins: if the approval was
+                already decided or expired, the existing record is returned unchanged
+                (200) rather than an error — the caller's next question is what the
+                answer was. A cancellation is delivered to webhook subscribers as
+                `approval.decided` with `decision: "cancelled"`, and audited as
+                `approval.cancelled`.
+            operationId: cancelApproval
+            parameters:
+                - name: approval_id
+                  in: path
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: false
+                content:
+                    application/json:
+                        schema:
+                            type: object
+                            properties:
+                                reason: { type: string, maxLength: 500 }
+            responses:
+                "200":
+                    description: The approval — `cancelled`, or the decision that landed first
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/ApprovalResponse"
+                "403":
+                    $ref: "#/components/responses/Forbidden"
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/approvals/{approval_id}/status:
         get:
             tags: [Approvals]
@@ -25359,7 +25574,7 @@ components:
                     description: "What the action will do, as submitted."
                 status:
                     type: string
-                    enum: [pending, approved, rejected, expired]
+                    enum: [pending, approved, rejected, expired, cancelled]
                 summary:
                     type: object
                     description: Structured summary of the action requiring approval
@@ -25402,7 +25617,7 @@ components:
             properties:
                 status:
                     type: string
-                    enum: [pending, approved, rejected, expired]
+                    enum: [pending, approved, rejected, expired, cancelled]
                 expires_at:
                     type: string
                     format: date-time
@@ -26074,12 +26289,62 @@ components:
                 chain_id: { type: integer }
                 safe_address: { type: string }
                 passkey_id: { type: string, format: uuid }
+                passkey_name: { type: string, nullable: true, description: The owning passkey's name — only that credential can sign for the Safe. }
+                passkey_rp_id: { type: string, nullable: true, description: The domain the owning passkey was registered under (WebAuthn rpId); a browser on another domain cannot use it. }
                 custody: { type: string, enum: [passkey_owner] }
                 deploy_status: { type: string, enum: [pending, deployed] }
                 deploy_tx_hash: { type: string, nullable: true }
                 owner_signer: { type: string, description: The SafeWebAuthnSharedSigner address listed as the Safe's owner. }
                 created_at: { type: string, format: date-time }
 
+        PasskeySafePrepare:
+            type: object
+            properties:
+                safe_id: { type: string, format: uuid }
+                safe_address: { type: string }
+                chain: { type: string }
+                chain_id: { type: integer }
+                to: { type: string }
+                value_wei: { type: string }
+                data: { type: string }
+                nonce: { type: integer }
+                operation: { type: integer, description: Pass back to `execute` unchanged. }
+                grant_id: { type: string, format: uuid, description: Present for grant setup / revoke; pass back to `execute`. }
+                deploy_required: { type: boolean }
+                safe_tx_hash: { type: string, description: Hex SafeTx hash — the WebAuthn challenge (raw 32 bytes). }
+                credential_id: { type: string }
+                transports:
+                    type: array
+                    nullable: true
+                    items: { type: string }
+                    description: The passkey's registered transports (`internal`, `hybrid`, `usb`…) — pass as the `allowCredentials` hint so the browser asks the right authenticator.
+                passkey_name: { type: string, nullable: true }
+                rp_id: { type: string }
+
+        PasskeySafeGrant:
+            type: object
+            properties:
+                id: { type: string, format: uuid }
+                safe_id: { type: string, format: uuid }
+                agent_id: { type: string, format: uuid }
+                chain: { type: string }
+                delegate_address: { type: string, description: The agent's Ethereum signing key at grant time. }
+                token_address: { type: string, description: 0x000…0 for the native token. }
+                allowance_amount: { type: string, description: Base units per reset period. }
+                reset_time_min: { type: integer }
+                status: { type: string, enum: [pending, active, revoking, revoked] }
+                setup_tx_hash: { type: string, nullable: true }
+                revoke_tx_hash: { type: string, nullable: true }
+                created_at: { type: string, format: date-time }
+
+        PasskeySafeGrantPrepare:
+            type: object
+            properties:
+                grant:
+                    $ref: "#/components/schemas/PasskeySafeGrant"
+                prepare:
+                    $ref: "#/components/schemas/PasskeySafePrepare"
+
         ClientShareListResponse:
             type: object
             properties:
@@ -27150,6 +27415,16 @@ components:
                 monthly_hours_used:
                     type: number
                     nullable: true
+                has_paid_addon:
+                    type: boolean
+                    description: Whether this runtime has a paid Stripe add-on (unlimited hours).
+                billing_kind:
+                    type: string
+                    enum: [pool, included, addon]
+                    description: |
+                        `pool` — counts against the plan's monthly runtime hours. `included` — the plan's
+                        free runtime (every plan from Pro up includes one small or medium runtime, no hour
+                        cap, no charge). `addon` — paid Stripe subscription item (no hour cap).
                 created_at:
                     type: string
                     format: date-time
@@ -27165,6 +27440,16 @@ components:
                     type: array
                     items:
                         $ref: "#/components/schemas/RuntimeResponse"
+                included_runtime:
+                    type: object
+                    description: The plan's included-runtime allowance (human callers only).
+                    properties:
+                        allowance: { type: integer, description: Runtimes the plan includes at no charge. }
+                        used: { type: integer, description: Included slots currently in use. }
+                        presets:
+                            type: array
+                            items: { type: string }
+                            description: Presets an included runtime may use (up to 1 vCPU / 2 GB).
 
         SlugCheckResponse:
             type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.23",
+  "version": "0.61.25",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {