@1claw/openapi-spec 0.61.36 → 0.61.39
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +426 -1
- package/openapi.yaml +297 -1
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.39",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -6610,6 +6610,46 @@
|
|
|
6610
6610
|
}
|
|
6611
6611
|
}
|
|
6612
6612
|
},
|
|
6613
|
+
"/v1/org/overview": {
|
|
6614
|
+
"get": {
|
|
6615
|
+
"tags": [
|
|
6616
|
+
"Organization"
|
|
6617
|
+
],
|
|
6618
|
+
"summary": "System overview",
|
|
6619
|
+
"operationId": "getOrgOverview",
|
|
6620
|
+
"description": "The whole org in one call: inventory (vaults, secrets, agents, runtimes,\nautomations, bindings, policies, wallets, apps, members), activity in the last\n`hours` (secret reads/writes, denials, executions, transactions, Shroud\nrequests/blocked/redacted/injections, automation runs, approvals, consensus,\nrisk events, API requests), spend (inference, executions, automations, credit\nbalance), health (expiring secrets, stale/suspended/unpoliced agents, failing\nautomations, errored runtimes, overdue approvals) and a 7-day trend. Human and\nplatform callers only. Backs the dashboard's Overview tab.\n",
|
|
6621
|
+
"parameters": [
|
|
6622
|
+
{
|
|
6623
|
+
"name": "hours",
|
|
6624
|
+
"in": "query",
|
|
6625
|
+
"schema": {
|
|
6626
|
+
"type": "integer",
|
|
6627
|
+
"minimum": 1,
|
|
6628
|
+
"maximum": 168,
|
|
6629
|
+
"default": 24
|
|
6630
|
+
}
|
|
6631
|
+
}
|
|
6632
|
+
],
|
|
6633
|
+
"responses": {
|
|
6634
|
+
"200": {
|
|
6635
|
+
"description": "Overview",
|
|
6636
|
+
"content": {
|
|
6637
|
+
"application/json": {
|
|
6638
|
+
"schema": {
|
|
6639
|
+
"$ref": "#/components/schemas/OrgOverview"
|
|
6640
|
+
}
|
|
6641
|
+
}
|
|
6642
|
+
}
|
|
6643
|
+
},
|
|
6644
|
+
"401": {
|
|
6645
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
6646
|
+
},
|
|
6647
|
+
"403": {
|
|
6648
|
+
"$ref": "#/components/responses/Forbidden"
|
|
6649
|
+
}
|
|
6650
|
+
}
|
|
6651
|
+
}
|
|
6652
|
+
},
|
|
6613
6653
|
"/v1/org/members": {
|
|
6614
6654
|
"get": {
|
|
6615
6655
|
"tags": [
|
|
@@ -29613,6 +29653,254 @@
|
|
|
29613
29653
|
}
|
|
29614
29654
|
}
|
|
29615
29655
|
},
|
|
29656
|
+
"/v1/runtimes/provision": {
|
|
29657
|
+
"post": {
|
|
29658
|
+
"tags": [
|
|
29659
|
+
"Runtimes"
|
|
29660
|
+
],
|
|
29661
|
+
"summary": "Provision an agent and its runtime in one call",
|
|
29662
|
+
"operationId": "provisionRuntime",
|
|
29663
|
+
"description": "Creates (or reuses) the agent, its keys and default-vault grant, the runtime, and\nstarts it. Each step runs the same code as the individual endpoints, so the\n`agent.create` consensus gate, plan caps, image allowlist and included-slot logic\napply exactly as one click at a time. Human-only. The new agent's API key is\nreturned once.\n",
|
|
29664
|
+
"requestBody": {
|
|
29665
|
+
"required": true,
|
|
29666
|
+
"content": {
|
|
29667
|
+
"application/json": {
|
|
29668
|
+
"schema": {
|
|
29669
|
+
"type": "object",
|
|
29670
|
+
"required": [
|
|
29671
|
+
"name",
|
|
29672
|
+
"agent"
|
|
29673
|
+
],
|
|
29674
|
+
"properties": {
|
|
29675
|
+
"name": {
|
|
29676
|
+
"type": "string"
|
|
29677
|
+
},
|
|
29678
|
+
"template": {
|
|
29679
|
+
"type": "string"
|
|
29680
|
+
},
|
|
29681
|
+
"preset": {
|
|
29682
|
+
"type": "string",
|
|
29683
|
+
"default": "small"
|
|
29684
|
+
},
|
|
29685
|
+
"agent": {
|
|
29686
|
+
"type": "object",
|
|
29687
|
+
"description": "Either `id` (existing) or `name` (create).",
|
|
29688
|
+
"properties": {
|
|
29689
|
+
"id": {
|
|
29690
|
+
"type": "string",
|
|
29691
|
+
"format": "uuid"
|
|
29692
|
+
},
|
|
29693
|
+
"name": {
|
|
29694
|
+
"type": "string"
|
|
29695
|
+
},
|
|
29696
|
+
"description": {
|
|
29697
|
+
"type": "string"
|
|
29698
|
+
}
|
|
29699
|
+
}
|
|
29700
|
+
},
|
|
29701
|
+
"env_public": {
|
|
29702
|
+
"type": "object",
|
|
29703
|
+
"additionalProperties": {
|
|
29704
|
+
"type": "string"
|
|
29705
|
+
}
|
|
29706
|
+
},
|
|
29707
|
+
"expose_http": {
|
|
29708
|
+
"type": "boolean"
|
|
29709
|
+
},
|
|
29710
|
+
"source_repo": {
|
|
29711
|
+
"type": "string"
|
|
29712
|
+
},
|
|
29713
|
+
"startup_command": {
|
|
29714
|
+
"type": "string"
|
|
29715
|
+
},
|
|
29716
|
+
"environment": {
|
|
29717
|
+
"type": "string"
|
|
29718
|
+
},
|
|
29719
|
+
"start": {
|
|
29720
|
+
"type": "boolean",
|
|
29721
|
+
"default": true
|
|
29722
|
+
},
|
|
29723
|
+
"approval_id": {
|
|
29724
|
+
"type": "string",
|
|
29725
|
+
"format": "uuid"
|
|
29726
|
+
}
|
|
29727
|
+
}
|
|
29728
|
+
}
|
|
29729
|
+
}
|
|
29730
|
+
}
|
|
29731
|
+
},
|
|
29732
|
+
"responses": {
|
|
29733
|
+
"201": {
|
|
29734
|
+
"description": "Provisioned",
|
|
29735
|
+
"content": {
|
|
29736
|
+
"application/json": {
|
|
29737
|
+
"schema": {
|
|
29738
|
+
"type": "object",
|
|
29739
|
+
"required": [
|
|
29740
|
+
"runtime",
|
|
29741
|
+
"agent_id",
|
|
29742
|
+
"started"
|
|
29743
|
+
],
|
|
29744
|
+
"properties": {
|
|
29745
|
+
"runtime": {
|
|
29746
|
+
"$ref": "#/components/schemas/RuntimeResponse"
|
|
29747
|
+
},
|
|
29748
|
+
"agent_id": {
|
|
29749
|
+
"type": "string",
|
|
29750
|
+
"format": "uuid"
|
|
29751
|
+
},
|
|
29752
|
+
"agent_api_key": {
|
|
29753
|
+
"type": "string",
|
|
29754
|
+
"description": "Only when the agent was created here; shown once."
|
|
29755
|
+
},
|
|
29756
|
+
"vault_id": {
|
|
29757
|
+
"type": "string",
|
|
29758
|
+
"format": "uuid"
|
|
29759
|
+
},
|
|
29760
|
+
"started": {
|
|
29761
|
+
"type": "boolean"
|
|
29762
|
+
}
|
|
29763
|
+
}
|
|
29764
|
+
}
|
|
29765
|
+
}
|
|
29766
|
+
}
|
|
29767
|
+
},
|
|
29768
|
+
"400": {
|
|
29769
|
+
"$ref": "#/components/responses/BadRequest"
|
|
29770
|
+
},
|
|
29771
|
+
"401": {
|
|
29772
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
29773
|
+
},
|
|
29774
|
+
"403": {
|
|
29775
|
+
"$ref": "#/components/responses/Forbidden"
|
|
29776
|
+
}
|
|
29777
|
+
}
|
|
29778
|
+
}
|
|
29779
|
+
},
|
|
29780
|
+
"/v1/runtimes/{runtime_id}/env/resolved": {
|
|
29781
|
+
"get": {
|
|
29782
|
+
"tags": [
|
|
29783
|
+
"Runtimes"
|
|
29784
|
+
],
|
|
29785
|
+
"summary": "The environment the container is started with",
|
|
29786
|
+
"operationId": "getRuntimeResolvedEnv",
|
|
29787
|
+
"description": "Every variable, its source (`platform`, `env_public`, `vault_env`, `agent`,\n`secret`) and which wins on a name collision. Vault-derived values and the minted\nagent token are named, never shown. Human-only; nothing is minted.\n",
|
|
29788
|
+
"parameters": [
|
|
29789
|
+
{
|
|
29790
|
+
"name": "runtime_id",
|
|
29791
|
+
"in": "path",
|
|
29792
|
+
"required": true,
|
|
29793
|
+
"schema": {
|
|
29794
|
+
"type": "string",
|
|
29795
|
+
"format": "uuid"
|
|
29796
|
+
}
|
|
29797
|
+
}
|
|
29798
|
+
],
|
|
29799
|
+
"responses": {
|
|
29800
|
+
"200": {
|
|
29801
|
+
"description": "Resolved environment",
|
|
29802
|
+
"content": {
|
|
29803
|
+
"application/json": {
|
|
29804
|
+
"schema": {
|
|
29805
|
+
"type": "object",
|
|
29806
|
+
"properties": {
|
|
29807
|
+
"runtime_id": {
|
|
29808
|
+
"type": "string",
|
|
29809
|
+
"format": "uuid"
|
|
29810
|
+
},
|
|
29811
|
+
"environment": {
|
|
29812
|
+
"type": "string"
|
|
29813
|
+
},
|
|
29814
|
+
"restart_required_for_changes": {
|
|
29815
|
+
"type": "boolean"
|
|
29816
|
+
},
|
|
29817
|
+
"entries": {
|
|
29818
|
+
"type": "array",
|
|
29819
|
+
"items": {
|
|
29820
|
+
"type": "object",
|
|
29821
|
+
"properties": {
|
|
29822
|
+
"key": {
|
|
29823
|
+
"type": "string"
|
|
29824
|
+
},
|
|
29825
|
+
"source": {
|
|
29826
|
+
"type": "string",
|
|
29827
|
+
"enum": [
|
|
29828
|
+
"platform",
|
|
29829
|
+
"env_public",
|
|
29830
|
+
"vault_env",
|
|
29831
|
+
"agent",
|
|
29832
|
+
"secret"
|
|
29833
|
+
]
|
|
29834
|
+
},
|
|
29835
|
+
"value": {
|
|
29836
|
+
"type": "string"
|
|
29837
|
+
},
|
|
29838
|
+
"masked": {
|
|
29839
|
+
"type": "boolean"
|
|
29840
|
+
},
|
|
29841
|
+
"overrides": {
|
|
29842
|
+
"type": "string",
|
|
29843
|
+
"nullable": true
|
|
29844
|
+
}
|
|
29845
|
+
}
|
|
29846
|
+
}
|
|
29847
|
+
}
|
|
29848
|
+
}
|
|
29849
|
+
}
|
|
29850
|
+
}
|
|
29851
|
+
}
|
|
29852
|
+
},
|
|
29853
|
+
"401": {
|
|
29854
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
29855
|
+
},
|
|
29856
|
+
"404": {
|
|
29857
|
+
"$ref": "#/components/responses/NotFound"
|
|
29858
|
+
}
|
|
29859
|
+
}
|
|
29860
|
+
}
|
|
29861
|
+
},
|
|
29862
|
+
"/v1/runtimes/{runtime_id}/rollback": {
|
|
29863
|
+
"post": {
|
|
29864
|
+
"tags": [
|
|
29865
|
+
"Runtimes"
|
|
29866
|
+
],
|
|
29867
|
+
"summary": "Roll back to the previous image and restart",
|
|
29868
|
+
"operationId": "rollbackRuntime",
|
|
29869
|
+
"description": "Starts the runtime again on `previous_image_digest` (recorded at each start whose\nresolved image differed). The image must still pass the allowlist. 409 when no\nprevious image is recorded.\n",
|
|
29870
|
+
"parameters": [
|
|
29871
|
+
{
|
|
29872
|
+
"name": "runtime_id",
|
|
29873
|
+
"in": "path",
|
|
29874
|
+
"required": true,
|
|
29875
|
+
"schema": {
|
|
29876
|
+
"type": "string",
|
|
29877
|
+
"format": "uuid"
|
|
29878
|
+
}
|
|
29879
|
+
}
|
|
29880
|
+
],
|
|
29881
|
+
"responses": {
|
|
29882
|
+
"200": {
|
|
29883
|
+
"description": "Restarting on the previous image",
|
|
29884
|
+
"content": {
|
|
29885
|
+
"application/json": {
|
|
29886
|
+
"schema": {
|
|
29887
|
+
"$ref": "#/components/schemas/RuntimeResponse"
|
|
29888
|
+
}
|
|
29889
|
+
}
|
|
29890
|
+
}
|
|
29891
|
+
},
|
|
29892
|
+
"401": {
|
|
29893
|
+
"$ref": "#/components/responses/Unauthorized"
|
|
29894
|
+
},
|
|
29895
|
+
"404": {
|
|
29896
|
+
"$ref": "#/components/responses/NotFound"
|
|
29897
|
+
},
|
|
29898
|
+
"409": {
|
|
29899
|
+
"$ref": "#/components/responses/Conflict"
|
|
29900
|
+
}
|
|
29901
|
+
}
|
|
29902
|
+
}
|
|
29903
|
+
},
|
|
29616
29904
|
"/v1/runtimes/{runtime_id}/rebuild": {
|
|
29617
29905
|
"parameters": [
|
|
29618
29906
|
{
|
|
@@ -43353,6 +43641,101 @@
|
|
|
43353
43641
|
}
|
|
43354
43642
|
}
|
|
43355
43643
|
},
|
|
43644
|
+
"OrgOverview": {
|
|
43645
|
+
"type": "object",
|
|
43646
|
+
"required": [
|
|
43647
|
+
"generated_at",
|
|
43648
|
+
"window_hours",
|
|
43649
|
+
"inventory",
|
|
43650
|
+
"activity",
|
|
43651
|
+
"spend",
|
|
43652
|
+
"health",
|
|
43653
|
+
"trend"
|
|
43654
|
+
],
|
|
43655
|
+
"properties": {
|
|
43656
|
+
"generated_at": {
|
|
43657
|
+
"type": "string",
|
|
43658
|
+
"format": "date-time"
|
|
43659
|
+
},
|
|
43660
|
+
"window_hours": {
|
|
43661
|
+
"type": "integer"
|
|
43662
|
+
},
|
|
43663
|
+
"inventory": {
|
|
43664
|
+
"type": "object",
|
|
43665
|
+
"additionalProperties": {
|
|
43666
|
+
"type": "integer"
|
|
43667
|
+
},
|
|
43668
|
+
"description": "vaults, secrets, agents_total, agents_active, child_agents, runtimes_total, runtimes_running, automations_total, automations_active, bindings, policies, treasury_wallets, signing_keys, platform_apps, connected_apps, team_members"
|
|
43669
|
+
},
|
|
43670
|
+
"activity": {
|
|
43671
|
+
"type": "object",
|
|
43672
|
+
"additionalProperties": {
|
|
43673
|
+
"type": "integer"
|
|
43674
|
+
},
|
|
43675
|
+
"description": "audit_events, secret_reads, secret_writes, policy_denials, executions, execution_failures, transactions, transactions_failed, shroud_requests, shroud_blocked, shroud_redacted, shroud_injections, automation_runs, automation_runs_failed, automation_runs_parked, approvals_pending, approvals_decided, consensus_pending, risk_events, threats_open, api_requests"
|
|
43676
|
+
},
|
|
43677
|
+
"spend": {
|
|
43678
|
+
"type": "object",
|
|
43679
|
+
"properties": {
|
|
43680
|
+
"inference_usd": {
|
|
43681
|
+
"type": "number"
|
|
43682
|
+
},
|
|
43683
|
+
"inference_tokens": {
|
|
43684
|
+
"type": "integer"
|
|
43685
|
+
},
|
|
43686
|
+
"execution_cost_cents": {
|
|
43687
|
+
"type": "integer"
|
|
43688
|
+
},
|
|
43689
|
+
"automation_cost_cents": {
|
|
43690
|
+
"type": "integer"
|
|
43691
|
+
},
|
|
43692
|
+
"credit_balance_micro_usd": {
|
|
43693
|
+
"type": "integer"
|
|
43694
|
+
},
|
|
43695
|
+
"billing_tier": {
|
|
43696
|
+
"type": "string"
|
|
43697
|
+
}
|
|
43698
|
+
}
|
|
43699
|
+
},
|
|
43700
|
+
"health": {
|
|
43701
|
+
"type": "object",
|
|
43702
|
+
"additionalProperties": {
|
|
43703
|
+
"type": "integer"
|
|
43704
|
+
},
|
|
43705
|
+
"description": "secrets_expiring_7d, stale_agents, agents_without_policy, automations_failing, runtimes_errored, approvals_overdue, agents_suspended"
|
|
43706
|
+
},
|
|
43707
|
+
"trend": {
|
|
43708
|
+
"type": "array",
|
|
43709
|
+
"items": {
|
|
43710
|
+
"type": "object",
|
|
43711
|
+
"properties": {
|
|
43712
|
+
"day": {
|
|
43713
|
+
"type": "string",
|
|
43714
|
+
"format": "date"
|
|
43715
|
+
},
|
|
43716
|
+
"audit_events": {
|
|
43717
|
+
"type": "integer"
|
|
43718
|
+
},
|
|
43719
|
+
"denials": {
|
|
43720
|
+
"type": "integer"
|
|
43721
|
+
},
|
|
43722
|
+
"shroud_requests": {
|
|
43723
|
+
"type": "integer"
|
|
43724
|
+
},
|
|
43725
|
+
"shroud_blocked": {
|
|
43726
|
+
"type": "integer"
|
|
43727
|
+
},
|
|
43728
|
+
"automation_runs": {
|
|
43729
|
+
"type": "integer"
|
|
43730
|
+
},
|
|
43731
|
+
"transactions": {
|
|
43732
|
+
"type": "integer"
|
|
43733
|
+
}
|
|
43734
|
+
}
|
|
43735
|
+
}
|
|
43736
|
+
}
|
|
43737
|
+
}
|
|
43738
|
+
},
|
|
43356
43739
|
"DryRunRequest": {
|
|
43357
43740
|
"type": "object",
|
|
43358
43741
|
"properties": {
|
|
@@ -43987,6 +44370,24 @@
|
|
|
43987
44370
|
"UpdateRuntimeRequest": {
|
|
43988
44371
|
"type": "object",
|
|
43989
44372
|
"properties": {
|
|
44373
|
+
"schedule": {
|
|
44374
|
+
"nullable": true,
|
|
44375
|
+
"description": "Scheduled start/stop: start the container when `start_cron` fires (IANA\n`timezone`, default UTC) and stop it `stop_after_secs` later (60–86400; null\nleaves it to the idle reconciler). `null` clears the schedule.\n",
|
|
44376
|
+
"type": "object",
|
|
44377
|
+
"properties": {
|
|
44378
|
+
"start_cron": {
|
|
44379
|
+
"type": "string"
|
|
44380
|
+
},
|
|
44381
|
+
"timezone": {
|
|
44382
|
+
"type": "string",
|
|
44383
|
+
"default": "UTC"
|
|
44384
|
+
},
|
|
44385
|
+
"stop_after_secs": {
|
|
44386
|
+
"type": "integer",
|
|
44387
|
+
"nullable": true
|
|
44388
|
+
}
|
|
44389
|
+
}
|
|
44390
|
+
},
|
|
43990
44391
|
"name": {
|
|
43991
44392
|
"type": "string"
|
|
43992
44393
|
},
|
|
@@ -44051,6 +44452,30 @@
|
|
|
44051
44452
|
"updated_at"
|
|
44052
44453
|
],
|
|
44053
44454
|
"properties": {
|
|
44455
|
+
"previous_image_digest": {
|
|
44456
|
+
"type": "string",
|
|
44457
|
+
"nullable": true
|
|
44458
|
+
},
|
|
44459
|
+
"image_digest": {
|
|
44460
|
+
"type": "string",
|
|
44461
|
+
"nullable": true,
|
|
44462
|
+
"description": "Resolved image (digest form when the provider reports one); runtime-minted agent tokens carry it as `runtime_image`, which access policies can require via `conditions.runtime_image_in`."
|
|
44463
|
+
},
|
|
44464
|
+
"schedule": {
|
|
44465
|
+
"type": "object",
|
|
44466
|
+
"nullable": true,
|
|
44467
|
+
"additionalProperties": true
|
|
44468
|
+
},
|
|
44469
|
+
"next_scheduled_start_at": {
|
|
44470
|
+
"type": "string",
|
|
44471
|
+
"format": "date-time",
|
|
44472
|
+
"nullable": true
|
|
44473
|
+
},
|
|
44474
|
+
"scheduled_stop_at": {
|
|
44475
|
+
"type": "string",
|
|
44476
|
+
"format": "date-time",
|
|
44477
|
+
"nullable": true
|
|
44478
|
+
},
|
|
44054
44479
|
"id": {
|
|
44055
44480
|
"type": "string",
|
|
44056
44481
|
"format": "uuid"
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.39"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -4282,6 +4282,40 @@ paths:
|
|
|
4282
4282
|
# Organization
|
|
4283
4283
|
# ---------------------------------------------------------------------------
|
|
4284
4284
|
|
|
4285
|
+
/v1/org/overview:
|
|
4286
|
+
get:
|
|
4287
|
+
tags: [Organization]
|
|
4288
|
+
summary: System overview
|
|
4289
|
+
operationId: getOrgOverview
|
|
4290
|
+
description: |
|
|
4291
|
+
The whole org in one call: inventory (vaults, secrets, agents, runtimes,
|
|
4292
|
+
automations, bindings, policies, wallets, apps, members), activity in the last
|
|
4293
|
+
`hours` (secret reads/writes, denials, executions, transactions, Shroud
|
|
4294
|
+
requests/blocked/redacted/injections, automation runs, approvals, consensus,
|
|
4295
|
+
risk events, API requests), spend (inference, executions, automations, credit
|
|
4296
|
+
balance), health (expiring secrets, stale/suspended/unpoliced agents, failing
|
|
4297
|
+
automations, errored runtimes, overdue approvals) and a 7-day trend. Human and
|
|
4298
|
+
platform callers only. Backs the dashboard's Overview tab.
|
|
4299
|
+
parameters:
|
|
4300
|
+
- name: hours
|
|
4301
|
+
in: query
|
|
4302
|
+
schema:
|
|
4303
|
+
type: integer
|
|
4304
|
+
minimum: 1
|
|
4305
|
+
maximum: 168
|
|
4306
|
+
default: 24
|
|
4307
|
+
responses:
|
|
4308
|
+
"200":
|
|
4309
|
+
description: Overview
|
|
4310
|
+
content:
|
|
4311
|
+
application/json:
|
|
4312
|
+
schema:
|
|
4313
|
+
$ref: "#/components/schemas/OrgOverview"
|
|
4314
|
+
"401":
|
|
4315
|
+
$ref: "#/components/responses/Unauthorized"
|
|
4316
|
+
"403":
|
|
4317
|
+
$ref: "#/components/responses/Forbidden"
|
|
4318
|
+
|
|
4285
4319
|
/v1/org/members:
|
|
4286
4320
|
get:
|
|
4287
4321
|
tags: [Organization]
|
|
@@ -18951,6 +18985,173 @@ paths:
|
|
|
18951
18985
|
description: Forbidden, or the plan does not include this
|
|
18952
18986
|
'404':
|
|
18953
18987
|
description: Not found
|
|
18988
|
+
/v1/runtimes/provision:
|
|
18989
|
+
post:
|
|
18990
|
+
tags: [Runtimes]
|
|
18991
|
+
summary: Provision an agent and its runtime in one call
|
|
18992
|
+
operationId: provisionRuntime
|
|
18993
|
+
description: |
|
|
18994
|
+
Creates (or reuses) the agent, its keys and default-vault grant, the runtime, and
|
|
18995
|
+
starts it. Each step runs the same code as the individual endpoints, so the
|
|
18996
|
+
`agent.create` consensus gate, plan caps, image allowlist and included-slot logic
|
|
18997
|
+
apply exactly as one click at a time. Human-only. The new agent's API key is
|
|
18998
|
+
returned once.
|
|
18999
|
+
requestBody:
|
|
19000
|
+
required: true
|
|
19001
|
+
content:
|
|
19002
|
+
application/json:
|
|
19003
|
+
schema:
|
|
19004
|
+
type: object
|
|
19005
|
+
required: [name, agent]
|
|
19006
|
+
properties:
|
|
19007
|
+
name:
|
|
19008
|
+
type: string
|
|
19009
|
+
template:
|
|
19010
|
+
type: string
|
|
19011
|
+
preset:
|
|
19012
|
+
type: string
|
|
19013
|
+
default: small
|
|
19014
|
+
agent:
|
|
19015
|
+
type: object
|
|
19016
|
+
description: Either `id` (existing) or `name` (create).
|
|
19017
|
+
properties:
|
|
19018
|
+
id:
|
|
19019
|
+
type: string
|
|
19020
|
+
format: uuid
|
|
19021
|
+
name:
|
|
19022
|
+
type: string
|
|
19023
|
+
description:
|
|
19024
|
+
type: string
|
|
19025
|
+
env_public:
|
|
19026
|
+
type: object
|
|
19027
|
+
additionalProperties:
|
|
19028
|
+
type: string
|
|
19029
|
+
expose_http:
|
|
19030
|
+
type: boolean
|
|
19031
|
+
source_repo:
|
|
19032
|
+
type: string
|
|
19033
|
+
startup_command:
|
|
19034
|
+
type: string
|
|
19035
|
+
environment:
|
|
19036
|
+
type: string
|
|
19037
|
+
start:
|
|
19038
|
+
type: boolean
|
|
19039
|
+
default: true
|
|
19040
|
+
approval_id:
|
|
19041
|
+
type: string
|
|
19042
|
+
format: uuid
|
|
19043
|
+
responses:
|
|
19044
|
+
"201":
|
|
19045
|
+
description: Provisioned
|
|
19046
|
+
content:
|
|
19047
|
+
application/json:
|
|
19048
|
+
schema:
|
|
19049
|
+
type: object
|
|
19050
|
+
required: [runtime, agent_id, started]
|
|
19051
|
+
properties:
|
|
19052
|
+
runtime:
|
|
19053
|
+
$ref: "#/components/schemas/RuntimeResponse"
|
|
19054
|
+
agent_id:
|
|
19055
|
+
type: string
|
|
19056
|
+
format: uuid
|
|
19057
|
+
agent_api_key:
|
|
19058
|
+
type: string
|
|
19059
|
+
description: Only when the agent was created here; shown once.
|
|
19060
|
+
vault_id:
|
|
19061
|
+
type: string
|
|
19062
|
+
format: uuid
|
|
19063
|
+
started:
|
|
19064
|
+
type: boolean
|
|
19065
|
+
"400":
|
|
19066
|
+
$ref: "#/components/responses/BadRequest"
|
|
19067
|
+
"401":
|
|
19068
|
+
$ref: "#/components/responses/Unauthorized"
|
|
19069
|
+
"403":
|
|
19070
|
+
$ref: "#/components/responses/Forbidden"
|
|
19071
|
+
|
|
19072
|
+
/v1/runtimes/{runtime_id}/env/resolved:
|
|
19073
|
+
get:
|
|
19074
|
+
tags: [Runtimes]
|
|
19075
|
+
summary: The environment the container is started with
|
|
19076
|
+
operationId: getRuntimeResolvedEnv
|
|
19077
|
+
description: |
|
|
19078
|
+
Every variable, its source (`platform`, `env_public`, `vault_env`, `agent`,
|
|
19079
|
+
`secret`) and which wins on a name collision. Vault-derived values and the minted
|
|
19080
|
+
agent token are named, never shown. Human-only; nothing is minted.
|
|
19081
|
+
parameters:
|
|
19082
|
+
- name: runtime_id
|
|
19083
|
+
in: path
|
|
19084
|
+
required: true
|
|
19085
|
+
schema:
|
|
19086
|
+
type: string
|
|
19087
|
+
format: uuid
|
|
19088
|
+
responses:
|
|
19089
|
+
"200":
|
|
19090
|
+
description: Resolved environment
|
|
19091
|
+
content:
|
|
19092
|
+
application/json:
|
|
19093
|
+
schema:
|
|
19094
|
+
type: object
|
|
19095
|
+
properties:
|
|
19096
|
+
runtime_id:
|
|
19097
|
+
type: string
|
|
19098
|
+
format: uuid
|
|
19099
|
+
environment:
|
|
19100
|
+
type: string
|
|
19101
|
+
restart_required_for_changes:
|
|
19102
|
+
type: boolean
|
|
19103
|
+
entries:
|
|
19104
|
+
type: array
|
|
19105
|
+
items:
|
|
19106
|
+
type: object
|
|
19107
|
+
properties:
|
|
19108
|
+
key:
|
|
19109
|
+
type: string
|
|
19110
|
+
source:
|
|
19111
|
+
type: string
|
|
19112
|
+
enum: [platform, env_public, vault_env, agent, secret]
|
|
19113
|
+
value:
|
|
19114
|
+
type: string
|
|
19115
|
+
masked:
|
|
19116
|
+
type: boolean
|
|
19117
|
+
overrides:
|
|
19118
|
+
type: string
|
|
19119
|
+
nullable: true
|
|
19120
|
+
"401":
|
|
19121
|
+
$ref: "#/components/responses/Unauthorized"
|
|
19122
|
+
"404":
|
|
19123
|
+
$ref: "#/components/responses/NotFound"
|
|
19124
|
+
|
|
19125
|
+
/v1/runtimes/{runtime_id}/rollback:
|
|
19126
|
+
post:
|
|
19127
|
+
tags: [Runtimes]
|
|
19128
|
+
summary: Roll back to the previous image and restart
|
|
19129
|
+
operationId: rollbackRuntime
|
|
19130
|
+
description: |
|
|
19131
|
+
Starts the runtime again on `previous_image_digest` (recorded at each start whose
|
|
19132
|
+
resolved image differed). The image must still pass the allowlist. 409 when no
|
|
19133
|
+
previous image is recorded.
|
|
19134
|
+
parameters:
|
|
19135
|
+
- name: runtime_id
|
|
19136
|
+
in: path
|
|
19137
|
+
required: true
|
|
19138
|
+
schema:
|
|
19139
|
+
type: string
|
|
19140
|
+
format: uuid
|
|
19141
|
+
responses:
|
|
19142
|
+
"200":
|
|
19143
|
+
description: Restarting on the previous image
|
|
19144
|
+
content:
|
|
19145
|
+
application/json:
|
|
19146
|
+
schema:
|
|
19147
|
+
$ref: "#/components/schemas/RuntimeResponse"
|
|
19148
|
+
"401":
|
|
19149
|
+
$ref: "#/components/responses/Unauthorized"
|
|
19150
|
+
"404":
|
|
19151
|
+
$ref: "#/components/responses/NotFound"
|
|
19152
|
+
"409":
|
|
19153
|
+
$ref: "#/components/responses/Conflict"
|
|
19154
|
+
|
|
18954
19155
|
/v1/runtimes/{runtime_id}/rebuild:
|
|
18955
19156
|
parameters:
|
|
18956
19157
|
- name: runtime_id
|
|
@@ -28061,6 +28262,66 @@ components:
|
|
|
28061
28262
|
format: uuid
|
|
28062
28263
|
description: Control-plane approval when rolling back to a wider spec.
|
|
28063
28264
|
|
|
28265
|
+
OrgOverview:
|
|
28266
|
+
type: object
|
|
28267
|
+
required: [generated_at, window_hours, inventory, activity, spend, health, trend]
|
|
28268
|
+
properties:
|
|
28269
|
+
generated_at:
|
|
28270
|
+
type: string
|
|
28271
|
+
format: date-time
|
|
28272
|
+
window_hours:
|
|
28273
|
+
type: integer
|
|
28274
|
+
inventory:
|
|
28275
|
+
type: object
|
|
28276
|
+
additionalProperties:
|
|
28277
|
+
type: integer
|
|
28278
|
+
description: vaults, secrets, agents_total, agents_active, child_agents, runtimes_total, runtimes_running, automations_total, automations_active, bindings, policies, treasury_wallets, signing_keys, platform_apps, connected_apps, team_members
|
|
28279
|
+
activity:
|
|
28280
|
+
type: object
|
|
28281
|
+
additionalProperties:
|
|
28282
|
+
type: integer
|
|
28283
|
+
description: audit_events, secret_reads, secret_writes, policy_denials, executions, execution_failures, transactions, transactions_failed, shroud_requests, shroud_blocked, shroud_redacted, shroud_injections, automation_runs, automation_runs_failed, automation_runs_parked, approvals_pending, approvals_decided, consensus_pending, risk_events, threats_open, api_requests
|
|
28284
|
+
spend:
|
|
28285
|
+
type: object
|
|
28286
|
+
properties:
|
|
28287
|
+
inference_usd:
|
|
28288
|
+
type: number
|
|
28289
|
+
inference_tokens:
|
|
28290
|
+
type: integer
|
|
28291
|
+
execution_cost_cents:
|
|
28292
|
+
type: integer
|
|
28293
|
+
automation_cost_cents:
|
|
28294
|
+
type: integer
|
|
28295
|
+
credit_balance_micro_usd:
|
|
28296
|
+
type: integer
|
|
28297
|
+
billing_tier:
|
|
28298
|
+
type: string
|
|
28299
|
+
health:
|
|
28300
|
+
type: object
|
|
28301
|
+
additionalProperties:
|
|
28302
|
+
type: integer
|
|
28303
|
+
description: secrets_expiring_7d, stale_agents, agents_without_policy, automations_failing, runtimes_errored, approvals_overdue, agents_suspended
|
|
28304
|
+
trend:
|
|
28305
|
+
type: array
|
|
28306
|
+
items:
|
|
28307
|
+
type: object
|
|
28308
|
+
properties:
|
|
28309
|
+
day:
|
|
28310
|
+
type: string
|
|
28311
|
+
format: date
|
|
28312
|
+
audit_events:
|
|
28313
|
+
type: integer
|
|
28314
|
+
denials:
|
|
28315
|
+
type: integer
|
|
28316
|
+
shroud_requests:
|
|
28317
|
+
type: integer
|
|
28318
|
+
shroud_blocked:
|
|
28319
|
+
type: integer
|
|
28320
|
+
automation_runs:
|
|
28321
|
+
type: integer
|
|
28322
|
+
transactions:
|
|
28323
|
+
type: integer
|
|
28324
|
+
|
|
28064
28325
|
DryRunRequest:
|
|
28065
28326
|
type: object
|
|
28066
28327
|
properties:
|
|
@@ -28475,6 +28736,22 @@ components:
|
|
|
28475
28736
|
UpdateRuntimeRequest:
|
|
28476
28737
|
type: object
|
|
28477
28738
|
properties:
|
|
28739
|
+
schedule:
|
|
28740
|
+
nullable: true
|
|
28741
|
+
description: |
|
|
28742
|
+
Scheduled start/stop: start the container when `start_cron` fires (IANA
|
|
28743
|
+
`timezone`, default UTC) and stop it `stop_after_secs` later (60–86400; null
|
|
28744
|
+
leaves it to the idle reconciler). `null` clears the schedule.
|
|
28745
|
+
type: object
|
|
28746
|
+
properties:
|
|
28747
|
+
start_cron:
|
|
28748
|
+
type: string
|
|
28749
|
+
timezone:
|
|
28750
|
+
type: string
|
|
28751
|
+
default: UTC
|
|
28752
|
+
stop_after_secs:
|
|
28753
|
+
type: integer
|
|
28754
|
+
nullable: true
|
|
28478
28755
|
name:
|
|
28479
28756
|
type: string
|
|
28480
28757
|
template:
|
|
@@ -28512,6 +28789,25 @@ components:
|
|
|
28512
28789
|
type: object
|
|
28513
28790
|
required: [id, name, agent_id, status, created_at, updated_at]
|
|
28514
28791
|
properties:
|
|
28792
|
+
previous_image_digest:
|
|
28793
|
+
type: string
|
|
28794
|
+
nullable: true
|
|
28795
|
+
image_digest:
|
|
28796
|
+
type: string
|
|
28797
|
+
nullable: true
|
|
28798
|
+
description: Resolved image (digest form when the provider reports one); runtime-minted agent tokens carry it as `runtime_image`, which access policies can require via `conditions.runtime_image_in`.
|
|
28799
|
+
schedule:
|
|
28800
|
+
type: object
|
|
28801
|
+
nullable: true
|
|
28802
|
+
additionalProperties: true
|
|
28803
|
+
next_scheduled_start_at:
|
|
28804
|
+
type: string
|
|
28805
|
+
format: date-time
|
|
28806
|
+
nullable: true
|
|
28807
|
+
scheduled_stop_at:
|
|
28808
|
+
type: string
|
|
28809
|
+
format: date-time
|
|
28810
|
+
nullable: true
|
|
28515
28811
|
id:
|
|
28516
28812
|
type: string
|
|
28517
28813
|
format: uuid
|