@1claw/openapi-spec 0.61.44 → 0.61.46

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.44",
+    "version": "0.61.46",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -28151,6 +28151,195 @@
         }
       }
     },
+    "/v1/marketing/unsubscribe": {
+      "get": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "Unsubscribe an address from offers and announcements",
+        "description": "Public and session-less by necessity: the link lives in an email, and an unsubscribe that asks the reader to log in first is one they abandon — they mark the next message as spam instead, which costs the sending domain far more. The `t` parameter is an HMAC over the address, which is what stops a stranger unsubscribing somebody else.\n\nOffers and announcements only. Transactional mail — sign-in codes, approval requests, invitations, reports the recipient asked for — does not consult this flag and is unaffected; turning it off must never lock someone out of their account.\n\nIdempotent, and the answer is the same whether or not the address has an account. \"Stop emailing me\" is always answered \"done\", and a 404 here would tell a caller holding a valid token which addresses are registered.\n",
+        "operationId": "marketing_unsubscribe",
+        "security": [],
+        "parameters": [
+          {
+            "name": "email",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "email"
+            }
+          },
+          {
+            "name": "t",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "HMAC over the address, from the link."
+          },
+          {
+            "name": "c",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Campaign the link came from. Recorded, not trusted."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Unsubscribed (or already was)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "unsubscribed",
+                    "email",
+                    "message"
+                  ],
+                  "properties": {
+                    "unsubscribed": {
+                      "type": "boolean"
+                    },
+                    "email": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "The link's signature did not verify"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Billing"
+        ],
+        "summary": "Unsubscribe (one-click)",
+        "description": "Identical to the GET. Present because `List-Unsubscribe-Post: List-Unsubscribe=One-Click` makes Gmail and Yahoo POST here without ever opening the page, and both require that header on bulk mail — an endpoint that only answered GET would look like a working unsubscribe to a person and a broken one to the providers scoring the domain.\n",
+        "operationId": "marketing_unsubscribe_post",
+        "security": [],
+        "parameters": [
+          {
+            "name": "email",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "email"
+            }
+          },
+          {
+            "name": "t",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "HMAC over the address, from the link."
+          },
+          {
+            "name": "c",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Campaign the link came from. Recorded, not trusted."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Unsubscribed (or already was)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "unsubscribed",
+                    "email",
+                    "message"
+                  ],
+                  "properties": {
+                    "unsubscribed": {
+                      "type": "boolean"
+                    },
+                    "email": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "The link's signature did not verify"
+          }
+        }
+      }
+    },
+    "/v1/connectors/suggest": {
+      "get": {
+        "tags": [
+          "Connectors"
+        ],
+        "summary": "Is there a connector for this credential?",
+        "description": "Asked before a secret is written, so the caller can offer to connect the service properly instead of filing a key that cannot do the job. A user stored an X bearer token, a consumer key and a consumer secret and asked their agent to post daily; none of the three can post, because X needs a user-context OAuth grant. Nothing said so until the agent failed.\n\nMatches on both a provider name and a credential word, so `api-keys/x-bearer-token` suggests the X connector and `notes/slack-migration-plan` suggests nothing — a hint that fires on every path is one people learn to scroll past.\n",
+        "operationId": "suggest_connector",
+        "parameters": [
+          {
+            "name": "path",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "The secret path about to be written."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The matching connector, or null.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "preset"
+                  ],
+                  "properties": {
+                    "preset": {
+                      "nullable": true,
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/ConnectorPreset"
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthenticated"
+          }
+        }
+      }
+    },
     "/v1/billing/promo/preview": {
       "get": {
         "tags": [

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.44"
+    version: "0.61.46"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -18000,6 +18000,110 @@ paths:
                     description: Forbidden, or the plan does not include this
                 '404':
                     description: Not found
+    /v1/marketing/unsubscribe:
+        get: &marketing_unsubscribe
+            tags: [Billing]
+            summary: "Unsubscribe an address from offers and announcements"
+            description: >
+                Public and session-less by necessity: the link lives in an
+                email, and an unsubscribe that asks the reader to log in
+                first is one they abandon — they mark the next message as
+                spam instead, which costs the sending domain far more.
+                The `t` parameter is an HMAC over the address, which is what
+                stops a stranger unsubscribing somebody else.
+
+
+                Offers and announcements only. Transactional mail — sign-in
+                codes, approval requests, invitations, reports the recipient
+                asked for — does not consult this flag and is unaffected;
+                turning it off must never lock someone out of their account.
+
+
+                Idempotent, and the answer is the same whether or not the
+                address has an account. "Stop emailing me" is always
+                answered "done", and a 404 here would tell a caller holding
+                a valid token which addresses are registered.
+            operationId: marketing_unsubscribe
+            security: []
+            parameters:
+                - name: email
+                  in: query
+                  required: true
+                  schema: { type: string, format: email }
+                - name: t
+                  in: query
+                  required: true
+                  schema: { type: string }
+                  description: HMAC over the address, from the link.
+                - name: c
+                  in: query
+                  required: false
+                  schema: { type: string }
+                  description: Campaign the link came from. Recorded, not trusted.
+            responses:
+                '200':
+                    description: Unsubscribed (or already was)
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                required: [unsubscribed, email, message]
+                                properties:
+                                    unsubscribed: { type: boolean }
+                                    email: { type: string }
+                                    message: { type: string }
+                '400':
+                    description: The link's signature did not verify
+        post:
+            <<: *marketing_unsubscribe
+            summary: "Unsubscribe (one-click)"
+            description: >
+                Identical to the GET. Present because
+                `List-Unsubscribe-Post: List-Unsubscribe=One-Click` makes
+                Gmail and Yahoo POST here without ever opening the page, and
+                both require that header on bulk mail — an endpoint that only
+                answered GET would look like a working unsubscribe to a
+                person and a broken one to the providers scoring the domain.
+            operationId: marketing_unsubscribe_post
+    /v1/connectors/suggest:
+        get:
+            tags: [Connectors]
+            summary: "Is there a connector for this credential?"
+            description: >
+                Asked before a secret is written, so the caller can offer to
+                connect the service properly instead of filing a key that
+                cannot do the job. A user stored an X bearer token, a consumer
+                key and a consumer secret and asked their agent to post daily;
+                none of the three can post, because X needs a user-context
+                OAuth grant. Nothing said so until the agent failed.
+
+
+                Matches on both a provider name and a credential word, so
+                `api-keys/x-bearer-token` suggests the X connector and
+                `notes/slack-migration-plan` suggests nothing — a hint that
+                fires on every path is one people learn to scroll past.
+            operationId: suggest_connector
+            parameters:
+                - name: path
+                  in: query
+                  required: true
+                  schema: { type: string }
+                  description: The secret path about to be written.
+            responses:
+                '200':
+                    description: The matching connector, or null.
+                    content:
+                        application/json:
+                            schema:
+                                type: object
+                                required: [preset]
+                                properties:
+                                    preset:
+                                        nullable: true
+                                        allOf:
+                                            - $ref: '#/components/schemas/ConnectorPreset'
+                '401':
+                    description: Unauthenticated
     /v1/billing/promo/preview:
         get:
             tags: [Billing]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.44",
+  "version": "0.61.46",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
   "license": "MIT",
   "repository": {