@1claw/openapi-spec 0.61.55 → 0.61.57

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.55",
+    "version": "0.61.57",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -15875,6 +15875,63 @@
         }
       }
     },
+    "/v1/platform/connections/{connectionId}/agents": {
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Add agents to a bootstrapped connection",
+        "description": "Provision additional agents on a connection that has already been\nbootstrapped, from a template belonging to the same app. `plt_` auth only.\n\nBootstrap refuses a second run (409) because it also creates the vault,\nthe policies and the plan tier, none of which should happen twice. This\nroute applies only the agent portion of a template: its `agents`, their\nper-agent `signing_keys`, `eoa` and `runtime`. `vault`, `policies`,\n`automations` and `entitlements` in the spec are ignored, and new agents\nattach to the vault the connection already has.\n\nConfiguration comes from a template rather than from fields on the\nrequest so that the agent portion of a spec has exactly one reader,\nshared with bootstrap.\n\nCapped per connection by `max_agents_per_connection` on the platform app\n(unset means a built-in default, not unlimited: an agent with signing\nkeys costs a KMS key per chain). The whole batch is checked before\nanything is created, so a template that would overshoot is refused\nrather than partly applied.\n",
+        "operationId": "addConnectionAgents",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "connectionId",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AddConnectionAgentsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Agents provisioned",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AddConnectionAgentsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Connection not bootstrapped yet, or the template provisions no agents"
+          },
+          "403": {
+            "description": "Past the per-connection agent cap"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        }
+      }
+    },
     "/v1/platform/connections/{connectionId}/agents/{agentId}": {
       "patch": {
         "tags": [
@@ -37750,6 +37807,92 @@
           }
         }
       },
+      "AddConnectionAgentsRequest": {
+        "type": "object",
+        "required": [
+          "template_id"
+        ],
+        "properties": {
+          "template_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "A template belonging to the same platform app. Only its `agents`\nand their per-agent `signing_keys`, `eoa` and `runtime` are\napplied.\n"
+          },
+          "params": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "Substituted into the spec as `{{params.*}}`, same as at bootstrap.\nUse it to name the agent after the account it signs for.\n"
+          }
+        }
+      },
+      "AddConnectionAgentsResponse": {
+        "type": "object",
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "agent_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "agent_api_key": {
+            "type": "string",
+            "description": "Returned once, at creation, and never retrievable again."
+          },
+          "agent_evm_address": {
+            "type": "string"
+          },
+          "signing_keys": {
+            "type": "array",
+            "description": "Provisioned signing key details, same shape as the bootstrap summary.",
+            "items": {
+              "type": "object",
+              "properties": {
+                "chain": {
+                  "type": "string"
+                },
+                "curve": {
+                  "type": "string"
+                },
+                "public_key": {
+                  "type": "string"
+                },
+                "address": {
+                  "type": "string"
+                },
+                "agent_id": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "format": "uuid"
+                }
+              }
+            }
+          },
+          "runtime_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          "agent_count": {
+            "type": "integer",
+            "format": "int64",
+            "description": "Agents on this connection after the call."
+          },
+          "max_agents_per_connection": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The ceiling the call was checked against."
+          }
+        }
+      },
       "PatchConnectionAgentRequest": {
         "type": "object",
         "description": "At least one field is required.\n",
@@ -37764,6 +37907,10 @@
             "type": "boolean",
             "description": "Agent memory, off by default. Until this field existed a\nplatform app had no way to turn it on: a bootstrap template\naccepted `memory_enabled` in its spec and never read it, so\nthe capability was reachable only from the end user's own\ndashboard. Templates now honour the flag too.\n"
           },
+          "raw_signing_enabled": {
+            "type": "boolean",
+            "description": "Raw/blind digest signing (`sign_digest`, `eip712_digest`),\noff by default. The same gap as `memory_enabled` above, one\ncapability later: a template accepted `raw_signing_enabled`\nand never read it, and this route had no field for it, so a\nplatform app that provisioned an agent for raw signing had\nno way to switch it on. Reported from production.\n\nThis route is the only one that reaches an already\nbootstrapped agent — it lives in the end user's own org, so\nthe platform app's own `PATCH /v1/agents/{agent_id}` returns\n403, and the fleet bulk-patch refuses capability flags by\ndesign. Enabling it is audited as\n`platform.connection.agent_patch` with\n`raw_signing_changed`.\n"
+          },
           "system_prompt": {
             "type": [
               "string",
@@ -37788,6 +37935,9 @@
           "memory_enabled": {
             "type": "boolean"
           },
+          "raw_signing_enabled": {
+            "type": "boolean"
+          },
           "system_prompt": {
             "type": [
               "string",

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.55"
+    version: "0.61.57"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -10093,6 +10093,60 @@ paths:
                 "404":
                     $ref: "#/components/responses/NotFound"
 
+    /v1/platform/connections/{connectionId}/agents:
+        post:
+            tags: [Platform]
+            summary: Add agents to a bootstrapped connection
+            description: |
+                Provision additional agents on a connection that has already been
+                bootstrapped, from a template belonging to the same app. `plt_` auth only.
+
+                Bootstrap refuses a second run (409) because it also creates the vault,
+                the policies and the plan tier, none of which should happen twice. This
+                route applies only the agent portion of a template: its `agents`, their
+                per-agent `signing_keys`, `eoa` and `runtime`. `vault`, `policies`,
+                `automations` and `entitlements` in the spec are ignored, and new agents
+                attach to the vault the connection already has.
+
+                Configuration comes from a template rather than from fields on the
+                request so that the agent portion of a spec has exactly one reader,
+                shared with bootstrap.
+
+                Capped per connection by `max_agents_per_connection` on the platform app
+                (unset means a built-in default, not unlimited: an agent with signing
+                keys costs a KMS key per chain). The whole batch is checked before
+                anything is created, so a template that would overshoot is refused
+                rather than partly applied.
+            operationId: addConnectionAgents
+            security:
+                - BearerAuth: []
+            parameters:
+                - in: path
+                  name: connectionId
+                  required: true
+                  schema:
+                      type: string
+                      format: uuid
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: "#/components/schemas/AddConnectionAgentsRequest"
+            responses:
+                "201":
+                    description: Agents provisioned
+                    content:
+                        application/json:
+                            schema:
+                                $ref: "#/components/schemas/AddConnectionAgentsResponse"
+                "400":
+                    description: Connection not bootstrapped yet, or the template provisions no agents
+                "403":
+                    description: Past the per-connection agent cap
+                "404":
+                    $ref: "#/components/responses/NotFound"
+
     /v1/platform/connections/{connectionId}/agents/{agentId}:
         patch:
             tags: [Platform]
@@ -24353,6 +24407,71 @@ components:
                 curve:
                     type: string
 
+        AddConnectionAgentsRequest:
+            type: object
+            required: [template_id]
+            properties:
+                template_id:
+                    type: string
+                    format: uuid
+                    description: |
+                        A template belonging to the same platform app. Only its `agents`
+                        and their per-agent `signing_keys`, `eoa` and `runtime` are
+                        applied.
+                params:
+                    type: object
+                    additionalProperties: true
+                    description: |
+                        Substituted into the spec as `{{params.*}}`, same as at bootstrap.
+                        Use it to name the agent after the account it signs for.
+
+        AddConnectionAgentsResponse:
+            type: object
+            properties:
+                connection_id:
+                    type: string
+                    format: uuid
+                agent_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                agent_api_key:
+                    type: string
+                    description: Returned once, at creation, and never retrievable again.
+                agent_evm_address:
+                    type: string
+                signing_keys:
+                    type: array
+                    description: Provisioned signing key details, same shape as the bootstrap summary.
+                    items:
+                        type: object
+                        properties:
+                            chain:
+                                type: string
+                            curve:
+                                type: string
+                            public_key:
+                                type: string
+                            address:
+                                type: string
+                            agent_id:
+                                type: [string, "null"]
+                                format: uuid
+                runtime_ids:
+                    type: array
+                    items:
+                        type: string
+                        format: uuid
+                agent_count:
+                    type: integer
+                    format: int64
+                    description: Agents on this connection after the call.
+                max_agents_per_connection:
+                    type: integer
+                    format: int64
+                    description: The ceiling the call was checked against.
+
         PatchConnectionAgentRequest:
             type: object
             description: |
@@ -24370,6 +24489,23 @@ components:
                         accepted `memory_enabled` in its spec and never read it, so
                         the capability was reachable only from the end user's own
                         dashboard. Templates now honour the flag too.
+                raw_signing_enabled:
+                    type: boolean
+                    description: |
+                        Raw/blind digest signing (`sign_digest`, `eip712_digest`),
+                        off by default. The same gap as `memory_enabled` above, one
+                        capability later: a template accepted `raw_signing_enabled`
+                        and never read it, and this route had no field for it, so a
+                        platform app that provisioned an agent for raw signing had
+                        no way to switch it on. Reported from production.
+
+                        This route is the only one that reaches an already
+                        bootstrapped agent — it lives in the end user's own org, so
+                        the platform app's own `PATCH /v1/agents/{agent_id}` returns
+                        403, and the fleet bulk-patch refuses capability flags by
+                        design. Enabling it is audited as
+                        `platform.connection.agent_patch` with
+                        `raw_signing_changed`.
                 system_prompt:
                     type: [string, "null"]
 
@@ -24385,6 +24521,8 @@ components:
                     type: boolean
                 memory_enabled:
                     type: boolean
+                raw_signing_enabled:
+                    type: boolean
                 system_prompt:
                     type: [string, "null"]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.55",
+  "version": "0.61.57",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {