@1claw/openapi-spec 0.61.58 → 0.61.60

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.58",
+    "version": "0.61.60",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -15881,7 +15881,7 @@
           "Platform"
         ],
         "summary": "Add agents to a bootstrapped connection",
-        "description": "Provision additional agents on a connection that has already been\nbootstrapped, from a template belonging to the same app. `plt_` auth only.\n\nBootstrap refuses a second run (409) because it also creates the vault,\nthe policies and the plan tier, none of which should happen twice. This\nroute applies only the agent portion of a template: its `agents`, their\nper-agent `signing_keys`, `eoa` and `runtime`. `vault`, `policies`,\n`automations` and `entitlements` in the spec are ignored, and new agents\nattach to the vault the connection already has.\n\nConfiguration comes from a template rather than from fields on the\nrequest so that the agent portion of a spec has exactly one reader,\nshared with bootstrap.\n\nCapped per connection by `max_agents_per_connection` on the platform app\n(unset means a built-in default, not unlimited: an agent with signing\nkeys costs a KMS key per chain). The whole batch is checked before\nanything is created, so a template that would overshoot is refused\nrather than partly applied.\n",
+        "description": "Provision an additional agent on a connection that has already been\nbootstrapped, from a template belonging to the same app. `plt_` auth only.\n\nOne agent per call. A template declaring more than one agent is refused\nwith 400: each agent's API key is returned once and cannot be re-issued\nto a platform app, so batching them would put several unrecoverable\ncredentials in a single response.\n\nBootstrap refuses a second run (409) because it also creates the vault,\nthe policies and the plan tier, none of which should happen twice. This\nroute applies only the agent portion of a template: its `agents`, their\nper-agent `signing_keys`, `eoa` and `runtime`. `vault`, `policies`,\n`automations` and `entitlements` in the spec are ignored, and new agents\nattach to the vault the connection already has.\n\nConfiguration comes from a template rather than from fields on the\nrequest so that the agent portion of a spec has exactly one reader,\nshared with bootstrap.\n\nCapped per connection by `max_agents_per_connection` on the platform app\n(unset means a built-in default, not unlimited: an agent with signing\nkeys costs a KMS key per chain). The whole batch is checked before\nanything is created, so a template that would overshoot is refused\nrather than partly applied.\n",
         "operationId": "addConnectionAgents",
         "security": [
           {
@@ -37841,7 +37841,24 @@
           },
           "agent_api_key": {
             "type": "string",
-            "description": "Returned once, at creation, and never retrievable again."
+            "description": "The first agent's key, kept so existing clients keep parsing.\nPrefer `agent_api_keys`.\n"
+          },
+          "agent_api_keys": {
+            "type": "array",
+            "maxItems": 1,
+            "description": "The created agent and its one-time API key. Exactly one entry:\nprovisioning is one agent per call, because a key is returned\nonce and cannot be re-issued to a platform app, so a response\ncarrying several would put several unrecoverable credentials in\none payload. A template declaring more than one agent is\nrefused with 400. The singular `agent_api_key` is the same key.\n",
+            "items": {
+              "type": "object",
+              "properties": {
+                "agent_id": {
+                  "type": "string",
+                  "format": "uuid"
+                },
+                "api_key": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "agent_evm_address": {
             "type": "string"
@@ -42309,7 +42326,24 @@
                   "string",
                   "null"
                 ],
-                "description": "One-time agent API key (ocv_ prefix). Store securely — not retrievable later."
+                "description": "First agent's one-time API key (ocv_ prefix). Kept for\ncompatibility; prefer `agent_api_keys`, which covers every\nagent the template created.\n"
+              },
+              "agent_api_keys": {
+                "type": "array",
+                "maxItems": 1,
+                "description": "The created agent and its one-time API key. Exactly one entry:\na template declaring more than one agent is refused with 400,\nbecause a key is returned once and cannot be re-issued to a\nplatform app. Split such a template and bootstrap once per agent.\n",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "agent_id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "api_key": {
+                      "type": "string"
+                    }
+                  }
+                }
               },
               "agent_evm_address": {
                 "type": [

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.58"
+    version: "0.61.60"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -10098,9 +10098,14 @@ paths:
             tags: [Platform]
             summary: Add agents to a bootstrapped connection
             description: |
-                Provision additional agents on a connection that has already been
+                Provision an additional agent on a connection that has already been
                 bootstrapped, from a template belonging to the same app. `plt_` auth only.
 
+                One agent per call. A template declaring more than one agent is refused
+                with 400: each agent's API key is returned once and cannot be re-issued
+                to a platform app, so batching them would put several unrecoverable
+                credentials in a single response.
+
                 Bootstrap refuses a second run (409) because it also creates the vault,
                 the policies and the plan tier, none of which should happen twice. This
                 route applies only the agent portion of a template: its `agents`, their
@@ -24438,7 +24443,27 @@ components:
                         format: uuid
                 agent_api_key:
                     type: string
-                    description: Returned once, at creation, and never retrievable again.
+                    description: |
+                        The first agent's key, kept so existing clients keep parsing.
+                        Prefer `agent_api_keys`.
+                agent_api_keys:
+                    type: array
+                    maxItems: 1
+                    description: |
+                        The created agent and its one-time API key. Exactly one entry:
+                        provisioning is one agent per call, because a key is returned
+                        once and cannot be re-issued to a platform app, so a response
+                        carrying several would put several unrecoverable credentials in
+                        one payload. A template declaring more than one agent is
+                        refused with 400. The singular `agent_api_key` is the same key.
+                    items:
+                        type: object
+                        properties:
+                            agent_id:
+                                type: string
+                                format: uuid
+                            api_key:
+                                type: string
                 agent_evm_address:
                     type: string
                 signing_keys:
@@ -27429,7 +27454,26 @@ components:
                             description: Chains with provisioned signing keys
                         agent_api_key:
                             type: [string, "null"]
-                            description: One-time agent API key (ocv_ prefix). Store securely — not retrievable later.
+                            description: |
+                                First agent's one-time API key (ocv_ prefix). Kept for
+                                compatibility; prefer `agent_api_keys`, which covers every
+                                agent the template created.
+                        agent_api_keys:
+                            type: array
+                            maxItems: 1
+                            description: |
+                                The created agent and its one-time API key. Exactly one entry:
+                                a template declaring more than one agent is refused with 400,
+                                because a key is returned once and cannot be re-issued to a
+                                platform app. Split such a template and bootstrap once per agent.
+                            items:
+                                type: object
+                                properties:
+                                    agent_id:
+                                        type: string
+                                        format: uuid
+                                    api_key:
+                                        type: string
                         agent_evm_address:
                             type: [string, "null"]
                             description: EOA address when provision_eoa is true in the template

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.58",
+  "version": "0.61.60",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {