@1claw/openapi-spec 0.61.7 → 0.61.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/openapi.json +252 -1
- package/openapi.yaml +129 -1
- package/package.json +1 -1
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "1Claw API",
|
|
5
|
-
"version": "0.61.
|
|
5
|
+
"version": "0.61.9",
|
|
6
6
|
"description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
|
|
7
7
|
"contact": {
|
|
8
8
|
"email": "ops@1claw.co"
|
|
@@ -25551,6 +25551,257 @@
|
|
|
25551
25551
|
}
|
|
25552
25552
|
}
|
|
25553
25553
|
},
|
|
25554
|
+
"/v1/otel/agents/{agent_id}/trust": {
|
|
25555
|
+
"get": {
|
|
25556
|
+
"tags": [
|
|
25557
|
+
"Observability"
|
|
25558
|
+
],
|
|
25559
|
+
"summary": "The breakdown behind one agent's trust score",
|
|
25560
|
+
"description": "The topology carries a single 0-100 trust number per agent. This is what it is made of: each weighted component (`null` when this deployment has no source for it — not measured, not zero), a 24-hour history for a sparkline, and the agent's last audit actions. Actions and resource types only; audit `metadata` is where secret paths live and it is not returned.\n\nScores are `shadow` until the engine is promoted out of recommend-only mode; an agent the engine has not yet reached returns `score: null` and `shadow: true`.\n\nHuman users only. An agent id outside the caller's org is a 404, not a 403, so the response does not confirm the id exists.",
|
|
25561
|
+
"operationId": "get_otel_agent_trust",
|
|
25562
|
+
"parameters": [
|
|
25563
|
+
{
|
|
25564
|
+
"name": "agent_id",
|
|
25565
|
+
"in": "path",
|
|
25566
|
+
"required": true,
|
|
25567
|
+
"schema": {
|
|
25568
|
+
"type": "string",
|
|
25569
|
+
"format": "uuid"
|
|
25570
|
+
}
|
|
25571
|
+
}
|
|
25572
|
+
],
|
|
25573
|
+
"responses": {
|
|
25574
|
+
"200": {
|
|
25575
|
+
"description": "Current score, components, history, recent actions",
|
|
25576
|
+
"content": {
|
|
25577
|
+
"application/json": {
|
|
25578
|
+
"schema": {
|
|
25579
|
+
"type": "object",
|
|
25580
|
+
"required": [
|
|
25581
|
+
"agent_id",
|
|
25582
|
+
"shadow",
|
|
25583
|
+
"components",
|
|
25584
|
+
"history",
|
|
25585
|
+
"recent"
|
|
25586
|
+
],
|
|
25587
|
+
"properties": {
|
|
25588
|
+
"agent_id": {
|
|
25589
|
+
"type": "string",
|
|
25590
|
+
"format": "uuid"
|
|
25591
|
+
},
|
|
25592
|
+
"score": {
|
|
25593
|
+
"type": "integer",
|
|
25594
|
+
"minimum": 0,
|
|
25595
|
+
"maximum": 100,
|
|
25596
|
+
"nullable": true
|
|
25597
|
+
},
|
|
25598
|
+
"shadow": {
|
|
25599
|
+
"type": "boolean",
|
|
25600
|
+
"description": "True while the engine is recommend-only or the agent is unscored."
|
|
25601
|
+
},
|
|
25602
|
+
"updated_at": {
|
|
25603
|
+
"type": "string",
|
|
25604
|
+
"format": "date-time",
|
|
25605
|
+
"nullable": true
|
|
25606
|
+
},
|
|
25607
|
+
"components": {
|
|
25608
|
+
"type": "object",
|
|
25609
|
+
"description": "0-100 per component; null means no source in this deployment.",
|
|
25610
|
+
"properties": {
|
|
25611
|
+
"denial_rate": {
|
|
25612
|
+
"type": "integer",
|
|
25613
|
+
"nullable": true
|
|
25614
|
+
},
|
|
25615
|
+
"threat_hits": {
|
|
25616
|
+
"type": "integer",
|
|
25617
|
+
"nullable": true
|
|
25618
|
+
},
|
|
25619
|
+
"egress_blocks": {
|
|
25620
|
+
"type": "integer",
|
|
25621
|
+
"nullable": true
|
|
25622
|
+
},
|
|
25623
|
+
"spend_velocity": {
|
|
25624
|
+
"type": "integer",
|
|
25625
|
+
"nullable": true
|
|
25626
|
+
},
|
|
25627
|
+
"off_hours": {
|
|
25628
|
+
"type": "integer",
|
|
25629
|
+
"nullable": true
|
|
25630
|
+
},
|
|
25631
|
+
"consensus_bypass": {
|
|
25632
|
+
"type": "integer",
|
|
25633
|
+
"nullable": true
|
|
25634
|
+
}
|
|
25635
|
+
}
|
|
25636
|
+
},
|
|
25637
|
+
"history": {
|
|
25638
|
+
"type": "array",
|
|
25639
|
+
"maxItems": 96,
|
|
25640
|
+
"description": "Oldest first, last 24 hours.",
|
|
25641
|
+
"items": {
|
|
25642
|
+
"type": "object",
|
|
25643
|
+
"required": [
|
|
25644
|
+
"at",
|
|
25645
|
+
"score"
|
|
25646
|
+
],
|
|
25647
|
+
"properties": {
|
|
25648
|
+
"at": {
|
|
25649
|
+
"type": "string",
|
|
25650
|
+
"format": "date-time"
|
|
25651
|
+
},
|
|
25652
|
+
"score": {
|
|
25653
|
+
"type": "integer",
|
|
25654
|
+
"minimum": 0,
|
|
25655
|
+
"maximum": 100
|
|
25656
|
+
}
|
|
25657
|
+
}
|
|
25658
|
+
}
|
|
25659
|
+
},
|
|
25660
|
+
"recent": {
|
|
25661
|
+
"type": "array",
|
|
25662
|
+
"maxItems": 12,
|
|
25663
|
+
"description": "Newest first.",
|
|
25664
|
+
"items": {
|
|
25665
|
+
"type": "object",
|
|
25666
|
+
"required": [
|
|
25667
|
+
"at",
|
|
25668
|
+
"action"
|
|
25669
|
+
],
|
|
25670
|
+
"properties": {
|
|
25671
|
+
"at": {
|
|
25672
|
+
"type": "string",
|
|
25673
|
+
"format": "date-time"
|
|
25674
|
+
},
|
|
25675
|
+
"action": {
|
|
25676
|
+
"type": "string"
|
|
25677
|
+
},
|
|
25678
|
+
"resource_type": {
|
|
25679
|
+
"type": "string",
|
|
25680
|
+
"nullable": true
|
|
25681
|
+
}
|
|
25682
|
+
}
|
|
25683
|
+
}
|
|
25684
|
+
}
|
|
25685
|
+
}
|
|
25686
|
+
}
|
|
25687
|
+
}
|
|
25688
|
+
}
|
|
25689
|
+
},
|
|
25690
|
+
"401": {
|
|
25691
|
+
"description": "Unauthenticated"
|
|
25692
|
+
},
|
|
25693
|
+
"403": {
|
|
25694
|
+
"description": "Not a human user"
|
|
25695
|
+
},
|
|
25696
|
+
"404": {
|
|
25697
|
+
"description": "No such agent in the caller's organization"
|
|
25698
|
+
}
|
|
25699
|
+
}
|
|
25700
|
+
}
|
|
25701
|
+
},
|
|
25702
|
+
"/v1/otel/flows": {
|
|
25703
|
+
"get": {
|
|
25704
|
+
"tags": [
|
|
25705
|
+
"Observability"
|
|
25706
|
+
],
|
|
25707
|
+
"summary": "Who actually read from which vault",
|
|
25708
|
+
"description": "Reachability (the topology's policy edges) says who *could* read a vault. This says who *did*, counted from `audit_events.action = 'secret.read'` — the durable record every read already writes — grouped by agent and vault. That is what lets a Sankey ribbon's width be a count of real reads rather than a guess.\n\nAgent actors only; a human reading a secret through the dashboard is not an agent flow. Deleted agents and vaults are kept and labelled as such — a read that happened is still a read.",
|
|
25709
|
+
"operationId": "get_otel_flows",
|
|
25710
|
+
"parameters": [
|
|
25711
|
+
{
|
|
25712
|
+
"name": "window",
|
|
25713
|
+
"in": "query",
|
|
25714
|
+
"required": false,
|
|
25715
|
+
"description": "Lookback, e.g. `1h`, `24h`, `7d`. Default 24h, maximum 30d.",
|
|
25716
|
+
"schema": {
|
|
25717
|
+
"type": "string",
|
|
25718
|
+
"default": "24h"
|
|
25719
|
+
}
|
|
25720
|
+
}
|
|
25721
|
+
],
|
|
25722
|
+
"responses": {
|
|
25723
|
+
"200": {
|
|
25724
|
+
"description": "Read flows, highest first",
|
|
25725
|
+
"content": {
|
|
25726
|
+
"application/json": {
|
|
25727
|
+
"schema": {
|
|
25728
|
+
"type": "object",
|
|
25729
|
+
"required": [
|
|
25730
|
+
"window",
|
|
25731
|
+
"edges",
|
|
25732
|
+
"total_reads"
|
|
25733
|
+
],
|
|
25734
|
+
"properties": {
|
|
25735
|
+
"window": {
|
|
25736
|
+
"type": "object",
|
|
25737
|
+
"properties": {
|
|
25738
|
+
"window_secs": {
|
|
25739
|
+
"type": "integer"
|
|
25740
|
+
},
|
|
25741
|
+
"step_secs": {
|
|
25742
|
+
"type": "integer"
|
|
25743
|
+
}
|
|
25744
|
+
}
|
|
25745
|
+
},
|
|
25746
|
+
"edges": {
|
|
25747
|
+
"type": "array",
|
|
25748
|
+
"maxItems": 500,
|
|
25749
|
+
"items": {
|
|
25750
|
+
"type": "object",
|
|
25751
|
+
"required": [
|
|
25752
|
+
"agent_id",
|
|
25753
|
+
"agent_name",
|
|
25754
|
+
"vault_id",
|
|
25755
|
+
"vault_name",
|
|
25756
|
+
"reads",
|
|
25757
|
+
"distinct_paths"
|
|
25758
|
+
],
|
|
25759
|
+
"properties": {
|
|
25760
|
+
"agent_id": {
|
|
25761
|
+
"type": "string",
|
|
25762
|
+
"format": "uuid"
|
|
25763
|
+
},
|
|
25764
|
+
"agent_name": {
|
|
25765
|
+
"type": "string"
|
|
25766
|
+
},
|
|
25767
|
+
"vault_id": {
|
|
25768
|
+
"type": "string",
|
|
25769
|
+
"format": "uuid"
|
|
25770
|
+
},
|
|
25771
|
+
"vault_name": {
|
|
25772
|
+
"type": "string"
|
|
25773
|
+
},
|
|
25774
|
+
"reads": {
|
|
25775
|
+
"type": "integer",
|
|
25776
|
+
"description": "secret.read events in the window."
|
|
25777
|
+
},
|
|
25778
|
+
"distinct_paths": {
|
|
25779
|
+
"type": "integer",
|
|
25780
|
+
"description": "Distinct secret paths touched."
|
|
25781
|
+
}
|
|
25782
|
+
}
|
|
25783
|
+
}
|
|
25784
|
+
},
|
|
25785
|
+
"total_reads": {
|
|
25786
|
+
"type": "integer"
|
|
25787
|
+
}
|
|
25788
|
+
}
|
|
25789
|
+
}
|
|
25790
|
+
}
|
|
25791
|
+
}
|
|
25792
|
+
},
|
|
25793
|
+
"400": {
|
|
25794
|
+
"description": "Unparseable window or window over 30d"
|
|
25795
|
+
},
|
|
25796
|
+
"401": {
|
|
25797
|
+
"description": "Unauthenticated"
|
|
25798
|
+
},
|
|
25799
|
+
"403": {
|
|
25800
|
+
"description": "Not a human user"
|
|
25801
|
+
}
|
|
25802
|
+
}
|
|
25803
|
+
}
|
|
25804
|
+
},
|
|
25554
25805
|
"/v1/otel/summary": {
|
|
25555
25806
|
"get": {
|
|
25556
25807
|
"tags": [
|
package/openapi.yaml
CHANGED
|
@@ -2,7 +2,7 @@ openapi: 3.1.0
|
|
|
2
2
|
|
|
3
3
|
info:
|
|
4
4
|
title: 1Claw API
|
|
5
|
-
version: "0.61.
|
|
5
|
+
version: "0.61.9"
|
|
6
6
|
description: |
|
|
7
7
|
Secure secret management for AI agents. Provides vaults, secrets,
|
|
8
8
|
policy-based access control, agent identity, Intents API,
|
|
@@ -16402,6 +16402,134 @@ paths:
|
|
|
16402
16402
|
description: Unauthenticated
|
|
16403
16403
|
'403':
|
|
16404
16404
|
description: Not a human user
|
|
16405
|
+
/v1/otel/agents/{agent_id}/trust:
|
|
16406
|
+
get:
|
|
16407
|
+
tags: [Observability]
|
|
16408
|
+
summary: "The breakdown behind one agent's trust score"
|
|
16409
|
+
description: >-
|
|
16410
|
+
The topology carries a single 0-100 trust number per agent.
|
|
16411
|
+
This is what it is made of: each weighted component (`null`
|
|
16412
|
+
when this deployment has no source for it — not measured, not
|
|
16413
|
+
zero), a 24-hour history for a sparkline, and the agent's last
|
|
16414
|
+
audit actions. Actions and resource types only; audit
|
|
16415
|
+
`metadata` is where secret paths live and it is not returned.
|
|
16416
|
+
|
|
16417
|
+
|
|
16418
|
+
Scores are `shadow` until the engine is promoted out of
|
|
16419
|
+
recommend-only mode; an agent the engine has not yet reached
|
|
16420
|
+
returns `score: null` and `shadow: true`.
|
|
16421
|
+
|
|
16422
|
+
|
|
16423
|
+
Human users only. An agent id outside the caller's org is a
|
|
16424
|
+
404, not a 403, so the response does not confirm the id exists.
|
|
16425
|
+
operationId: get_otel_agent_trust
|
|
16426
|
+
parameters:
|
|
16427
|
+
- name: agent_id
|
|
16428
|
+
in: path
|
|
16429
|
+
required: true
|
|
16430
|
+
schema: { type: string, format: uuid }
|
|
16431
|
+
responses:
|
|
16432
|
+
'200':
|
|
16433
|
+
description: Current score, components, history, recent actions
|
|
16434
|
+
content:
|
|
16435
|
+
application/json:
|
|
16436
|
+
schema:
|
|
16437
|
+
type: object
|
|
16438
|
+
required: [agent_id, shadow, components, history, recent]
|
|
16439
|
+
properties:
|
|
16440
|
+
agent_id: { type: string, format: uuid }
|
|
16441
|
+
score: { type: integer, minimum: 0, maximum: 100, nullable: true }
|
|
16442
|
+
shadow: { type: boolean, description: "True while the engine is recommend-only or the agent is unscored." }
|
|
16443
|
+
updated_at: { type: string, format: date-time, nullable: true }
|
|
16444
|
+
components:
|
|
16445
|
+
type: object
|
|
16446
|
+
description: "0-100 per component; null means no source in this deployment."
|
|
16447
|
+
properties:
|
|
16448
|
+
denial_rate: { type: integer, nullable: true }
|
|
16449
|
+
threat_hits: { type: integer, nullable: true }
|
|
16450
|
+
egress_blocks: { type: integer, nullable: true }
|
|
16451
|
+
spend_velocity: { type: integer, nullable: true }
|
|
16452
|
+
off_hours: { type: integer, nullable: true }
|
|
16453
|
+
consensus_bypass: { type: integer, nullable: true }
|
|
16454
|
+
history:
|
|
16455
|
+
type: array
|
|
16456
|
+
maxItems: 96
|
|
16457
|
+
description: "Oldest first, last 24 hours."
|
|
16458
|
+
items:
|
|
16459
|
+
type: object
|
|
16460
|
+
required: [at, score]
|
|
16461
|
+
properties:
|
|
16462
|
+
at: { type: string, format: date-time }
|
|
16463
|
+
score: { type: integer, minimum: 0, maximum: 100 }
|
|
16464
|
+
recent:
|
|
16465
|
+
type: array
|
|
16466
|
+
maxItems: 12
|
|
16467
|
+
description: "Newest first."
|
|
16468
|
+
items:
|
|
16469
|
+
type: object
|
|
16470
|
+
required: [at, action]
|
|
16471
|
+
properties:
|
|
16472
|
+
at: { type: string, format: date-time }
|
|
16473
|
+
action: { type: string }
|
|
16474
|
+
resource_type: { type: string, nullable: true }
|
|
16475
|
+
'401': { description: Unauthenticated }
|
|
16476
|
+
'403': { description: Not a human user }
|
|
16477
|
+
'404': { description: No such agent in the caller's organization }
|
|
16478
|
+
/v1/otel/flows:
|
|
16479
|
+
get:
|
|
16480
|
+
tags: [Observability]
|
|
16481
|
+
summary: "Who actually read from which vault"
|
|
16482
|
+
description: >-
|
|
16483
|
+
Reachability (the topology's policy edges) says who *could*
|
|
16484
|
+
read a vault. This says who *did*, counted from
|
|
16485
|
+
`audit_events.action = 'secret.read'` — the durable record every
|
|
16486
|
+
read already writes — grouped by agent and vault. That is what
|
|
16487
|
+
lets a Sankey ribbon's width be a count of real reads rather
|
|
16488
|
+
than a guess.
|
|
16489
|
+
|
|
16490
|
+
|
|
16491
|
+
Agent actors only; a human reading a secret through the
|
|
16492
|
+
dashboard is not an agent flow. Deleted agents and vaults are
|
|
16493
|
+
kept and labelled as such — a read that happened is still a
|
|
16494
|
+
read.
|
|
16495
|
+
operationId: get_otel_flows
|
|
16496
|
+
parameters:
|
|
16497
|
+
- name: window
|
|
16498
|
+
in: query
|
|
16499
|
+
required: false
|
|
16500
|
+
description: "Lookback, e.g. `1h`, `24h`, `7d`. Default 24h, maximum 30d."
|
|
16501
|
+
schema: { type: string, default: "24h" }
|
|
16502
|
+
responses:
|
|
16503
|
+
'200':
|
|
16504
|
+
description: Read flows, highest first
|
|
16505
|
+
content:
|
|
16506
|
+
application/json:
|
|
16507
|
+
schema:
|
|
16508
|
+
type: object
|
|
16509
|
+
required: [window, edges, total_reads]
|
|
16510
|
+
properties:
|
|
16511
|
+
window:
|
|
16512
|
+
type: object
|
|
16513
|
+
properties:
|
|
16514
|
+
window_secs: { type: integer }
|
|
16515
|
+
step_secs: { type: integer }
|
|
16516
|
+
edges:
|
|
16517
|
+
type: array
|
|
16518
|
+
maxItems: 500
|
|
16519
|
+
items:
|
|
16520
|
+
type: object
|
|
16521
|
+
required: [agent_id, agent_name, vault_id, vault_name, reads, distinct_paths]
|
|
16522
|
+
properties:
|
|
16523
|
+
agent_id: { type: string, format: uuid }
|
|
16524
|
+
agent_name: { type: string }
|
|
16525
|
+
vault_id: { type: string, format: uuid }
|
|
16526
|
+
vault_name: { type: string }
|
|
16527
|
+
reads: { type: integer, description: "secret.read events in the window." }
|
|
16528
|
+
distinct_paths: { type: integer, description: "Distinct secret paths touched." }
|
|
16529
|
+
total_reads: { type: integer }
|
|
16530
|
+
'400': { description: Unparseable window or window over 30d }
|
|
16531
|
+
'401': { description: Unauthenticated }
|
|
16532
|
+
'403': { description: Not a human user }
|
|
16405
16533
|
/v1/otel/summary:
|
|
16406
16534
|
get:
|
|
16407
16535
|
tags: [Observability]
|