@inklok/api-spec 7.11.1 → 7.11.2

package/openapi.yaml

@@ -8,7 +8,7 @@ info:
     Authenticate using an API key or bearer token, then use the resources below to manage
     templates, agreements, documents, and signing. For your first integration, start with
     the Quick Start guide.
-  version: "7.11.1"
+  version: "7.11.2"
   contact:
     name: Inklok API Support
     email: support@inklok.com
@@ -3099,12 +3099,29 @@ paths:
       operationId: getSigningAgreement
       summary: Get signing details
       description: |
-        Returns the agreement details visible to the authenticated signer, including
-        the document, participant status, fields, and current signing state.
+        Returns the agreement details visible to the authorized participant. A party-scoped
+        signer bearer token uses the party embedded in the token and requires no query selectors.
+        An authenticated Cognito account may instead supply both `executionId` and `partyId` to
+        read a completed agreement when that exact party is durably bound to the authenticated
+        user. Completed account reads are read-only, expose only the matching USER envelope
+        projection, and never return guest invitation capability secrets.
       tags:
         - Signing
       security:
         - bearerAuth: []
+      parameters:
+        - name: executionId
+          in: query
+          required: false
+          description: Required with `partyId` only for authenticated account access to a completed agreement. Ignored for party-scoped signer tokens.
+          schema:
+            type: string
+        - name: partyId
+          in: query
+          required: false
+          description: Required with `executionId` only for authenticated account access. The party must already be durably bound to the authenticated USER.
+          schema:
+            type: string
       responses:
         '200':
           description: Agreement data for signer
@@ -3243,8 +3260,12 @@ paths:
                           description: JSON-serialized ScopedEncryptedFieldValue (v2). The server stores this string verbatim only after structural and authoritative binding validation.
                         required:
                           type: boolean
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
         '500':
           $ref: '#/components/responses/InternalServerError'
       x-inklok-lambda: signing-get-execution

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inklok/api-spec",
-  "version": "7.11.1",
+  "version": "7.11.2",
   "description": "Canonical OpenAPI specification for the Inklok public API.",
   "main": "openapi.yaml",
   "license": "MIT",