@inklok/api-spec 7.5.0 → 7.5.2

package/openapi.yaml

@@ -8,7 +8,7 @@ info:
     Authenticate using an API key or bearer token, then use the resources below to manage
     templates, agreements, documents, and signing. For your first integration, start with
     the Quick Start guide.
-  version: "7.5.0"
+  version: "7.5.2"
   contact:
     name: Inklok API Support
     email: support@inklok.com
@@ -2202,19 +2202,30 @@ paths:
       x-visibility: internal
       description: |
         Returns simulated emails generated by sandbox agreement workflows visible
-        to the authenticated account or the caller's sandbox API-key organization.
+        to the authenticated Cognito user account. API key authentication is not
+        supported for Sandbox Inbox.
         When an agreement action would normally send a notification to a party,
         Inklok creates a simulated email in Sandbox Inbox instead. No emails are
         sent to recipients. Recipient email address is not used for visibility.
         The endpoint uses an explicit allowlist of agreement lifecycle email event
         types and never returns authentication, identity, invitation, security, or
         generic outbound email history. List items are summary-only and do not
-        include rendered email bodies.
+        include rendered email bodies. When `messageId` is supplied, the response
+        includes sanitized rendered preview content with executable hrefs, magic
+        links, signer tokens, signing URLs, and replay-enabling identifiers removed.
+        Sanitization is applied to every user-visible Sandbox Inbox field in the
+        response, including subject, preview text, participant labels, agreement
+        titles, and rendered bodies. Email event records remain unchanged.
       x-required-roles: [workflow-editor, workflow-operator, agreement-auditor, organization-admin, platform-super-admin]
-      x-required-scopes: [agreements:read]
       tags:
         - Me
       parameters:
+        - name: messageId
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Optional Sandbox Inbox message identifier. When supplied, returns a sanitized message detail instead of a paginated summary list.
         - name: limit
           in: query
           required: false
@@ -2233,11 +2244,13 @@ paths:
           description: Opaque pagination cursor returned by a previous response.
       responses:
         '200':
-          description: Simulated Sandbox agreement emails for the authenticated user
+          description: Simulated Sandbox agreement emails or sanitized message detail for the authenticated user
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/SandboxInboxResponse'
+                oneOf:
+                  - $ref: '#/components/schemas/SandboxInboxResponse'
+                  - $ref: '#/components/schemas/SandboxInboxDetail'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -3311,10 +3324,11 @@ components:
         email:
           type: string
           nullable: true
-          format: email
+          description: Sanitized recipient address preview. Token-like values and replay-enabling identifiers are removed at retrieval time.
         label:
           type: string
           nullable: true
+          description: Sanitized participant display label. Token-like values and replay-enabling identifiers are removed at retrieval time.
 
     SandboxInboxItem:
       type: object
@@ -3336,6 +3350,7 @@ components:
         agreementTitle:
           type: string
           nullable: true
+          description: Sanitized agreement title preview. Token-like values and replay-enabling identifiers are removed at retrieval time.
         eventType:
           type: string
           enum: [SIGN_REQUEST, NEXT_STEP, COMPLETED, REMINDER, SIGNING_REMINDER, AGREEMENT_REMINDER]
@@ -3344,15 +3359,35 @@ components:
         sender:
           type: string
           nullable: true
+          description: Sanitized sender preview. Token-like values and replay-enabling identifiers are removed at retrieval time.
         subject:
           type: string
           nullable: true
+          description: Sanitized email subject preview. Token-like values, signing URLs, and replay-enabling identifiers are removed at retrieval time.
         preview:
           type: string
+          description: Sanitized list preview. Token-like values, signing URLs, and replay-enabling identifiers are removed at retrieval time.
         sentAt:
           type: string
           format: date-time
 
+    SandboxInboxDetail:
+      allOf:
+        - $ref: '#/components/schemas/SandboxInboxItem'
+        - type: object
+          required:
+            - htmlBody
+            - textBody
+          properties:
+            htmlBody:
+              type: string
+              nullable: true
+              description: Sanitized rendered HTML preview. Executable hrefs, magic links, signer tokens, signing URLs, and replay-enabling identifiers are removed at retrieval time.
+            textBody:
+              type: string
+              nullable: true
+              description: Sanitized plain-text preview. Magic links, signer tokens, signing URLs, and replay-enabling identifiers are removed at retrieval time.
+
     SandboxInboxResponse:
       type: object
       required:
@@ -4599,7 +4634,7 @@ components:
           description: Document identifier
         type:
           type: string
-          enum: [signature, text, date]
+          enum: [signature, text, date, checkbox]
           description: Placeholder type
         position:
           type: object
@@ -4973,7 +5008,7 @@ components:
           description: Placeholder identifier
         type:
           type: string
-          enum: [signature, text, date]
+          enum: [signature, text, date, checkbox]
           description: Placeholder type
         role:
           type: string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inklok/api-spec",
-  "version": "7.5.0",
+  "version": "7.5.2",
   "description": "Canonical OpenAPI specification for the Inklok public API.",
   "main": "openapi.yaml",
   "license": "MIT",