@inklok/api-spec 7.8.0 → 7.8.1

package/openapi.yaml

@@ -8,7 +8,7 @@ info:
     Authenticate using an API key or bearer token, then use the resources below to manage
     templates, agreements, documents, and signing. For your first integration, start with
     the Quick Start guide.
-  version: "7.8.0"
+  version: "7.8.1"
   contact:
     name: Inklok API Support
     email: support@inklok.com
@@ -1816,6 +1816,12 @@ paths:
           description: Document identifier
           schema:
             type: string
+        - name: executionId
+          in: query
+          required: false
+          description: Required for signer-token access; binds document access to the verified signing execution.
+          schema:
+            type: string
       responses:
         '200':
           description: Base64-encoded document encryption key for client-side decryption
@@ -2624,63 +2630,6 @@ paths:
         '500':
           $ref: '#/components/responses/InternalServerError'
 
-  /v1/signing/managed-regrant:
-    post:
-      operationId: managedScopeRegrant
-      summary: Regrant authorized managed scope envelopes
-      x-visibility: internal
-      x-required-roles: []
-      description: |
-        Derives the caller's authorized managed scopes from the verified Cognito
-        membership or signer token, recovers those scope DEKs inside the managed
-        recovery boundary, and returns only RSA-OAEP envelopes for the caller's
-        validated registered transient public key. The request cannot select scope
-        IDs and the response never contains plaintext values or raw DEKs.
-      tags:
-        - Signing
-      security:
-        - bearerAuth: []
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [executionId, destinationPublicKeyId]
-              properties:
-                executionId:
-                  type: string
-                destinationPublicKeyId:
-                  type: string
-      responses:
-        '200':
-          description: Scoped managed envelopes for the authenticated principal
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [keyScopes, envelopes]
-                properties:
-                  keyScopes:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/KeyScope'
-                  envelopes:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/KeyEnvelope'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '403':
-          $ref: '#/components/responses/Forbidden'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      x-inklok-lambda: managed-scope-regrant
-
   /v1/agreements/{executionId}/resend-completion-emails:
     post:
       operationId: agreementResendCompletionEmails
@@ -3175,16 +3124,15 @@ paths:
 
   /v1/signing/scope-envelopes:
     post:
-      operationId: resolveSigningScopeEnvelopes
-      summary: Resolve signer-authorized scope envelopes
+      operationId: managedScopeRegrant
+      summary: Regrant authorized managed scope envelopes
       x-visibility: internal
       description: |
-        Returns wrapped key material scoped to the authenticated signer.
-
-        - Requires a signing access token
-        - Returns document key material for current PDF compatibility
-        - Returns only scope envelopes authorized for the signer
-        - Audited for signer access
+        Derives the caller's authorized managed scopes from the verified Cognito
+        membership or signer token, recovers those scope DEKs inside the managed
+        recovery boundary, and returns only RSA-OAEP envelopes for the caller's
+        validated registered transient public key. The request cannot select scope
+        IDs and the response never contains plaintext values or raw DEKs.
       tags:
         - Signing
       security:
@@ -3195,30 +3143,24 @@ paths:
           application/json:
             schema:
               type: object
-              required: [executionId]
+              required: [executionId, destinationPublicKeyId]
               properties:
                 executionId:
                   type: string
+                destinationPublicKeyId:
+                  type: string
             example:
               executionId: "exec_123"
+              destinationPublicKeyId: "session_key_123"
       responses:
         '200':
-          description: Wrapped document material and signer-visible scoped field envelopes
+          description: Scoped managed envelopes for the authenticated principal
           content:
             application/json:
               schema:
                 type: object
-                required: [documentDek, placeholders]
+                required: [keyScopes, envelopes]
                 properties:
-                  documentDek:
-                    type: object
-                    required: [encrypted, alg]
-                    properties:
-                      encrypted:
-                        type: string
-                      alg:
-                        type: string
-                        enum: [KMS-WRAPPED-BASE64, RSA-OAEP]
                   keyScopes:
                     type: array
                     items:
@@ -3228,9 +3170,6 @@ paths:
                     items:
                       $ref: '#/components/schemas/KeyEnvelope'
               example:
-                documentDek:
-                  encrypted: "base64..."
-                  alg: "KMS-WRAPPED-BASE64"
                 keyScopes: []
                 envelopes: []
         '400':
@@ -3243,7 +3182,7 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/InternalServerError'
-      x-inklok-lambda: signing-scope-envelopes
+      x-inklok-lambda: managed-scope-regrant
 
 components:
   securitySchemes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inklok/api-spec",
-  "version": "7.8.0",
+  "version": "7.8.1",
   "description": "Canonical OpenAPI specification for the Inklok public API.",
   "main": "openapi.yaml",
   "license": "MIT",