@inklok/api-spec 7.8.0 → 7.8.2

package/openapi.yaml

@@ -8,7 +8,7 @@ info:
     Authenticate using an API key or bearer token, then use the resources below to manage
     templates, agreements, documents, and signing. For your first integration, start with
     the Quick Start guide.
-  version: "7.8.0"
+  version: "7.8.2"
   contact:
     name: Inklok API Support
     email: support@inklok.com
@@ -1816,6 +1816,12 @@ paths:
           description: Document identifier
           schema:
             type: string
+        - name: executionId
+          in: query
+          required: false
+          description: Required for signer-token access; binds document access to the verified signing execution.
+          schema:
+            type: string
       responses:
         '200':
           description: Base64-encoded document encryption key for client-side decryption
@@ -2624,63 +2630,6 @@ paths:
         '500':
           $ref: '#/components/responses/InternalServerError'
 
-  /v1/signing/managed-regrant:
-    post:
-      operationId: managedScopeRegrant
-      summary: Regrant authorized managed scope envelopes
-      x-visibility: internal
-      x-required-roles: []
-      description: |
-        Derives the caller's authorized managed scopes from the verified Cognito
-        membership or signer token, recovers those scope DEKs inside the managed
-        recovery boundary, and returns only RSA-OAEP envelopes for the caller's
-        validated registered transient public key. The request cannot select scope
-        IDs and the response never contains plaintext values or raw DEKs.
-      tags:
-        - Signing
-      security:
-        - bearerAuth: []
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [executionId, destinationPublicKeyId]
-              properties:
-                executionId:
-                  type: string
-                destinationPublicKeyId:
-                  type: string
-      responses:
-        '200':
-          description: Scoped managed envelopes for the authenticated principal
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [keyScopes, envelopes]
-                properties:
-                  keyScopes:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/KeyScope'
-                  envelopes:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/KeyEnvelope'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '403':
-          $ref: '#/components/responses/Forbidden'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      x-inklok-lambda: managed-scope-regrant
-
   /v1/agreements/{executionId}/resend-completion-emails:
     post:
       operationId: agreementResendCompletionEmails
@@ -2884,6 +2833,7 @@ paths:
                         value_encrypted:
                           type: string
                           nullable: true
+                          description: JSON-serialized ScopedEncryptedFieldValue (v2). The server stores this string verbatim only after structural and authoritative binding validation.
                         required:
                           type: boolean
         '401':
@@ -2975,6 +2925,8 @@ paths:
                         type: string
                       value_encrypted:
                         type: string
+                        minLength: 1
+                        description: JSON-serialized ScopedEncryptedFieldValue. The server validates its exact v2 envelope, authoritative keyScopeId, and canonical AAD before persistence.
                 metadata:
                   type: object
                   additionalProperties: true
@@ -3175,16 +3127,15 @@ paths:
 
   /v1/signing/scope-envelopes:
     post:
-      operationId: resolveSigningScopeEnvelopes
-      summary: Resolve signer-authorized scope envelopes
+      operationId: managedScopeRegrant
+      summary: Regrant authorized managed scope envelopes
       x-visibility: internal
       description: |
-        Returns wrapped key material scoped to the authenticated signer.
-
-        - Requires a signing access token
-        - Returns document key material for current PDF compatibility
-        - Returns only scope envelopes authorized for the signer
-        - Audited for signer access
+        Derives the caller's authorized managed scopes from the verified Cognito
+        membership or signer token, recovers those scope DEKs inside the managed
+        recovery boundary, and returns only RSA-OAEP envelopes for the caller's
+        validated registered transient public key. The request cannot select scope
+        IDs and the response never contains plaintext values or raw DEKs.
       tags:
         - Signing
       security:
@@ -3195,30 +3146,24 @@ paths:
           application/json:
             schema:
               type: object
-              required: [executionId]
+              required: [executionId, destinationPublicKeyId]
               properties:
                 executionId:
                   type: string
+                destinationPublicKeyId:
+                  type: string
             example:
               executionId: "exec_123"
+              destinationPublicKeyId: "session_key_123"
       responses:
         '200':
-          description: Wrapped document material and signer-visible scoped field envelopes
+          description: Scoped managed envelopes for the authenticated principal
           content:
             application/json:
               schema:
                 type: object
-                required: [documentDek, placeholders]
+                required: [keyScopes, envelopes]
                 properties:
-                  documentDek:
-                    type: object
-                    required: [encrypted, alg]
-                    properties:
-                      encrypted:
-                        type: string
-                      alg:
-                        type: string
-                        enum: [KMS-WRAPPED-BASE64, RSA-OAEP]
                   keyScopes:
                     type: array
                     items:
@@ -3228,9 +3173,6 @@ paths:
                     items:
                       $ref: '#/components/schemas/KeyEnvelope'
               example:
-                documentDek:
-                  encrypted: "base64..."
-                  alg: "KMS-WRAPPED-BASE64"
                 keyScopes: []
                 envelopes: []
         '400':
@@ -3243,7 +3185,7 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/InternalServerError'
-      x-inklok-lambda: signing-scope-envelopes
+      x-inklok-lambda: managed-scope-regrant
 
 components:
   securitySchemes:
@@ -5689,6 +5631,7 @@ components:
         type:
           type: string
           enum: [PARTY_PRIVATE, SHARED, ORG_AUTHORIZED, WORKSPACE_AUTHORIZED]
+          description: Current managed signing creation accepts PARTY_PRIVATE and SHARED. Other enum values are reserved for future modes and are rejected at creation time.
         partyId:
           type: string
         members:
@@ -5708,6 +5651,7 @@ components:
         protectionMode:
           type: string
           enum: [MANAGED, STRICT_ZK]
+          description: Current signing creation accepts MANAGED only. STRICT_ZK is reserved and not enabled.
         createdAt:
           type: string
           format: date-time
@@ -5788,6 +5732,37 @@ components:
         kmsWrappedScopeDek:
           type: string
 
+    ScopedEncryptedFieldValue:
+      type: object
+      additionalProperties: false
+      description: |
+        Parsed form of the JSON string carried by signing field value_encrypted.
+        v2 binds AES-GCM authentication to the agreement, authoritative scope,
+        field, and encryption version. The server validates structure and AAD
+        metadata but does not decrypt managed values.
+      required: [alg, keyScopeId, encryptionVersion, ciphertext, iv, authTag, aad]
+      properties:
+        alg:
+          type: string
+          enum: [AES-256-GCM]
+        keyScopeId:
+          type: string
+        encryptionVersion:
+          type: integer
+          enum: [2]
+        ciphertext:
+          type: string
+          description: Canonical base64 ciphertext bytes, without the GCM tag.
+        iv:
+          type: string
+          description: Canonical base64 12-byte AES-GCM IV.
+        authTag:
+          type: string
+          description: Canonical base64 16-byte AES-GCM authentication tag.
+        aad:
+          type: string
+          description: 'Exact UTF-8 AAD string: inklok:field-value:v2:{"agreementId":"…","keyScopeId":"…","fieldId":"…","encryptionVersion":2}'
+
     CryptoPrincipal:
       type: object
       required: [principalId, type, subjectId]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inklok/api-spec",
-  "version": "7.8.0",
+  "version": "7.8.2",
   "description": "Canonical OpenAPI specification for the Inklok public API.",
   "main": "openapi.yaml",
   "license": "MIT",