@inklok/api-spec 7.8.1 → 7.8.3

package/openapi.yaml

@@ -8,7 +8,7 @@ info:
     Authenticate using an API key or bearer token, then use the resources below to manage
     templates, agreements, documents, and signing. For your first integration, start with
     the Quick Start guide.
-  version: "7.8.1"
+  version: "7.8.3"
   contact:
     name: Inklok API Support
     email: support@inklok.com
@@ -239,6 +239,96 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+
+  /v1/crypto/identities/{publicKeyId}/recovery:
+    get:
+      operationId: getCryptoIdentityRecoveryBundleV1
+      summary: Get crypto identity recovery bundle
+      x-visibility: internal
+      description: |
+        Returns the encrypted client-side recovery bundle for an authorized account crypto identity. Recovery Keys are never accepted by this API.
+      x-required-roles: [workflow-editor, workflow-operator, agreement-auditor, organization-admin]
+      tags:
+        - Crypto Identities
+      parameters:
+        - name: publicKeyId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: X-Inklok-Org-Id
+          in: header
+          required: false
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Encrypted recovery bundle
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [bundle]
+                properties:
+                  bundle:
+                    $ref: '#/components/schemas/CryptoIdentityRecoveryBundle'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+    put:
+      operationId: putCryptoIdentityRecoveryBundleV1
+      summary: Replace crypto identity recovery bundle
+      x-visibility: internal
+      description: |
+        Stores an encrypted client-side recovery bundle for an authorized account crypto identity. The plaintext private key and Recovery Key are never accepted.
+      x-required-roles: [workflow-editor, workflow-operator, agreement-auditor, organization-admin]
+      tags:
+        - Crypto Identities
+      parameters:
+        - name: publicKeyId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: X-Inklok-Org-Id
+          in: header
+          required: false
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CryptoIdentityRecoveryBundle'
+      responses:
+        '200':
+          description: Stored encrypted recovery bundle
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [bundle]
+                properties:
+                  bundle:
+                    $ref: '#/components/schemas/CryptoIdentityRecoveryBundle'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/InternalServerError'
 
@@ -2833,6 +2923,7 @@ paths:
                         value_encrypted:
                           type: string
                           nullable: true
+                          description: JSON-serialized ScopedEncryptedFieldValue (v2). The server stores this string verbatim only after structural and authoritative binding validation.
                         required:
                           type: boolean
         '401':
@@ -2924,6 +3015,8 @@ paths:
                         type: string
                       value_encrypted:
                         type: string
+                        minLength: 1
+                        description: JSON-serialized ScopedEncryptedFieldValue. The server validates its exact v2 envelope, authoritative keyScopeId, and canonical AAD before persistence.
                 metadata:
                   type: object
                   additionalProperties: true
@@ -5628,6 +5721,7 @@ components:
         type:
           type: string
           enum: [PARTY_PRIVATE, SHARED, ORG_AUTHORIZED, WORKSPACE_AUTHORIZED]
+          description: Current managed signing creation accepts PARTY_PRIVATE and SHARED. Other enum values are reserved for future modes and are rejected at creation time.
         partyId:
           type: string
         members:
@@ -5647,6 +5741,7 @@ components:
         protectionMode:
           type: string
           enum: [MANAGED, STRICT_ZK]
+          description: Current signing creation accepts MANAGED only. STRICT_ZK is reserved and not enabled.
         createdAt:
           type: string
           format: date-time
@@ -5727,6 +5822,37 @@ components:
         kmsWrappedScopeDek:
           type: string
 
+    ScopedEncryptedFieldValue:
+      type: object
+      additionalProperties: false
+      description: |
+        Parsed form of the JSON string carried by signing field value_encrypted.
+        v2 binds AES-GCM authentication to the agreement, authoritative scope,
+        field, and encryption version. The server validates structure and AAD
+        metadata but does not decrypt managed values.
+      required: [alg, keyScopeId, encryptionVersion, ciphertext, iv, authTag, aad]
+      properties:
+        alg:
+          type: string
+          enum: [AES-256-GCM]
+        keyScopeId:
+          type: string
+        encryptionVersion:
+          type: integer
+          enum: [2]
+        ciphertext:
+          type: string
+          description: Canonical base64 ciphertext bytes, without the GCM tag.
+        iv:
+          type: string
+          description: Canonical base64 12-byte AES-GCM IV.
+        authTag:
+          type: string
+          description: Canonical base64 16-byte AES-GCM authentication tag.
+        aad:
+          type: string
+          description: 'Exact UTF-8 AAD string: inklok:field-value:v2:{"agreementId":"…","keyScopeId":"…","fieldId":"…","encryptionVersion":2}'
+
     CryptoPrincipal:
       type: object
       required: [principalId, type, subjectId]
@@ -5823,6 +5949,57 @@ components:
           format: date-time
           readOnly: true
 
+    CryptoIdentityRecoveryBundle:
+      type: object
+      description: Client-encrypted account private-key recovery payload. The Recovery Key is never included.
+      required: [identityId, encryptedPrivateKey, salt, iv, kdf, kdfVersion, kdfParams, encryptionAlg, encryptionVersion, aad]
+      properties:
+        identityId:
+          type: string
+        encryptedPrivateKey:
+          type: string
+          description: Base64 AES-GCM ciphertext of the account private key export.
+        salt:
+          type: string
+        iv:
+          type: string
+        kdf:
+          type: string
+          enum: [PBKDF2-SHA-256]
+        kdfVersion:
+          type: integer
+          enum: [1]
+        kdfParams:
+          type: object
+          required: [iterations, hash, saltBytes]
+          properties:
+            iterations:
+              type: integer
+              minimum: 310000
+            hash:
+              type: string
+              enum: [SHA-256]
+            saltBytes:
+              type: integer
+              enum: [16]
+        encryptionAlg:
+          type: string
+          enum: [AES-GCM-256]
+        encryptionVersion:
+          type: integer
+          enum: [1]
+        aad:
+          type: string
+          description: Identity-bound AES-GCM additional authenticated data.
+        createdAt:
+          type: string
+          format: date-time
+          readOnly: true
+        updatedAt:
+          type: string
+          format: date-time
+          readOnly: true
+
     AppendExecutionEventRequest:
       type: object
       required: [type, actorType]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inklok/api-spec",
-  "version": "7.8.1",
+  "version": "7.8.3",
   "description": "Canonical OpenAPI specification for the Inklok public API.",
   "main": "openapi.yaml",
   "license": "MIT",