{
  "openapi": "3.1.0",
  "info": {
    "title": "Key Chest",
    "version": "2.0.0",
    "description": "Release vault for ch21 agents. No endpoint returns a raw value. Legacy names request_release, check_request_status, proxy_call and signed_in_lookup still work."
  },
  "servers": [
    {
      "url": "https://ch21.ai/api/public/keychest"
    }
  ],
  "components": {
    "securitySchemes": {
      "feedKey": {
        "type": "http",
        "scheme": "bearer"
      }
    }
  },
  "security": [
    {
      "feedKey": []
    }
  ],
  "paths": {
    "/keychest_request_use": {
      "post": {
        "operationId": "keychest_request_use",
        "summary": "Ask to use a saved login or key for one purpose on one site. From outside ch21 this always returns pending_approval. Never returns the value.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "purpose"
                ],
                "properties": {
                  "item_label": {
                    "type": "string"
                  },
                  "item_id": {
                    "type": "string",
                    "format": "uuid"
                  },
                  "purpose": {
                    "type": "object",
                    "required": [
                      "action",
                      "target_domain"
                    ],
                    "properties": {
                      "action": {
                        "type": "string",
                        "enum": [
                          "sign_in",
                          "api_call",
                          "account_lookup",
                          "purchase"
                        ]
                      },
                      "target_domain": {
                        "type": "string"
                      },
                      "reason": {
                        "type": "string"
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "result (never a value)"
          },
          "401": {
            "description": "feed key required"
          },
          "403": {
            "description": "refused"
          }
        }
      }
    },
    "/keychest_check": {
      "post": {
        "operationId": "keychest_check",
        "summary": "Poll a request. When approved, returns a single-use grant_token once.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "request_id"
                ],
                "properties": {
                  "request_id": {
                    "type": "string",
                    "format": "uuid"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "result (never a value)"
          },
          "401": {
            "description": "feed key required"
          },
          "403": {
            "description": "refused"
          }
        }
      }
    },
    "/keychest_proxy_call": {
      "post": {
        "operationId": "keychest_proxy_call",
        "summary": "API keys and account numbers only: one HTTPS call to the grant's exact host with {{secret}} filled in server-side; the value is scrubbed from the reply.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "grant_token",
                  "url"
                ],
                "properties": {
                  "grant_token": {
                    "type": "string"
                  },
                  "method": {
                    "type": "string"
                  },
                  "url": {
                    "type": "string"
                  },
                  "headers": {
                    "type": "object"
                  },
                  "body": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "result (never a value)"
          },
          "401": {
            "description": "feed key required"
          },
          "403": {
            "description": "refused"
          }
        }
      }
    },
    "/keychest_signed_in_lookup": {
      "post": {
        "operationId": "keychest_signed_in_lookup",
        "summary": "Website logins: sign in on ch21's hosted browser, read the requested pages on the allowed site, sign out. Returns scrubbed page text.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "grant_token"
                ],
                "properties": {
                  "grant_token": {
                    "type": "string"
                  },
                  "login_url": {
                    "type": "string"
                  },
                  "read_urls": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  },
                  "find": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "result (never a value)"
          },
          "401": {
            "description": "feed key required"
          },
          "403": {
            "description": "refused"
          }
        }
      }
    }
  }
}