--- title: "Add a smart account (Safe) for this agent on a chain" method: POST path: "/v1/agents/{agent_id}/smart-accounts" tags: ["Agents"] --- # Add a smart account (Safe) for this agent on a chain `POST /v1/agents/{agent_id}/smart-accounts` ## Request - Base URL: `https://api.1claw.co` - URL: `https://api.1claw.co/v1/agents/{agent_id}/smart-accounts` - Auth: HTTP bearer Use after deploying a Safe on a new chain. Multi-chain; one Safe per chain. Replaces any existing entry for the same chain_id. ## Path parameters - `agent_id` string, uuid, required ## Request body - AddSmartAccountRequest - `chain` string, required - `chain_id` integer, required - `safe_address` string, required - `nonce` string - `init_data` object ## Response `200` Agent with updated smart_accounts list - AgentResponse - `agent_type` 'standard' | 'child': A `child` is a sub-agent under `parent_agent_id` that inherits its parent's policies and does not count against the plan's agent cap. - `parent_agent_id` string, uuid: Present on child agents. - `memory_enabled` boolean: Whether durable key-value and semantic memory is enabled. Omitted when false: the server skips serializing this field unless it is true, so an absent key means disabled. - `memory_namespace_allowlist` string[]: Namespaces this agent may use. Omitted when empty, which means unrestricted. - `memory_max_entry_bytes` integer, nullable: Maximum size of a single memory entry value. Omitted when unset, which means the platform default (64 KiB). - `id` string, uuid, required - `name` string, required - `description` string - `auth_method` 'api_key' | 'mtls' | 'oidc_client_credentials', required - `scopes` string[] - `is_active` boolean, required - `intents_api_enabled` boolean, required - `tx_to_allowlist` string[] - `tx_max_value` string: Maximum value per transaction in native major units for the transacting chain family (ETH on EVM, BTC on Bitcoin, SOL on Solana, XRP, ADA, TRX). - `tx_daily_limit` string: Rolling daily spend cap in native major units, enforced per chain family at signing time. - `tx_max_value_eth` string: Deprecated alias for tx_max_value. Same unit semantics (native major units, not ETH-only). - `tx_daily_limit_eth` string: Deprecated alias for tx_daily_limit. - `tx_spent_today` string: Sum of today's spend across all chain families in major units. Prefer tx_spent_today_by_chain. - `tx_spent_today_eth` string: Deprecated alias for tx_spent_today. - `tx_allowed_chains` string[] - `token_ttl_seconds` integer, nullable - `vault_ids` string[] - `client_cert_fingerprint` string: SHA-256 fingerprint of the client certificate (mTLS agents) - `oidc_issuer` string: OIDC issuer URL (oidc_client_credentials agents) - `oidc_client_id` string: OIDC client ID (oidc_client_credentials agents) - `ssh_public_key` string: Ed25519 SSH public key (base64-encoded, auto-generated at creation) - `ecdh_public_key` string: P-256 ECDH public key (base64 SEC1 uncompressed point, auto-generated at creation) - `shroud_enabled` boolean, required: Whether this agent routes LLM traffic through the Shroud TEE proxy - `shroud_config` ShroudConfig: Per-agent Shroud LLM Proxy configuration - `pii_policy` 'block' | 'redact' | 'warn' | 'allow': How PII detections are handled - `injection_threshold` number: Prompt injection score threshold (0.0–1.0). Requests above are blocked - `context_injection_threshold` number: Context injection score threshold (0.0–1.0) - `allowed_providers` string[]: LLM providers this agent may use (empty = all) - `allowed_models` string[]: Specific models allowed (empty = all) - `denied_models` string[]: Models explicitly blocked - `max_tokens_per_request` integer: Maximum input tokens per request - `max_requests_per_minute` integer: Rate limit (requests per minute) - `max_requests_per_day` integer: Rate limit (requests per day) - `daily_budget_usd` number: Daily LLM spend cap in USD (0 = unlimited) - `enable_secret_redaction` boolean: Whether vault secrets are redacted from prompts/responses - `enable_response_filtering` boolean: Whether response credential scanning is active - `unicode_normalization` UnicodeNormalizationConfig: Unicode normalization and homoglyph detection settings - `enabled` boolean: Enable Unicode normalization - `strip_zero_width` boolean: Remove zero-width and invisible Unicode characters - `normalize_homoglyphs` boolean: Replace look-alike characters (e.g., Cyrillic а → Latin a) - `normalization_form` 'NFC' | 'NFKC' | 'NFD' | 'NFKD': Unicode normalization form to apply - `command_injection_detection` CommandInjectionConfig: Shell/command injection detection settings - `enabled` boolean: Enable command injection detection - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when command injection is detected - `patterns` 'default' | 'strict' | 'custom': Pattern strictness level - `custom_patterns` string[]: Custom regex patterns for detection (only used when patterns=custom) - `social_engineering_detection` SocialEngineeringConfig: Social engineering and manipulation detection settings - `enabled` boolean: Enable social engineering detection - `action` 'block' | 'warn' | 'log': Action when manipulation attempts are detected - `sensitivity` 'low' | 'medium' | 'high': Detection sensitivity level - `encoding_detection` EncodingDetectionConfig: Encoding/obfuscation detection settings - `enabled` boolean: Enable encoding detection - `action` 'block' | 'decode' | 'warn' | 'log': Action when obfuscated content is detected - `detect_base64` boolean: Detect Base64-encoded content - `detect_hex` boolean: Detect hex-encoded content (\\x41, 0x41) - `detect_unicode_escape` boolean: Detect Unicode escape sequences (\\u0041) - `network_detection` NetworkDetectionConfig: Suspicious URL/domain detection settings - `enabled` boolean: Enable network/URL detection - `action` 'block' | 'warn' | 'log': Action when suspicious URLs are detected - `blocked_domains` string[]: Domains to always block (e.g., pastebin.com, ngrok.io) - `allowed_domains` string[]: Domains to always allow (allowlist mode when non-empty) - `filesystem_detection` FilesystemDetectionConfig: Filesystem path detection settings - `enabled` boolean: Enable filesystem path detection (disabled by default as it can be noisy) - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when filesystem paths are detected - `blocked_paths` string[]: Path patterns to block (e.g., /etc/passwd, ~/.ssh) - `sanitization_mode` 'block' | 'surgical' | 'log_only': Global behavior when threats are detected (block=reject, surgical=remove only malicious parts, log_only=audit without action) - `threat_logging` boolean: Whether to log all detected threats to audit (even when action is allow/warn) - `tool_call_inspection` ToolCallPolicy: Tool/function call inspection settings - `enabled` boolean: Enable tool call inspection - `allowed_tool_names` string[]: Allowed tool/function names (empty = all allowed) - `denied_tool_names` string[]: Denied tool/function names - `scan_arguments` boolean: Scan tool call arguments for credential exfiltration - `block_credential_exfil` boolean: Block tool calls that appear to exfiltrate credentials - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when a tool call violation is detected - `output_policy` OutputPolicy: Output content policy settings for LLM responses - `enabled` boolean: Enable output content policies - `blocked_patterns` string[]: Custom regex patterns to block in responses - `blocked_entities` string[]: Named entities to block (e.g., competitor names) - `block_harmful_content` boolean: Block responses containing harmful content categories - `harmful_categories` string[]: Harm categories to block - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when output policy is violated - `secret_injection_detection` SecretInjectionConfig: Detects credentials injected into prompts that are not from the vault - `enabled` boolean: Enable secret injection detection - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when injected credentials are detected - `sensitivity` 'low' | 'medium' | 'high': Detection sensitivity level - `advanced_redaction` AdvancedRedactionConfig: Advanced secret redaction settings (base64-encoded, split, prefix leaks) - `enabled` boolean: Enable advanced redaction checks - `detect_base64_encoded` boolean: Detect base64-encoded vault secrets - `detect_split_secrets` boolean: Detect secrets split across tokens or messages - `detect_prefix_leak` boolean: Detect partial/prefix leaks of vault secrets - `min_secret_length` integer: Minimum secret length to consider for advanced matching - `semantic_policy` SemanticPolicy: Semantic/intent-level policy enforcement - `enabled` boolean: Enable semantic policy enforcement - `allowed_topics` string[]: Topics the agent is allowed to discuss (empty = all) - `denied_topics` string[]: Topics to block - `allowed_tasks` string[]: Tasks the agent is allowed to perform (empty = all) - `denied_tasks` string[]: Tasks to block (e.g., code_generation, data_export) - `action` 'block' | 'sanitize' | 'warn' | 'log': Action when semantic policy is violated - `flagged_request_retention_days` integer: Number of days to retain flagged request bodies for replay/investigation - `streaming_inspection_mode` 'rolling' | 'holdback': How streamed LLM responses are inspected before release. `rolling` (default) releases text behind a tail buffer at least as long as the org's longest vault secret (capped at 256 bytes; longer secrets are matched by prefix); `holdback` buffers `streaming_holdback_chars` for full parity with buffered inspection. Tool-call deltas are always held until the call is complete. - `streaming_holdback_chars` integer: Characters held back per stream in holdback mode (default 512) - `max_concurrent_streams` integer: Open streaming responses allowed per agent key (default 20; 429 with Retry-After beyond it) - `system_prompt` string: Default system prompt for agent chat when requests do not override it. - `execution_intents_enabled` boolean: Whether Execution Intents (bindings and execute endpoint) are enabled for this agent - `execution_guardrails` object: Guardrails applied to all execution intents for this agent - `intents_require_tee` boolean: When true, transaction/sign requests must arrive via a TEE host (Pro+ only) - `execution_require_tee` boolean: When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only) - `tx_max_per_day` integer, nullable: Max transactions per UTC calendar day. Null = unlimited. - `tx_overhead_budget` object, nullable: Per-chain daily overhead budget in native units. - `solana_ata_allowlist` string[]: Solana wallet addresses whose ATAs may be created. - `cards_enabled` boolean: Whether this agent may order payment cards (x402 card ordering). - `card_max_order_usd` string: Maximum USD amount for a single card order. - `card_daily_limit_usd` string: Maximum cumulative USD spent ordering cards per rolling 24h window. - `usdc_daily_limit_usd` string: One cap across ALL of this agent's x402 stablecoin spend — POST /v1/pay and card orders together. Calendar day, UTC. Omit for no cap. Applied **in addition to** the per-route caps, never instead of them: `tx_*` bounds signing and submitting, `pay_*` bounds POST /v1/pay, and `card_*` bounds card orders. None of those three bounds the others, so this is the only field that caps an agent's total stablecoin spend. - `card_payto_allowlist` string[]: Allowed x402 payTo recipients for card orders (empty = built-in Laso recipients). - `card_reveal_enabled` boolean: Whether agents may reveal card details subject to per-card reveal policy. - `card_require_approval` boolean: When true, card orders route through the human approval queue before x402 payment. - `tx_approval_policy` object, nullable: Graduated transaction approval policy (HITL thresholds). - `action_approval_policy` object, nullable: Which business actions this agent must ask a human about, and above what amount. `{}` means no per-action rules. Shape: `{ "default_mode": "deny|approve|allow", "rules": [ { "action_type": "refund.create", "mode": "approve", "require_for_amount_above_usd": "50", "summary_template": "Refund {{amount_usd}} to {{customer_email}}" } ] }`. A rule can only raise the bar. Editing this is classified as a guardrail widening, so it routes through the same approval flow as loosening a transaction limit. Malformed rules are rejected on write rather than ignored at request time. - `typed_data_policy` 'deny' | 'approve', nullable - `simulation_failure_policy` 'deny' | 'approve', nullable - `tx_block_unlimited_approvals` boolean: Block unlimited ERC-20 approvals. - `tx_per_recipient_max_per_day` integer, nullable - `tx_per_recipient_daily_limit` string, nullable - `new_recipient_cap_native` string, nullable - `tx_max_value_usd` string, nullable - `tx_daily_limit_usd` string, nullable - `raw_signing_policy` 'allow' | 'deny' | 'approve' - `personal_sign_policy` object, nullable - `allow_erc4337` boolean - `allow_eip7702` boolean - `auto_suspended` boolean: True when circuit breaker auto-suspended the agent after repeated guardrail denials. - `tx_count_today` integer: Today's transaction count (UTC calendar day). Present when intents_api_enabled. - `tx_overhead_today_by_chain` object: Today's overhead spend by chain in native units. - `federation_enabled` boolean: Whether this agent may mint OIDC federation tokens via POST /v1/auth/federated-token. False by default. - `federation_audiences` string[]: Allowlist of audience URIs the agent may federate to. - `federated_token_ttl_seconds` integer, nullable: Per-agent TTL override for federation tokens (60..=3600). - `signing_chains` string[]: Chains for which this agent has provisioned signing keys. - `eip712_domain_allowlist` object[]: JSON array of allowed EIP-712 domain entries. - `eip712_default_policy` 'deny' | 'allow': Default EIP-712 policy (deny blocks all unless allowlisted). - `message_signing_enabled` boolean: Whether EIP-191 personal_sign is enabled. - `raw_signing_enabled` boolean: Whether the raw/precomputed-digest signing intent (eip712_digest) is enabled. Blind signing — bypasses transaction guardrails; OFF by default and human-set. Required for ERC-1271/ERC-7739 flows (e.g. Polymarket). - `tx_token_allowlist` string[]: Token contract/mint addresses this agent may interact with. - `tx_known_tokens_only` boolean: When true, only tokens in the known_tokens registry may be used. - `xrpl_allowed_tx_types` string[]: Allowed XRP Ledger transaction types. - `per_chain_guardrails` object: Per-chain guardrail overrides. - `tx_spent_today_by_chain` object: Per-chain-family daily spend in native major units (keys: evm, bitcoin, solana, xrp, cardano, tron). - `api_key_expires_at` string, date-time, nullable: Optional expiration time for the agent's API key. - `evm_address` string, nullable: Agent's Ethereum EOA address (used as Safe signer for smart accounts and Intents API). - `created_at` string, date-time, required - `expires_at` string, date-time - `last_active_at` string, date-time - `smart_accounts` AgentSmartAccountResponse[]: Multi-chain; one Safe per chain - `id` string, uuid - `chain` string - `chain_id` integer - `safe_address` string - `nonce` string - `init_data` object - `created_at` string, date-time - `environment` string, nullable: Named environment this agent belongs to (production, preview, development, or custom). - `environment_locked` boolean: When true, the environment tag is locked and cannot be changed. - `env_auto_resolve` boolean: When true, env var resolve endpoints auto-fill environment from this agent's tag. - `per_environment_guardrails` object: Per-environment guardrail overrides keyed by environment slug. - `address_screening_policy` object: Recipient address screening policy. `mode` may be `off`, `deny`, or `approve`. ## Other responses - `400`: Invalid request - `403`: Insufficient permissions - `404`: Resource not found --- [API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)