Browser Bridge

Authorise one credential fill. Requires the bridge credential *and* an agent JWT — neither alone is sufficient.

post/v1/agents/{id}/browser/fills

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/agents/{id}/browser/fills
  • Auth: HTTP bearer

Headers

x-1claw-bridge-credentialstring required
x-1claw-bridge-versionstring required

Request body

session_idstring uuid required

Must match the session the presented bs_ token opened.

binding_idstring uuid required
frame_idstring required

The target the fill is for. Recorded on the grant.

generationinteger required

The bridge's navigation counter. Compared again at consume: a navigation in between means the page decided about is no longer the page in front of the bridge.

form_action_originstring

Where the form would POST. Checked as well as the two origins — a login form on an allowed page can still submit to somebody else's host. Absent is not treated as 'same as the tab'; it denies.

form_pathstring required

Path of the form being filled, checked against the binding's fingerprint.

field_namesstring[] required

Field names on that form. Every field the fingerprint expects must be present; extra fields are fine, since sites add hidden inputs.

redirect_chainstring[] required

Hosts the login has redirected through, in order. Each is checked against the binding's allowed hosts union its sso hosts.

current_generationinteger required

The target's generation now. A mismatch with generation means the page moved and the fill is denied.

tab_originstring required

Origin of the tab being driven. Checked against the binding's allowed and sso hosts by exact host match.

frame_originstring required

Origin of the frame holding the form. Checked separately — a credential typed into an allowed tab can still land in an attacker's iframe.

Response

A grant, a denial, or a pending approval. Never a secret.

kind'grant'
grant_idstring uuid

Single-use, short-lived, redeemable only by the session it was issued to.

binding_idstring uuid
expires_atstring date-time
login_urlstring

The bridge navigates here itself. An agent-supplied URL would be the agent choosing who receives the password.

Changes

No recorded changes to this operation across all 1 revision of this API.