modify /quotes and /quote/{quoteId}/execute for Embedded Wallet transfers

.stainless/stainless.yml

@@ -730,6 +730,7 @@ openapi:
           - "$.components.schemas.PaymentPolygonWalletInfo.allOf[0]"
           - "$.components.schemas.PaymentBaseWalletInfo.allOf[0]"
           - "$.components.schemas.PaymentEthereumWalletInfo.allOf[0]"
+          - "$.components.schemas.PaymentEmbeddedWalletInfo.allOf[0]"
         keys: [ "$ref" ]
 
     # ── Remove $ref to BaseExternalAccountInfo from external account variants ──

openapi/components/schemas/common/PaymentAccountType.yaml

@@ -25,5 +25,6 @@ enum:
   - POLYGON_WALLET
   - BASE_WALLET
   - ETHEREUM_WALLET
+  - EMBEDDED_WALLET
 description: Type of payment account or wallet
 example: USD_ACCOUNT

openapi/components/schemas/common/PaymentEmbeddedWalletInfo.yaml

@@ -0,0 +1,23 @@
+title: Embedded Wallet
+allOf:
+  - $ref: ./BasePaymentAccountInfo.yaml
+  - type: object
+    required:
+      - accountType
+      - payloadToSign
+    properties:
+      accountType:
+        type: string
+        enum:
+          - EMBEDDED_WALLET
+        description: Discriminator value identifying this as Embedded Wallet payment instructions.
+      payloadToSign:
+        type: string
+        description: >-
+          JSON-encoded transaction signing payload that must be signed, as-is
+          (byte-for-byte, without re-serialization), with the session private
+          key of a verified authentication credential on the source Embedded
+          Wallet. The resulting signature is base64-encoded and passed as the
+          `Grid-Wallet-Signature` header on `POST /quotes/{quoteId}/execute`
+          to authorize the outbound transfer from the wallet.
+        example: '{"type":"ACTIVITY_TYPE_SIGN_TRANSACTION_V2","timestampMs":"1746736509954","organizationId":"org_abc123","parameters":{"signWith":"wallet_abc123def456","unsignedTransaction":"ea69b4bf05f775209f26ff0a34a05569180f7936579d5c4af9377ae550194f72","type":"TRANSACTION_TYPE_ETHEREUM"},"generateAppProofs":true}'

openapi/components/schemas/common/PaymentInstructions.yaml

@@ -57,6 +57,7 @@ properties:
     - $ref: ../common/PaymentPolygonWalletInfo.yaml
     - $ref: ../common/PaymentBaseWalletInfo.yaml
     - $ref: ../common/PaymentEthereumWalletInfo.yaml
+    - $ref: ../common/PaymentEmbeddedWalletInfo.yaml
     discriminator:
       propertyName: accountType
       mapping:
@@ -103,3 +104,4 @@ properties:
         HTG_ACCOUNT: ../common/PaymentHtgAccountInfo.yaml
         JMD_ACCOUNT: ../common/PaymentJmdAccountInfo.yaml
         PKR_ACCOUNT: ../common/PaymentPkrAccountInfo.yaml
+        EMBEDDED_WALLET: ../common/PaymentEmbeddedWalletInfo.yaml

openapi/components/schemas/quotes/QuoteRequest.yaml

@@ -42,6 +42,13 @@ properties:
 
       This can only be used for quotes with a `source` which is either an internal account,
       or has direct pull functionality (e.g. ACH pull with an external account).
+
+      Not supported when the `source` is an internal account of type
+      `EMBEDDED_WALLET`: those transfers require a `Grid-Wallet-Signature`
+      over the `payloadToSign` returned in the quote response, which is not
+      available in a combined create-and-execute call. Create the quote
+      first with `immediatelyExecute: false` and then call
+      `POST /quotes/{quoteId}/execute` with the signature header.
     example: false
   description:
     type: string

openapi/paths/quotes/quotes_{quoteId}_execute.yaml

@@ -7,6 +7,12 @@ post:
     This endpoint can only be used for quotes with a `source` which is either an internal account,
     or has direct pull functionality (e.g. ACH pull with an external account).
 
+    When the quote's `source` is an internal account of type `EMBEDDED_WALLET`,
+    the request must include a `Grid-Wallet-Signature` header. The signature is
+    produced by signing the `payloadToSign` value from the quote's
+    `paymentInstructions[].accountOrWalletInfo` entry with the session private
+    key of a verified authentication credential on the source Embedded Wallet.
+
     Once executed, the quote cannot be cancelled and the transfer will be processed.
   operationId: executeQuote
   tags:
@@ -30,6 +36,19 @@ post:
       schema:
         type: string
         example: <uuid>
+    - name: Grid-Wallet-Signature
+      in: header
+      required: false
+      description: >-
+        Signature over the `payloadToSign` returned in the quote's
+        `paymentInstructions[].accountOrWalletInfo` entry, produced with the
+        session private key of a verified authentication credential on the
+        source Embedded Wallet and base64-encoded. Required when the quote's
+        source is an internal account of type `EMBEDDED_WALLET`; ignored for
+        other source types.
+      schema:
+        type: string
+      example: MEUCIQDx7k2N0aK4p8f3vR9J6yT5wL1mB0sXnG2hQ4vJ8zYkCgIgZ4rP9dT7eWfU3oM6KjR1qSpNvBwL0tXyA2iG8fH5dE=
   responses:
     '200':
       description: >
@@ -47,7 +66,11 @@ post:
           schema:
             $ref: ../../components/schemas/errors/Error400.yaml
     '401':
-      description: Unauthorized
+      description: >-
+        Unauthorized. Also returned when the quote's source is an internal
+        account of type `EMBEDDED_WALLET` and the provided
+        `Grid-Wallet-Signature` header is missing, malformed, or does not
+        match the quote's `payloadToSign`.
       content:
         application/json:
           schema:
@@ -70,5 +93,3 @@ post:
         application/json:
           schema:
             $ref: ../../components/schemas/errors/Error500.yaml
-
-