docs(quotes): document that quote create and execute require TRANSACT

[DhruvPareek]

Summary

Neither POST /quotes nor POST /quotes/{quoteId}/execute stated which token permission it requires, and neither documented a 403 for a permission refusal on execute.

Execute is the one worth spelling out. Its description covers Grid-Wallet-Signature in detail for EMBEDDED_WALLET sources, which reads as though the signature is the whole authorization story. It isn't: the signature proves the wallet holder approved the payment, while TRANSACT is what authorizes your integration to release it. An integrator building a read-only service could reasonably conclude a VIEW token plus a signature was a supported way to execute.

Changes

• openapi/paths/quotes/quotes_{quoteId}_execute.yaml — state the TRANSACT requirement and how it relates to Grid-Wallet-Signature; add the 403
• openapi/paths/quotes/quotes.yaml — state the TRANSACT requirement (a quote is the instrument execute draws on, and immediatelyExecute moves funds in the same request); extend the existing 403 description, which previously named only the End User Terms case
• Regenerated bundles via make build: openapi.yaml, mintlify/openapi.yaml

Verification

• make build — bundles regenerate cleanly; the bundle diff is exactly these four additions, no reformatting of unrelated paths
• make lint — "Woohoo! Your API description is valid.", 0 errors (pre-existing warnings/infos on unrelated beneficiary schemas only)

Original PR: #842

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored		Aug 18, 2026 8:20pm
grid-wallet-demo	Ignored		Aug 18, 2026 8:20pm

[lightspark-bot]

• docs(quotes): document that quote create and execute require TRANSACT #843 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli

chore(internal): regenerate SDK with no functional changes

go

docs(api): document permission requirements in quote methods

kotlin

docs(api): document TRANSACT permission requirement for quotes methods

openapi

docs(api): add TRANSACT permission requirements to quotes endpoints

php

docs(api): clarify TRANSACT permission requirements for quotes create and execute

python

docs(api): document TRANSACT permission requirements for quotes create/execute

ruby

docs(api): clarify permission requirements for quotes create and execute methods

typescript

docs(api): add permission requirements to quotes create and execute methods

⚠️ grid-openapi studio · code

Your SDK build had at least one "warning" diagnostic.
generate ⚠️

⚠️ grid-ruby studio · code

Your SDK build had at least one "warning" diagnostic.
generate ⚠️ → build ✅ → lint ✅ → test ✅

⚠️ grid-go studio · code

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ⚠️ → build ✅ → lint ❗ → test ❗

go get github.com/stainless-sdks/grid-go@5c5e9450f1f1c6f6c6d8d245590de34eaf975794

⚠️ grid-kotlin studio · code

Your SDK build had a failure in the test CI job, which is a regression from the base state.
generate ⚠️ → build ✅ → lint ✅ → test ❗

⚠️ grid-typescript studio · conflict

Your SDK build had at least one warning diagnostic.

⚠️ grid-python studio · code

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ⚠️ → build ✅ → lint ❗ → test ❗

pip install https://pkg.stainless.com/s/grid-python/5a2384d0c9d7ae0f7d96f3fd18faaa0ba1fcc7c4/grid-0.0.1-py3-none-any.whl

⚠️ grid-php studio · code

Your SDK build had at least one "warning" diagnostic.
generate ⚠️ → lint ✅ → test ✅

⚠️ grid-cli studio · code

Your SDK build had a failure in the test CI job, which is a regression from the base state.
generate ⚠️ → build ⏭️ → lint ⏭️ → test ❗

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-08-21 20:06:52 UTC

[greptile-apps]

Greptile Summary

The PR clarifies that quote creation and execution require TRANSACT, distinguishes that permission from Embedded Wallet signature authorization, and documents the relevant forbidden responses.

• Adds the permission requirement to both quote operations.
• Expands quote creation’s existing 403 description and adds a documented 403 response to execution.
• Keeps the root and Mintlify OpenAPI bundles synchronized with the modular source files.

Confidence Score: 5/5

The PR appears safe to merge.

The source specifications and both generated bundles remain synchronized, and the added permission and error-response documentation is internally consistent with the shared OpenAPI contracts.

Important Files Changed

Filename	Overview
openapi/paths/quotes/quotes.yaml	Accurately documents the TRANSACT requirement and broadens the existing 403 description while reusing Error403.
openapi/paths/quotes/quotes_{quoteId}_execute.yaml	Clarifies the distinct token and wallet-holder authorization requirements and adds a schema-consistent 403 response.
openapi.yaml	Generated bundle faithfully mirrors the quote source-file changes.
mintlify/openapi.yaml	Mintlify’s generated OpenAPI copy remains identical to the root bundle.

_{Reviews (1): Last reviewed commit: "docs(quotes): document that quote create..." | Re-trigger Greptile}

[DhruvPareek]

sparkcore change to go w this https://app.graphite.com/github/pr/lightsparkdev/webdev/32950?panel=timeline&pnid=eAjcpaGYNaMRnaRaRu1M#file-sparkcore/sparkcore/grid/api_handlers/execute_quote.py

[DhruvPareek]

Merge activity

• Aug 21, 8:01 PM UTC: @DhruvPareek merged this pull request with Graphite.