generated: '2026-07-18'
method: derived
source: openapi/cubist-cubesigner-openapi-original.json
format: custom-json
envelope:
  schema: ErrorResponse
  fields:
    error_code: Machine-readable SignerErrorCode (one of the class enums below)
    message: Human-readable error message
    accepted: Present when the operation requires MFA approval (HTTP 202) — carries the MfaRequired challenge
    policy_eval: Present on policy-denied signing requests — the policy evaluation tree explaining the
      denial
  content_type: application/json
notes: CubeSigner returns a structured ErrorResponse on the default response of every operation. error_code
  is a discriminated union (SignerErrorCode) grouped by HTTP status class. HTTP 202 with an accepted MfaRequired
  body is an approval challenge, not a failure.
error_classes:
- class: BadRequestErrorCode
  http_status: 400
  codes:
  - GenericBadRequest
  - DisallowedAllowRuleReference
  - InvalidPaginationToken
  - InvalidEmail
  - InvalidEmailTemplate
  - QueryMetricsError
  - InvalidTelegramData
  - ValidationError
  - WebhookPolicyTimeoutOutOfBounds
  - WebhookPolicyDisallowedUrlScheme
  - WebhookPolicyDisallowedUrlHost
  - WebhookPolicyDisallowedHeaders
  - ReservedName
  - UserEmailNotConfigured
  - EmailPasswordNotFound
  - PasswordAuthNotAllowedByInvitation
  - OneTimeCodeExpired
  - InvalidBody
  - InvalidJwt
  - InvitationNoLongerValid
  - TokenRequestError
  - InvalidMfaReceipt
  - InvalidMfaPolicyCount
  - InvalidMfaPolicyNumAuthFactors
  - InvalidMfaPolicyNumAllowedApprovers
  - InvalidMfaPolicyGracePeriodTooLong
  - InvalidBabylonStakingPolicyParams
  - InvalidSuiTxReceiversEmptyAllowlist
  - InvalidBtcTxReceiversEmptyAllowlist
  - InvalidRequireRoleSessionAllowlist
  - InvalidCreateKeyCount
  - InvalidDiffieHellmanCount
  - OrgInviteExistingUser
  - OrgUserAlreadyExists
  - OrgNameTaken
  - KwkNotFoundInRegion
  - OrgIsNotOrgExport
  - RoleNameTaken
  - PolicyNameTaken
  - NameTaken
  - ContactNameInvalid
  - ContactAddressesInvalid
  - ContactLabelInvalid
  - ContactModified
  - PolicyNotFound
  - PolicyVersionNotFound
  - PolicyRuleDisallowedByType
  - PolicyTypeDisallowed
  - PolicyDuplicateError
  - PolicyStillAttached
  - PolicyModified
  - PolicyNotAttached
  - AddKeyToRoleCountTooHigh
  - InvalidKeyId
  - InvalidTimeLockAlreadyInThePast
  - InvalidRestrictedScopes
  - InvalidUpdate
  - InvalidMetadataLength
  - InvalidLength
  - InvalidKeyMaterialId
  - KeyNotFound
  - SiweChallengeNotFound
  - SiweInvalidRequest
  - SiwsChallengeNotFound
  - SiwsInvalidRequest
  - UserExportDerivedKey
  - UserExportPublicKeyInvalid
  - NistP256PublicKeyInvalid
  - UnableToAccessSmtpRelay
  - UserExportInProgress
  - RoleNotFound
  - InvalidRoleNameOrId
  - InvalidMfaReceiptOrgIdMissing
  - InvalidMfaReceiptInvalidOrgId
  - MfaRequestNotFound
  - InvalidKeyType
  - InvalidPropertiesForKeyType
  - MismatchedKeyPropertiesPatch
  - MissingBinanceApiKey
  - MissingBybitApiKey
  - MissingCoinbaseApiKey
  - BinanceKeyMasterMismatch
  - BybitAccountMismatch
  - InvalidKeyMaterial
  - InvalidHexValue
  - InvalidBase32Value
  - InvalidBase58Value
  - InvalidBase64Value
  - InvalidSs58Value
  - InvalidForkVersionLength
  - InvalidEthAddress
  - InvalidStellarAddress
  - InvalidOrgNameOrId
  - InvalidUpdateOrgRequestDisallowedMfaType
  - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
  - EmailOtpDelayTooShortForRegisterMfa
  - InvalidStakeDeposit
  - InvalidBlobSignRequest
  - InvalidDiffieHellmanRequest
  - InvalidSolanaSignRequest
  - InvalidEip712SignRequest
  - InvalidEip7702SignRequest
  - OnlySpecifyOne
  - IncompatibleParams
  - NoOidcDataInProof
  - InvalidEvmSignRequest
  - InvalidEth2SignRequest
  - InvalidDeriveKeyRequest
  - InvalidStakingAmount
  - CustomStakingAmountNotAllowedForWrapperContract
  - InvalidUnstakeRequest
  - InvalidCreateUserRequest
  - UserAlreadyExists
  - IdpUserAlreadyExists
  - CognitoUserAlreadyOrgMember
  - UserNotFound
  - UserWithEmailNotFound
  - PolicyKeyMismatch
  - EmptyScopes
  - InvalidScopesForRoleSession
  - InvalidLifetime
  - NoSingleKeyForUser
  - InvalidOrgPolicyRule
  - SourceIpAllowlistEmpty
  - LimitWindowTooLong
  - Erc20ContractDisallowed
  - EmptyRuleError
  - PolicyFieldValidationError
  - OptionalListEmpty
  - MultipleExclusiveFieldsProvided
  - DuplicateFieldEntry
  - InvalidRange
  - InvalidOrgPolicyRepeatedRule
  - InvalidSuiTransaction
  - SuiSenderMismatch
  - AvaSignHashError
  - AvaSignError
  - BtcSegwitHashError
  - BtcTaprootHashError
  - BtcSignError
  - TaprootSignError
  - Eip712SignError
  - InvalidMemberRoleInUserAdd
  - InvalidMemberRoleInRecipientAdd
  - ThirdPartyUserAlreadyExists
  - OidcIdentityAlreadyExists
  - UserAlreadyHasIdentity
  - ThirdPartyUserNotFound
  - DeleteOidcUserError
  - DeleteUserError
  - SessionRoleMismatch
  - InvalidOidcToken
  - InvalidOidcIdentity
  - OidcIssuerUnsupported
  - OidcIssuerNotAllowed
  - OidcIssuerNoApplicableJwk
  - FidoKeyAlreadyRegistered
  - FidoKeySignCountTooLow
  - FidoVerificationFailed
  - FidoChallengeMfaMismatch
  - UnsupportedLegacyCognitoSession
  - InvalidIdentityProof
  - PaginationDataExpired
  - ExistingKeysViolateExclusiveKeyAccess
  - ExportDelayTooShort
  - ExportWindowTooLong
  - InvalidTotpFailureLimit
  - InvalidEip191SignRequest
  - CannotResendUserInvitation
  - InvalidNotificationEndpointCount
  - CannotDeletePendingSubscription
  - InvalidNotificationUrlProtocol
  - EmptyOneOfOrgEventFilter
  - EmptyAllExceptOrgEventFilter
  - InvalidTapNodeHash
  - InvalidOneTimeCode
  - MessageNotFound
  - MessageAlreadySigned
  - MessageRejected
  - MessageReplaced
  - InvalidMessageType
  - EmptyAddress
  - InvalidEth2SigningPolicySlotRange
  - InvalidEth2SigningPolicyEpochRange
  - InvalidEth2SigningPolicyTimestampRange
  - InvalidEth2SigningPolicyOverlappingRule
  - RpcUrlMissing
  - MmiChainIdMissing
  - EthersInvalidRpcUrl
  - EthersGetTransactionCountError
  - InvalidPassword
  - BabylonStakingFeePlusDustOverflow
  - BabylonStaking
  - BabylonStakingIncorrectKey
  - BabylonStakingSegwitNonDeposit
  - BabylonStakingRegistrationRequiresTaproot
  - PsbtSigning
  - TooManyResets
  - TooManyRequests
  - TooManyFailedLogins
  - BadBtcMessageSignP2shFlag
  - InvalidTendermintRequest
  - PolicyVersionMaxReached
  - PolicyVersionInvalid
  - PolicySecretLimitReached
  - PolicySecretTooLarge
  - InvalidImportKey
  - AlienOwnerInvalid
  - EmptyUpdateRequest
  - InvalidPolicyReference
  - PolicyEngineDisabled
  - InvalidWasmPolicy
  - CelProgramTooLarge
  - InvalidPolicy
  - RedundantDerivationPath
  - ImportKeyMissing
  - InvalidAbiMethods
  - BabylonCovSign
  - InvalidPolicyLogsRequest
  - UserProfileMigrationMultipleEntries
  - UserProfileMigrationTooManyItems
  - InputTooShort
  - InvalidTweakLength
  - InvalidCustomChains
  - InvalidRpcRequest
- class: UnauthorizedErrorCode
  http_status: 401
  codes:
  - AuthorizationHeaderMissing
  - EndpointRequiresUserSession
  - RefreshTokenMissing
- class: ForbiddenErrorCode
  http_status: 403
  codes:
  - AlienKeyCreate
  - CannotAssumeIdentity
  - SentryDisallowed
  - PasskeyLoginDisabled
  - PasskeyNotRegistered
  - CannotCreateOrg
  - WrongMfaEmailOtpJwt
  - OrgFlagNotSet
  - FidoRequiredToRemoveTotp
  - OidcIdentityLimitReached
  - OidcScopeCeilingMissing
  - OidcIssuerNotAllowedForMemberRole
  - OidcNoMemberRolesAllowed
  - EmailOtpNotConfigured
  - MfaChallengeExpired
  - ChainIdNotAllowed
  - InvalidOrg
  - OrgIdMismatch
  - SessionForWrongOrg
  - SelfDelete
  - SelfDisable
  - SelfMfaReset
  - InvalidOrgMembershipRoleChange
  - UserDisabled
  - OrgDisabled
  - OrgNotFound
  - OrgWithoutOwner
  - OrphanedUser
  - OidcUserNotFound
  - UserNotInOrg
  - UserNotOrgOwner
  - UserNotKeyOwner
  - InvalidRole
  - DisabledRole
  - KeyDisabled
  - KeyNotInRole
  - ContactNotInOrg
  - UserExportRequestNotInOrg
  - UserExportRequestInvalid
  - UserExportDisabled
  - UserNotOriginalKeyOwner
  - UserNotInRole
  - MustBeFullMember
  - SessionExpired
  - SessionChanged
  - SessionRevoked
  - ExpectedUserSession
  - SessionRoleChanged
  - ScopedNameNotFound
  - SessionInvalidEpochToken
  - SessionInvalidRefreshToken
  - SessionRefreshTokenExpired
  - InvalidAuthHeader
  - SessionNotFound
  - InvalidArn
  - SessionInvalidAuthToken
  - SessionAuthTokenExpired
  - SessionPossiblyStolenToken
  - MfaDisallowedIdentity
  - MfaDisallowedApprover
  - MfaTypeNotAllowed
  - MfaNotApprovedYet
  - MfaConfirmationCodeMismatch
  - MfaHttpRequestMismatch
  - MfaRemoveBelowMin
  - MfaOrgRequirementNotMet
  - MfaRegistrationDisallowed
  - TotpAlreadyConfigured
  - TotpConfigurationChanged
  - MfaTotpBadConfiguration
  - MfaTotpBadCode
  - MfaTotpRateLimit
  - ImproperSessionScope
  - FullSessionRequired
  - SessionWithoutAnyScopeUnder
  - UserRoleUnprivileged
  - MemberRoleForbidden
  - MfaNotConfigured
  - RemoveLastOidcIdentity
  - OperationNotAllowed
  - OrgExportRetrievalDisabled
  - ChangingKeyExportRequirementIsDisabled
  - AutoAddBlsKeyToProtectedRole
  - UserNotPolicyOwner
  - UserNotContactOwner
  - UserNotBucketOwner
  - LegacySessionCannotHaveScopeCeiling
  - RoleInParentOrgNotAllowed
  - RemoveKeyFromRoleUserNotAllowed
  - SiweChallengeExpired
  - SiweMessageNotValid
  - SiweMessageInvalidSignature
  - SiwsChallengeExpired
  - SiwsDomain
  - SiwsMessageInvalid
  - Acl
- class: NotFoundErrorCode
  http_status: 404
  codes:
  - UriSegmentMissing
  - UriSegmentInvalid
  - TotpNotConfigured
  - FidoKeyNotFound
  - FidoChallengeNotFound
  - TotpChallengeNotFound
  - UserExportRequestNotFound
  - UserExportCiphertextNotFound
  - OrgExportCiphertextNotFound
  - UploadObjectNotFound
  - PolicySecretNotFound
  - BucketMetaNotFound
  - TimestreamDisabled
  - CustomChainNotFound
  - InvitationNotFound
  - TransactionNotFound
  - EmailConfigNotFound
- class: ConflictErrorCode
  http_status: 409
  codes:
  - ConcurrentRequestDisallowed
  - ConcurrentLockCreation
- class: PreconditionErrorOwnCodes
  http_status: 412
  codes:
  - FailOnMfaRequired
  - KeyRegionLocked
  - KeyRegionChangedRecently
  - MfaRegionLocked
  - Eth2ProposerSlotTooLow
  - Eth2AttestationSourceEpochTooLow
  - Eth2AttestationTargetEpochTooLow
  - Eth2ConcurrentBlockSigning
  - Eth2ConcurrentAttestationSigning
  - Eth2MultiDepositToNonGeneratedKey
  - Eth2MultiDepositUnknownInitialDeposit
  - Eth2MultiDepositWithdrawalAddressMismatch
  - ConcurrentSigningWhenTimeLimitPolicyIsDefined
  - BabylonEotsConcurrentSigning
  - TendermintStateError
  - TendermintConcurrentSigning
  - MfaApprovalsNotYetValid
- class: TimeoutErrorCode
  http_status: 408
  codes:
  - PolicyEngineTimeout
  - WasmPolicyExecutionTimeout
- class: BadGatewayErrorCode
  http_status: 502
  codes:
  - Generic
  - CustomChainRpcError
  - EsploraApiError
  - SentryApiError
  - CallWebhookError
  - OAuthProviderError
  - OidcDisoveryFailed
  - OidcIssuerJwkEndpointUnavailable
  - SmtpServerUnavailable
- class: InternalErrorCode
  http_status: 500
  codes:
  - NoMaterialId
  - InvalidAuditLogEntry
  - UnexpectedCheckerRule
  - UnresolvedPolicyReference
  - UnexpectedAclAction
  - FidoKeyAssociatedWithMultipleUsers
  - ClaimsParseError
  - InvalidThrottleId
  - InvalidEmailAddress
  - EmailTemplateRender
  - OidcIdentityHeaderMissing
  - OidcIdentityParseError
  - SystemTimeError
  - PasswordHashParseError
  - SendMailError
  - ReqwestError
  - EmailConstructionError
  - TsWriteError
  - TsQueryError
  - DbQueryError
  - DbGetError
  - DbDeleteError
  - DbPutError
  - DbUpdateError
  - SerdeError
  - TestAndSetError
  - DbGetItemsError
  - DbWriteError
  - CubistSignerError
  - CwListMetricsError
  - CwPutMetricDataError
  - GetAwsSecretError
  - SecretNotFound
  - KmsGenerateRandomError
  - MalformedTotpBytes
  - KmsGenerateRandomNoResponseError
  - CreateKeyError
  - ParseDerivationPathError
  - SplitSignerError
  - CreateImportKeyError
  - CreateEotsNoncesError
  - EotsSignError
  - BabylonCovSignError
  - CognitoDeleteUserError
  - CognitoListUsersError
  - CognitoGetUserError
  - MissingUserEmail
  - CognitoResendUserInvitation
  - CognitoSetUserPasswordError
  - GenericInternalError
  - AssumeRoleWithoutEvidence
  - OidcAuthWithoutOrg
  - MissingKeyMetadata
  - KmsEnableKeyError
  - KmsDisableKeyError
  - LambdaInvokeError
  - LambdaNoResponseError
  - LambdaFailure
  - LambdaUnparsableResponse
  - SerializeEncryptedExportKeyError
  - DeserializeEncryptedExportKeyError
  - ReEncryptUserExport
  - S3UploadError
  - S3DownloadError
  - S3CopyError
  - S3ListObjectsError
  - S3DeleteObjectsError
  - S3BuildError
  - S3PresignedUrlError
  - ManagedStateMissing
  - InternalHeaderMissing
  - InvalidInternalHeaderValue
  - RequestLocalStateAlreadySet
  - OidcOrgMismatch
  - OidcIssuerInvalidJwk
  - InvalidPkForMaterialId
  - SegwitTweakFailed
  - UncheckedOrg
  - SessionOrgIdMissing
  - AvaSignCredsMissing
  - AvaSignSignatureMissing
  - ExpectedRoleSession
  - InvalidThirdPartyIdentity
  - CognitoGetUser
  - SnsSubscribeError
  - SnsUnsubscribeError
  - SnsGetSubscriptionAttributesError
  - SnsSubscriptionAttributesMissing
  - SnsSetSubscriptionAttributesError
  - SnsPublishBatchError
  - InconsistentMultiValueTestAndSet
  - MaterialIdError
  - InvalidBtcAddress
  - HistoricalTxBodyMissing
  - InvalidOperation
  - ParentOrgNotFound
  - OrgParentLoop
  - ResolvedParentOrgWithNoScopeCeiling
  - InvalidUploadObjectId
  - PolicyEngineNotFound
  - PolicyEngineError
  - PolicySecretsEncryptionError
  - CreatePolicyImportKeyError
  - InvalidAlias
  - EmptyUpdateModifiedObject
  - EmptyUpdateModifiedActions
  - DbContactAddressesInvalid
  - InvalidEvmSigedRlp
  - InvalidErc20Data
  - InvalidRpcUrl
- class: PolicyErrorOwnCodes
  http_status: 403
  codes:
  - Inapplicable
  - SuiTxReceiversDisallowedTransactionKind
  - SuiTxReceiversDisallowedTransferAddress
  - SuiTxReceiversDisallowedCommand
  - BtcTxDisallowedOutputs
  - BtcSignatureExceededValue
  - BtcValueOverflow
  - BtcSighashTypeDisallowed
  - Eip7702AddressMismatch
  - EvmTxReceiverMismatch
  - EvmTxChainIdMismatch
  - EvmTxSenderMismatch
  - EvmTxExceededValue
  - EvmTxExceededGasCost
  - EvmTxGasCostUndefined
  - EvmDataDisallowed
  - Erc20DataInvalid
  - EvmContractAddressUndefined
  - EvmContractChainIdUndefined
  - EvmDataNotDefined
  - EvmDataInvalid
  - EvmContractNotInAllowlist
  - Erc20ExceededTransferLimit
  - Erc20ReceiverMismatch
  - Erc20ExceededApproveLimit
  - Erc20SpenderMismatch
  - EvmFunctionNotInAllowlist
  - EvmFunctionCallInvalid
  - EvmFunctionCallDisallowedArg
  - PolicyDisjunctionError
  - PolicyNegationError
  - Eth2ExceededMaxUnstake
  - Eth2ConcurrentUnstaking
  - NotInIpv4Allowlist
  - NotInOriginAllowlist
  - NotInOperationAllowlist
  - InvalidSourceIp
  - RawSigningNotAllowed
  - DiffieHellmanExchangeNotAllowed
  - Eip712SigningNotAllowed
  - OidcSourceNotAllowed
  - NoOidcAuthSourcesDefined
  - AddKeyToRoleDisallowed
  - KeysAlreadyInRole
  - KeyInMultipleRoles
  - KeyAccessError
  - RequireRoleSessionKeyAccessError
  - BtcMessageSigningNotAllowed
  - Eip191SigningNotAllowed
  - Eip7702SigningNotAllowed
  - TaprootSigningDisallowed
  - SegwitSigningDisallowed
  - PsbtSigningDisallowed
  - BabylonStakingDisallowed
  - TimeLocked
  - CelPolicyDenied
  - BabylonStakingNetwork
  - BabylonStakingParamsVersion
  - BabylonStakingExplicitParams
  - BabylonStakingStakerPk
  - BabylonStakingFinalityProviderPk
  - BabylonStakingLockTime
  - BabylonStakingValue
  - BabylonStakingChangeAddress
  - BabylonStakingFee
  - BabylonStakingWithdrawalAddress
  - BabylonStakingBbnAddress
  - SolanaInstructionCountLow
  - SolanaInstructionCountHigh
  - SolanaNotInInstructionAllowlist
  - SolanaInstructionMismatch
  - WasmPoliciesDisabled
  - WasmPolicyDenied
  - WasmPolicyFailed
  - WebhookPoliciesDisabled
  - DeniedByWebhook
  - ExplicitlyDenied
- class: RpcApiErrorOwnCodes
  http_status: 400
  codes:
  - MfaRequired
  - ConcurrentTransactionFailed
  - InvalidTxStatus
total_error_codes: 561