openapi: 3.0.3
info:
  title: CubeSigner Account Keys API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Keys
paths:
  /v0/org/{org_id}/derive_key:
    put:
      tags:
      - Keys
      summary: Derive Key From Long-Lived Mnemonic
      description: 'Derive Key From Long-Lived Mnemonic


        Derives a key of a specified type using a supplied derivation path and an

        existing long-lived mnemonic.'
      operationId: deriveKeyLegacy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeriveKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/derive_keys:
    put:
      tags:
      - Keys
      summary: Derive Key From New Or Existing Long-Lived Mnemonic
      description: 'Derive Key From New Or Existing Long-Lived Mnemonic


        Uses either a new or existing long-lived mnemonic to derive keys of

        one or more specified types via specified derivation paths.'
      operationId: deriveKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeriveKeysRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/export/{key_id}:
    get:
      tags:
      - Keys
      summary: Get an Org-Export Ciphertext
      description: 'Get an Org-Export Ciphertext


        Returns the export ciphertext associated with the provided key-id.

        In order to use this API, you must be an org owner and your org must

        be configured for org export and for API-based export delivery.'
      operationId: getOrgExport
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/OrgExportResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:export:org:get
  /v0/org/{org_id}/import_key:
    get:
      tags:
      - Keys
      summary: Create Key-Import Key
      description: 'Create Key-Import Key


        Generate an ephemeral key that a client can use for key-import encryption.'
      operationId: createKeyImportKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyImportKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:import
    put:
      tags:
      - Keys
      summary: Import Key
      description: 'Import Key


        Securely imports an existing key using a previously generated key-import key.'
      operationId: importKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ImportKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:import
  /v0/org/{org_id}/keys:
    get:
      tags:
      - Keys
      summary: List Keys
      description: 'List Keys


        Gets the list of accessible keys in a given org (to org owner, all org keys

        are accessible; to members, only their own keys are accessible).


        If a search condition is, the result will contain only the keys whose either

        material ID or metadata contain the search condition string.


        NOTE that if pagination is used and a page limit is set, the returned result

        set may contain either FEWER or MORE elements than the requested page limit.'
      operationId: listKeysInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      - name: key_type
        in: query
        description: Filter by key type
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/KeyType'
          nullable: true
        style: form
        example: SecpEthAddr
      - name: key_owner
        in: query
        description: Filter by key owner
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
        style: form
        example: User#5269c579-b4f9-4620-9e90-e46a5a0ffb4d
      - name: search
        in: query
        description: Search key metadata
        required: false
        schema:
          type: string
          nullable: true
        style: form
        example: some value
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListKeysResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:list
    post:
      tags:
      - Keys
      summary: Create Key
      description: 'Create Key


        Creates one or more new keys of the specified type.'
      operationId: createKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/keys/{key_id}:
    get:
      tags:
      - Keys
      summary: Get Key
      description: 'Get Key


        Returns the properties of a key.'
      operationId: getKeyInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:get
    delete:
      tags:
      - Keys
      summary: Delete Key
      description: 'Delete Key


        Deletes a key specified by its ID.


        Only the key owner and org owners are allowed to delete keys.

        Additionally, the role''s edit policy (if set) must permit the update.'
      operationId: deleteKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:delete
    patch:
      tags:
      - Keys
      summary: Update Key
      description: 'Update Key


        Enable or disable a key.  The user must be the owner of the key or

        organization to perform this action.


        For each requested update, the session must have the corresponding ''manage:key:update:_'' scope;

        if no updates are requested, the session must have ''manage:key:get''.'
      operationId: updateKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:update:enabled
        - manage:key:update:metadata
        - manage:key:update:policy
        - manage:key:update:owner
        - manage:key:update:editPolicy
  /v0/org/{org_id}/keys/{key_id}/attest:
    get:
      tags:
      - Keys
      summary: Attest to Key Properties
      description: 'Attest to Key Properties


        The response is a JWT whose claims are the key properties.'
      operationId: attestKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: include_roles
        in: query
        required: false
        schema:
          type: boolean
          nullable: true
      responses:
        '200':
          $ref: '#/components/responses/KeyInfoJwt'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:attest
  /v0/org/{org_id}/keys/{key_id}/roles:
    get:
      tags:
      - Keys
      summary: List Key Roles
      description: 'List Key Roles


        Get all roles the key is in'
      operationId: listKeyRoles
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListKeyRolesResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:list_roles
  /v0/org/{org_id}/keys/{key_id}/tx:
    get:
      tags:
      - Keys
      summary: List Historical Transactions
      description: 'List Historical Transactions


        Returns a sorted, paginated list of transactions signed by a given key,

        ordered from most recent first.'
      operationId: listHistoricalKeyTx
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListHistoricalTxResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:history:tx:list
  /v0/org/{org_id}/keys/{key_type}/{material_id}:
    get:
      tags:
      - Keys
      summary: Get Key by Material ID
      description: 'Get Key by Material ID


        Returns the properties of a key.'
      operationId: getKeyByMaterialId
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_type
        in: path
        description: Type of the key to look up
        required: true
        schema:
          type: string
      - name: material_id
        in: path
        description: Material ID of the key to look up
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:get
components:
  schemas:
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    ImportKeyRequestMaterial:
      type: object
      required:
      - ikm_enc
      - salt
      - client_public_key
      properties:
        client_public_key:
          type: string
          description: 'The client''s ephemeral public key used to derive a shared key.

            This is a base64-encoded, SEC1-encoded P384 public key.'
        ikm_enc:
          type: string
          description: 'The encrypted keying material to be imported.

            This is a base64-encoded ciphertext.'
        salt:
          type: string
          description: 'A salt value used to derive a shared key.

            This is a base64-encoded byte string.'
    Empty:
      default: null
      nullable: true
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    KeyDerivationInfo:
      type: object
      description: Derivation-related metadata for keys derived from a long-lived mnemonic
      required:
      - mnemonic_id
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: The derivation path used to derive this key
        mnemonic_id:
          type: string
          description: The mnemonic-id of the key's parent mnemonic
    CoinbaseApiPropertiesPatch:
      type: object
      description: 'Wire-format patch payload for [`KeyProperties::CoinbaseApi`].


        Every field follows the same per-field PATCH semantics: a missing field

        leaves the existing value alone, a JSON `null` clears it, and a value sets it.'
      properties:
        api_key_id:
          type: string
          description: 'Identifier of the Coinbase API key this key authenticates as. Plain

            (non-secret) value; appears in JWT `kid`/`sub` claims.'
          nullable: true
        portfolio_name:
          type: string
          description: Coinbase portfolio name.
          nullable: true
        portfolio_uuid:
          type: string
          description: Coinbase portfolio UUID.
          nullable: true
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    KeyTypeAndDerivationPath:
      type: object
      required:
      - key_type
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: List of derivation paths for which to derive.
          example: m/44'/60'/0'/0/0
        key_type:
          $ref: '#/components/schemas/KeyType'
        policy:
          type: array
          items: {}
          description: 'Policies to apply to this key. It is an error to specify a policy

            that is not compatible with `key_type`.'
          example:
          - AllowRawBlobSigning
          - RequireMfa:
              count: 1
          nullable: true
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    EvmTxCmp:
      type: object
      properties:
        grace:
          type: integer
          format: int64
          description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.


            In this case, however, because EVM transactions already have a replay prevention mechanism

            (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to

            indicate how long an MFA receipt should remain valid after its first use.


            Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request

            enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to

            ensure that any subsequent requests that claim the same receipt must sign for the same

            nonce as the request we signed originally with that receipt.


            Also note that the grace period cannot extend the lifetime of an MFA request beyond its

            original expiration date.


            The grace period must not be greater than 30 days.'
          nullable: true
          minimum: 0
        ignore_gas:
          type: boolean
          description: Whether the 'gas' property of the EVM transaction is allowed to be different.
        ignore_nonce:
          type: boolean
          description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
    EvmTxDepositErrorCode:
      type: string
      enum:
      - EvmTxDepositReceiverMismatch
      - EvmTxDepositEmptyData
      - EvmTxDepositEmptyChainId
      - EvmTxDepositEmptyReceiver
      - EvmTxDepositUnexpectedValue
      - EvmTxDepositUnexpectedDataLength
      - EvmTxDepositNoAbi
      - EvmTxDepositNoDepositFunction
      - EvmTxDepositUnexpectedFunctionName
      - EvmTxDepositUnexpectedValidatorKey
      - EvmTxDepositInvalidValidatorKey
      - EvmTxDepositMissingDepositArg
      - EvmTxDepositWrongDepositArgType
      - EvmTxDepositValidatorKeyNotInRole
      - EvmTxDepositUnexpectedWithdrawalCredentials
      - EvmTxDepositUnresolvedRole
      - EvmTxDepositInvalidDepositEncoding
    KeyInfo:
      allOf:
      - $ref: '#/components/schemas/CommonFields'
      - type: object
        required:
        - key_type
        - key_id
        - material_id
        - purpose
        - enabled
        - owner
        - public_key
        - policy
        properties:
          derivation_info:
            allOf:
            - $ref: '#/components/schemas/KeyDerivationInfo'
            nullable: true
          enabled:
            type: boolean
            description: Whether the key is enabled (only enabled keys may be used for signing)
          key_id:
            type: string
            description: 'The id of the key: "Key#" followed by a unique identifier specific to

              the type of key (such as a public key for BLS or an ethereum address for Secp)'
            example: Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
          key_type:
            $ref: '#/components/schemas/KeyType'
          material_id:
            type: string
            description: A unique identifier specific to the type of key, such as a public key or an ethereum address
            example: '0x8e3484687e66cdd26cf04c3647633ab4f3570148'
          owner:
            type: string
            description: Owner of the key
            example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
          policy:
            type: array
            items: {}
            description: Key policy
            example:
            - AllowRawBlobSigning
            - RequireMfa:
                count: 1
          properties:
            allOf:
            - $ref: '#/components/schemas/KeyPropertiesPatch'
            nullable: true
          provenance:
            type: string
            description: The key provenance.
            nullable: true
          public_key:
            type: string
            description: 'Hex-encoded, serialized public key. The format used depends on the key type:

              - Secp256k1 keys use 65-byte uncompressed SECG format;

              - Stark keys use 33-byte compressed SECG format;

              - BLS keys use 48-byte compressed BLS12-381 (ZCash) format;

              - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032.'
            example: '0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431'
          purpose:
            type: string
            description: The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages)
            example: Eth2Validator(1)
          region:
            type: string
            description: The region affinity for this key
    EditPolicy:
      type: object
      description: 'A policy which governs when and who is allowed to update the entity this policy is

        attached to (e.g., a role or a key).


        When attached to a role, by default, this policy applies to role deletion and all

        role updates (including adding/removing keys and users); in terms of scopes,

        it applies to `manage:role:update:*` and `manage:role:delete`.


        When attached to a key, by default, this policy applies to key deletion, all

        key updates, and adding/removing that key to/from a role; in terms of scopes,

        it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`.


        This default can be changed by setting the `applies_to_scopes` property.'
      properties:
        applies_to_scopes:
          $ref: '#/components/schemas/ScopeSet'
        mfa:
          allOf:
          - $ref: '#/components/schemas/MfaPolicy'
          nullable: true
        time_lock_until:
          allOf:
          - $ref: '#/components/schemas/EpochDateTime'
          nullable: true
    OperationKind:
      type: string
      description: All different kinds of sensitive operations
      enum:
      - AvaSign
      - AvaChainTxSign
      - BabylonCovSign
      - BabylonRegistration
      - BabylonStaking
      - BinanceSubToMaster
      - BinanceSubToSub
      - BinanceUniversalTransfer
      - BinanceSubAccountAssets
      - BinanceAccountInfo
      - BinanceSubAccountTransferHistory
      - BinanceUniversalTransferHistory
      - BinanceWithdraw
      - BinanceWithdrawHistory
      - BinanceDeposit
      - BinanceDepositHistory
      - BinanceListSubAccounts
      - BinanceCoinInfo
      - BlobSign
      - BtcMessageSign
      - BtcSign
      - BybitQueryUser
      - BybitQuerySubMembers
      - BybitQueryCoinsBalance
      - BybitQueryDepositAddress
      - BybitUniversalTransfer
      - BybitWithdraw
      - BybitWithdrawals
      - CoinbaseListAccounts
      - CoinbaseListPortfolios
      - CoinbaseMoveFunds
      - DiffieHellman
      - PsbtSign
      - TaprootSign
      - Eip191Sign
      - Eip712Sign
      - Eip7702Sign
      - EotsNonces
      - EotsSign
      - Eth1Sign
      - Eth2Sign
      - Eth2Stake
      - Eth2Unstake
      - SolanaSign
      - SuiSign
      - TendermintSign
      - RoleUpdate
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
          nullable: true
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        request_id:
          type: string
          description: Optional request identifier
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    KeyImportKey:
      type: object
      description: A wrapped key-import key
      required:
      - public_key
      - sk_enc
      - dk_enc
      - expires
      properties:
        dk_enc:
          type: string
          description: Base64-encoded, encrypted data key.
        expires:
          type: integer
          format: int64
          description: Expiration timestamp expressed as seconds since the UNIX epoch.
          minimum: 0
        public_key:
          type: string
          description: 'The ephemeral public key to which an imported key should be encrypted.

            This is a P384 public key in base64-encoded uncompressed SECG format.'
        sk_enc:
          type: string
          description: Base64-encoded, encrypted secret key.
    DeriveKeyRequest:
      allOf:
      - $ref: '#/components/schemas/CreateAndUpdateKeyProperties'
      - type: object
        required:
        - key_type
        - derivation_path
        - mnemonic_id
        properties:
          derivation_path:
            type: array
            items:
              type: string
            description: List of derivation paths for which to derive.
            example:
            - m/44'/60'/0'/0/0
            - m/44'/9000'/0'/0/0
            maxItems: 32
            minItems: 1
          idempotent:
            type: boolean
            description: 'When false (the default), nothing is returned when a derived key already

              exists. When true, returns the KeyInfo struct for keys that already exist

              if caller is allowed to list that key.'
          key_type:
            $ref: '#/components/schemas/KeyType'
          mnemonic_id:
            type: string
            description: Material-id of the mnemonic to use for derivation.
            example: '0x9f07be82d934fcb5d0f75dd24c2dfea8a85a4d0c289d58828b3537fae24d32b8'
      description: Request to derive keys for one type from a specified mnemonic.
    ClientSessionInfo:
      type: object
      description: 'Session information sent to the client.

        This struct works in tandem with its server-side counterpart [`SessionData`].'
      required:
      - session_id
      - auth_token
      - refresh_token
      - epoch
      - epoch_token
      - auth_token_exp
      - refresh_token_exp
      properties:
        auth_token:
          type: string
          description: Token to use for authorization.
        auth_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        epoch:
          type: integer
          format: int32
          description: Epoch at which the token was last refreshed
          minimum: 0
        epoch_token:
          $ref: '#/components/schemas/B32'
        refresh_token:
          type: string
          description: Token to use for refreshing the `(auth, refresh)` token pair
        refresh_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        session_id:
          type: string
          description: Session ID
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    ExplicitScope:
      type: string
      title: ExplicitScope
      description: Explicitly named scopes for accessing CubeSigner APIs
      enum:
      - sign:*
      - sign:ava
      - sign:binance:*
      - sign:binance:subToMaster
      - sign:binance:subToSub
      - sign:binance:universalTransfer
      - sign:binance:subAccountAssets
      - sign:binance:accountInfo
      - sign:binance:subAccountTransferHistory
      - sign:binance:universalTransferHistory
      - sign:binance:withdraw
      - sign:binance:withdrawHistory
      - sign:binance:deposit
      - sign:binance:depositHistory
      - sign:binance:listSubAccounts
      - sign:binance:coinInfo
      - sign:bybit:*
      - sign:bybit:queryUser
      - sign:bybit:querySubMembers
      - sign:bybit:queryCoinsBalance
      - sign:bybit:queryDepositAddress
      - sign:bybit:universalTransfer
      - sign:bybit:withdraw
      - sign:bybit:withdrawals
      - sign:coinbase:*
      - sign:coinbase:accounts:list
      - sign:coinbase:portfolios:list
      - sign:coinbase:funds:move
      - sign:blob
      - sign:diffieHellman
      - sign:btc:*
      - sign:btc:segwit
      - sign:btc:taproot
      - sign:btc:psbt:*
      - sign:btc:psbt:doge
      - sign:btc:psbt:legacy
      - sign:btc:psbt:segwit
      - sign:btc:psbt:taproot
      - sign:btc:psbt:ltcSegwit
      - sign:btc:message:*
      - sign:btc:message:segwit
      - sign:btc:message:legacy
      - sign:babylon:*
      - sign:babylon:eots:*
      - sign:babylon:eots:nonces
      - sign:babylon:eots:sign
      - sign:babylon:staking:*
      - sign:babylon:staking:deposit
      - sign:babylon:staking:unbond
      - sign:babylon:staking:withdraw
      - sign:babylon:staking:slash
      - sign:babylon:registration
      - sign:babylon:covenant
      - sign:evm:*
      - sign:evm:tx
      - sign:evm:eip191
      - sign:evm:eip712
      - sign:evm:eip7702
      - sign:eth2:*
      - sign:eth2:validate
      - sign:eth2:stake
      - sign:eth2:unstake
      - sign:solana
      - sign:sui
      - sign:tendermint
      - sign:mmi
      - manage:*
      - manage:readonly
      - manage:email:*
      - manage:email:get
      - manage:email:update
      - manage:email:delete
      - manage:mfa:*
      - manage:mfa:readonly
      - manage:mfa:list
      - manage:mfa:vote:*
      - manage:mfa:vote:cs
      - manage:mfa:vote:email
      - manage:mfa:vote:fido
      - manage:mfa:vote:totp
      - manage:mfa:register:*
      - manage:mfa:register:fido
      - manage:mfa:register:totp
      - manage:mfa:register:email
      - manage:mfa:unregister:*
      - manage:mfa:unregister:fido
      - manage:mfa:unregister:totp
      - manage:mfa:verify:*
      - manage:mfa:verify:totp
      - manage:key:*
      - manage:key:readonly
      - manage:key:get
      - manage:key:attest
      - manage:key:listRoles
      - manage:key:list
      - manage:key:history:tx:list
      - manage:key:create
      - manage:key:import
      - manage:key:update:*
      - manage:key:update:owner
      - manage:key:update:policy
      - manage:key:update:enabled
      - manage:key:update:region
      - manage:key:update:metadata
      - manage:key:update:properties
      - manage:key:update:editPolicy
      - manage:key:delete
      - manage:policy:*
      - manage:policy:readonly
      - manage:policy:create
      - manage:policy:get
      - manage:policy:list
      - manage:policy:delete
      - manage:policy:update:*
      - manage:policy:update:owner
      - manage:policy:update:name
      - manage:policy:update:acl
      - manage:policy:update:editPolicy
      - manage:policy:update:metadata
      - manage:policy:update:rule
      - manage:policy:invoke
      - manage:policy:wasm:*
      - manage:policy:wasm:upload
      - manage:policy:secrets:*
      - manage:policy:secrets:get
      - manage:policy:secrets:update:*
      - manage:policy:secrets:update:values
      - manage:policy:secrets:update:acl
      - manage:policy:secrets:update:editPolicy
      - manage:policy:buckets:*
      - manage:policy:buckets:get
      - manage:policy:buckets:list
      - manage:policy:buckets:update:*
      - manage:policy:buckets:update:owner
      - manage:policy:buckets:update:acl
      - manage:policy:buckets:update:metadata
      - manage:contact:*
      - manage:contact:readonly
      - manage:contact:create
      - manage:contact:get
      - manage:contact:list
      - manage:contact:delete
      - manage:contact:update:*
      - manage:contact:update:name
      - manage:contact:update:addresses
      - manage:contact:update:owner
      - manage:contact:update:labels
      - manage:contact:update:metadata
      - manage:contact:update:editPolicy
      - manage:contact:lookup:*
      - manage:contact:lookup:address
      - manage:policy:createImportKey
      - manage:role:*
      - manage:role:readonly
      - manage:role:create
      - manage:role:delete
      - manage:role:get:*
      - manage:role:attest
      - manage:role:get:keys
      - manage:role:get:keys:list
      - manage:role:get:keys:get
      - manage:role:get:users
      - manage:role:list
      - manage:role:update:*
      - manage:role:update:enabled
      - manage:role:update:policy
      - manage:role:update:editPolicy
      - manage:role:update:actions
      - manage:role:update:key:*
      - manage:role:update:key:add
      - manage:role:update:key:remove
      - manage:role:update:user:*
      - manage:role:update:user:add
      - manage:role:update:user:remove
      - manage:role:history:tx:list
      - manage:identity:*
      - manage:identity:readonly
      - manage:identity:verify
      - manage:identity:add
      - manage:identity:remove
      - manage:identity:list
      - manage:org:*
      - manage:org:create
      - manage:org:metrics:query
      - manage:org:audit:query
      - manage:org:readonly
      - manage:org:addUser
      - manage:org:inviteUser
      - manage:org:inviteAlien
      - manage:org:invitation:list
      - manage:org:invitation:cancel
      - manage:org:updateMembership:*
      - manage:org:updateMembership:owner
      - manage:org:updateMembership:member
      - manage:org:updateMembership:alien
      - manage:org:listUsers
      - manage:org:user:get
      - manage:org:deleteUser:*
      - manage:org:deleteUser:owner
      - manage:org:deleteUser:member
      - manage:org:deleteUser:alien
      - manage:org:get
      - manage:org:update:*
      - manage:org:update:enabled
      - manage:org:update:policy
      - manage:org:update:signPolicy
      - manage:org:update:export
      - manage:org:update:totpFailureLimit
      - manage:org:update:notificationEndpoints
      - manage:org:update:defaultInviteKind
      - manage:org:update:idpConfiguration
      - manage:org:update:passkeyConfiguration
      - manage:org:update:emailPreferences
      - manage:org:update:historicalData
      - manage:org:update:requireScopeCeiling
      - manage:org:update:alienLoginRequirement
      - manage:org:update:memberLoginRequirement
      - manage:org:update:keyExportRequirement
      - manage:org:update:allowedMfaTypes
      - manage:org:update:policyEngineConf
      - manage:org:update:customChains
      - manage:org:update:extProps
      - manage:org:update:editPolicy
      - manage:org:user:resetMfa
      - manage:session:*
      - manage:session:readonly
      - manage:session:get
      - manage:session:list
      - manage:session:create
      - manage:session:extend
      - manage:session:revoke
      - manage:export:*
      - manage:export:readonly
      - manage:export:org:*
      - manage:export:org:get
      - manage:export:user:*
      - manage:export:user:delete
      - manage:export:user:list
      - manage:authMigration:*
      - manage:authMigration:identity:add
      - manage:authMigration:identity:remove
      - manage:authMigration:user:update
      - manage:mmi:*
      - manage:mmi:readonly
      - manage:mmi:get
      - manage:mmi:list
      - manage:mmi:reject
      - manage:mmi:delete
      - export:*
      - export:user:*
      - export:user:init
      - export:user:complete
      - mmi:*
      - orgAccess:*
      - orgAccess:child:*
      - rpc:*
      - rpc:createTransaction:*
      - rpc:createTransaction:evm
      - rpc:retryTransaction
      - rpc:cancelTransaction
      - rpc:getTransaction
      - rpc:listTransactions
      - rpc:btcListUtxos
      - rpc:binance
      - rpc:bybit
      - rpc:coinbase
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    UpdateKeyRequest:
      allOf:
      - $ref: '#/components/schemas/CreateAndUpdateKeyProperties'
      - type: object
        properties:
          enabled:
            type: boolean
            description: 'If set, updates the key''s `enabled` property to this value.

              Once disabled, a key cannot be used for signing.'
            nullable: true
          properties:
            description: 'If set, patch the key''s structured [`KeyProperties`]. The patch''s variant must

              match the key''s [`KeyType`] (e.g. `BinanceApi` properties are only allowed on

              `Ed25519BinanceApi` keys). Each field in the patch is independent: missing

              means leave alone, JSON `null` clears, a value sets. Sending JSON `null` for

              the whole field clears all properties on the key.'
            nullable: true
          region:
            type: string
            description: 'If set, change the key''s region affinity to this value.


              This is a region-locked operation, i.e., it can only be performed

              from the region matching the key''s current region affinity'
          version:
            type: integer
            format: int64
            description: If set, updating the metadata only succeeds if the version matches this value.
            nullable: true
            minimum: 0
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
          nullable: true
    Id:
      type: string
    BinanceApiPropertiesPatch:
      type: object
      properties:
        api_key:
          type: string
          description: The Binance-issued API key string. Encrypted server-side before storage.
          nullable: true
        email:
          type: string
          description: Email address of the Binance (master or sub) account this key authenticates as.
          nullable: true
        is_master:
          type: boolean
          description: Whether this corresponds to a master (as opposed to a sub) account on Binance.
          nullable: true
        label:
          type: string
          description: Arbitrary label. Useful for storing the corresponding API key label on the Binance side.
          nullable: true
        sub_of:
          type: string
          description: 'If this is a sub-account, this field can be used to link it to its master account

            (by providing the master account email, which Binance uses as an account identifier).'
          nullable: true
    DeriveKeysRequest:
      allOf:
      - $ref: '#/components/schemas/CreateAndUpdateKeyProperties'
      - type: object
        required:
        - key_types_and_derivation_paths
        properties:
          idempotent:
            type: boolean
            description: 'When false (the default), nothing is returned when a derived key already

              exists. When true, returns the KeyInfo struct for keys that already exist

              if caller is allowed to list that key.'
          key_types_and_derivation_paths:
            type: array
            items:
              $ref: '#/components/schemas/KeyTypeAndDerivationPath'
            description: 'Key types and corresponding paths for derivation, plus optional

              policies to include for specific keys. It is an error to specify

              a policy that does not apply to the corresponding key type.'
            example:
            - derivation_path: m/44'/60'/0'/0/0
              key_type: SecpEthAddr
            - derivation_path: m/11'/22'/33
              key_type: TaprootBtc
              policy:
              - AllowRawBlobSigning
            maxItems: 32
            minItems: 1
          mnemonic_id:
            type: string
            description: 'Material-id of the mnemonic to use for derivation. If unspecified,

              a new mnemonic is first created.'
            example: '0x9f07be82d934fcb5d0f75dd24c2dfea8a85a4d0c289d58828b3537fae24d32b8'
            nullable: true
      description: Request to derive keys for multiple types from a specified mnemonic.
    MfaType:
      type: string
      format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
      description: Different types that can be used to approve an MFA request
      pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
    PolicyErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PolicyErrorOwnCodes'
      - $ref: '#/components/schemas/EvmTxDepositErrorCode'
    BybitApiPropertiesPatch:
      type: object
      description: 'Wire-format patch payload for [`KeyProperties::BybitApi`].


        Every field follows the same per-field PATCH semantics: a missing field

        leaves the existing value alone, a JSON `null` clears it, and a value sets it.'
      properties:
        api_key:
          type: string
          description: The Bybit-issued API key string. Encrypted server-side before storage.
          nullable: true
        label:
          type: string
          description: Arbitrary label. Useful for storing the corresponding API key label on the Bybit side.
          nullable: true
    MfaRequestInfo:
      type: object
      description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp').
      required:
      - id
      - expires_at
      - request
      - status
      - created_by
      - provenance
      properties:
        created_at:
          $ref: '#/components/schemas/EpochDateTime'
        created_by:
          type: string
          description: The session identity (user or role) that created this request.
        expires_at:
          $ref: '#/components/schemas/EpochDateTime'
        id:
          type: string
          description: Approval request ID.
        not_valid_until:
          $ref: '#/components/schemas/EpochDateTime'
        provenance:
          type: string
          description: MFA policy provenance
          enum:
          - Org
          - Key
          - KeyInRole
          - Role
          - User
          - EditPolicy
        receipt:
          allOf:
          - $ref: '#/components/schemas/Receipt'
          nullable: true
        region:
          type: string
          description: The region this MFA request was created in.  It can only be redeemed from the same region.
        related_ids:
          type: array
          items:
            type: string
          description: 'If set, contains the IDs of all MFA requests (including this one!) that

            were generated at once for the same CubeSigner operation.


            If not set, it means that this was the lone MFA request generated for `request`.


            This is useful so that a client can discover all the MFAs whose receipts must

            be submitted together to carry out the original CubeSigner operation.'
        request:
          $ref: '#/components/schemas/HttpRequest'
        status:
          $ref: '#/components/schemas/Status'
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    Scope:
      oneOf:
      - $ref: '#/components/schemas/ExplicitScope'
      - type: string
        title: OtherScopes
        description: Scopes including wildcard fragments for accessing CubeSigner APIs
        pattern: ^(orgAccess:child)(:[^:]+)?$
      description: All scopes for accessing CubeSigner APIs
    KeyType:
      type: string
      enum:
      - SecpEthAddr
      - SecpBtc
      - SecpBtcTest
      - SecpBtcLegacy
      - SecpBtcLegacyTest
      - SecpAvaAddr
      - SecpAvaTestAddr
      - BlsPub
      - BlsInactive
      - BlsAvaIcm
      - Ed25519SolanaAddr
      - Ed25519SuiAddr
      - Ed25519AptosAddr
      - Ed25519CardanoAddrVk
      - Ed25519StellarAddr
      - Ed25519SubstrateAddr
      - Ed25519CantonAddr
      - Ed25519BinanceApi
      - Ed25519CoinbaseApi
      - Mnemonic
      - Stark
      - BabylonEots
      - BabylonCov
      - TaprootBtc
      - TaprootBtcTest
      - SecpCosmosAddr
      - P256CosmosAddr
      - P256OntologyAddr
      - P256Neo3Addr
      - Ed25519TendermintAddr
      - SecpTronAddr
      - Ed25519TonAddr
      - SecpDogeAddr
      - SecpDogeTestAddr
      - SecpKaspaAddr
      - SecpKaspaTestAddr
      - SchnorrKaspaAddr
      - SchnorrKaspaTestAddr
      - SecpLtc
      - SecpLtcTest
      - SecpXrpAddr
      - Ed25519XrpAddr
      - BabyJubjub
      - HmacSha256
      - HmacSha256Bybit
    Seconds:
      type: integer
      format: int64
      description: 'Duration measured in seconds

        A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.'
      minimum: 0
    KeyPropertiesPatch:
      oneOf:
      - allOf:
        - $ref: '#/components/schemas/BinanceApiPropertiesPatch'
        - type: object
          required:
          - kind
          properties:
            kind:
              type: string
              enum:
              - BinanceApi
      - allOf:
        - $ref: '#/components/schemas/CoinbaseApiPropertiesPatch'
        - type: object
          required:
          - kind
          properties:
            kind:
              type: string
              enum:
              - CoinbaseApi
      - allOf:
        - $ref: '#/components/schemas/BybitApiPropertiesPatch'
        - type: object
          required:
          - kind
          properties:
            kind:
              type: string
              enum:
              - BybitApi
      description: 'Client-side wire payload for [`KeyProperties`]. Used in both directions:


        - **On write**: a *patch*, i.e., for each field, missing means "leave alone",

        `null` means "clear", and a value means "set". Secret fields arrive in the

        clear and are encrypted server-side before persisting.

        - **On read**: each field is omitted when the stored property is unset; secret

        fields are emitted with the redacted marker (e.g. "[REDACTED]").'
    KeyInRoleInfo:
      type: object
      required:
      - role_id
      - key_id
      properties:
        key_id:
          type: string
          description: Key ID
          example: Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
        key_info:
          allOf:
          - $ref: '#/components/schemas/KeyInfo'
          nullable: true
        policy:
          type: array
          items:
            type: object
          description: Policies that are checked before this key is used on behalf of this role
          example:
          - TxReceiver: '0x8c594691c0e592ffa21f153a16ae41db5befcaaa'
          - TxDeposit:
              kind: Canonical
        role_id:
          type: string
          description: Role ID
          example: Role#e427c28a-9c5b-49cc-a257-878aea58a22c
    CreateAndUpdateKeyProperties:
      type: object
      properties:
        edit_policy:
          allOf:
          - $ref: '#/components/schemas/EditPolicy'
          nullable: true
        metadata:
          description: 'Set this key''s metadata. If this value is `null`, the metadata is erased. If the field is

            missing, the metadata remains unchanged.'
        owner:
          type: string
          description: 'Specify a user other than themselves to be the (potentially new) owner of the key.

            The specified owner must be an existing user who is a member of the same org.'
          example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
          nullable: true
        policy:
          type: array
          items: {}
          description: Set this key's policies. For an existing key, this overwrites all its policies.
          example:
          - AllowRawBlobSigning
          - RequireMfa:
              count: 1
          nullable: true
    ImportKeyRequest:
      allOf:
      - $ref: '#/components/schemas/KeyImportKey'
      - $ref: '#/components/schemas/CreateAndUpdateKeyProperties'
      - type: object
        required:
        - key_material
        - key_type
        properties:
          idempotent:
            type: boolean
            description: 'When false (the default), nothing is returned when an imported key already

              exists. When true, returns the KeyInfo struct for keys that already exist

              if caller is allowed to list that key.'
          key_material:
            type: array
            items:
              $ref: '#/components/schemas/ImportKeyRequestMaterial'
            description: A set of encrypted keys to be imported
            maxItems: 32
            minItems: 1
          key_type:
            $ref: '#/components/schemas/KeyType'
    CreateKeyRequest:
      allOf:
      - $ref: '#/components/schemas/CreateAndUpdateKeyProperties'
      - type: object
        required:
        - key_type
        - count
        properties:
          chain_id:
            type: integer
            format: int64
            description: Chain id for which the key is allowed to sign messages
            example: 5
            nullable: true
            minimum: 0
          count:
            type: integer
            format: int32
            description: Number of keys to create
            example: 1
            maximum: 32
            minimum: 1
          key_type:
            $ref: '#/components/schemas/KeyType'
    HistoricalTx:
      type: object
      description: A recently signed transaction that we store in the DB.
      required:
      - key_id
      - historical_tx_org_id
      - operation
      - request
      - result
      - date
      - exp_epoch
      properties:
        date:
          $ref: '#/components/schemas/EpochDateTime'
        exp_epoch:
          $ref: '#/components/schemas/EpochDateTime'
        historical_tx_org_id:
          $ref: '#/components/schemas/Id'
        key_id:
          $ref: '#/components/schemas/Id'
        mfa_status:
          allOf:
          - $ref: '#/components/schemas/Status'
          nullable: true
        operation:
          $ref: '#/components/schemas/OperationKind'
        request:
          $ref: '#/components/schemas/HttpRequest'
        request_id:
          type: string
          description: Original request id
          nullable: true
        result:
          description: Operation-specific result
        role_id:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
        user_id:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    MfaPolicy:
      type: object
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. If empty at creation time, default to the current user.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        count:
          type: integer
          format: int32
          description: How many users to require to approve (defaults to 1).
          minimum: 0
        lifetime:
          $ref: '#/components/schemas/Seconds'
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user (defaults to 1).
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
        restricted_operations:
          type: array
          items:
            $ref: '#/components/schemas/OperationKind'
          description: 'CubeSigner operations to which this policy should apply.

            When omitted, applies to all operations.'
          nullable: true
        time_delay:
          $ref: '#/components/schemas/Seconds'
      example:
        allowed_approvers:
        - User#fabc3f88-04e0-471b-9657-0ae12a3cd73e
        - User#d796c369-9974-473b-ab9e-e4a2418d2d07
        count: 2
        lifetime: 900
    ApprovalInfo:
      type: object
      required:
      - timestamp
      properties:
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    HttpRequest:
      type: object
      description: 'Information about the request.


        Captures all the relevant info (including the request body) about requests that require MFA.

        We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)

        it is exactly the same as it originally was.'
      required:
      - method
      - path
      properties:
        body:
          type: object
          description: HTTP request body
          nullable: true
        method:
          type: string
          description: HTTP method of the request
        path:
          type: string
          description: HTTP path of the request, excluding the host
    NewSessionResponse:
      type: object
      description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.).
      required:
      - org_id
      - token
      - refresh_token
      - session_info
      properties:
        expiration:
          type: integer
          format: int64
          description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed.
          example: 1701879640
          minimum: 0
        org_id:
          $ref: '#/components/schemas/Id'
        refresh_token:
          type: string
          description: Token that can be used to refresh this session.
        session_info:
          $ref: '#/components/schemas/ClientSessionInfo'
        token:
          type: string
          description: 'New token to be used for authentication. Requests to signing endpoints

            should include this value in the `Authorization` header.'
    Receipt:
      type: object
      description: Receipt that an MFA request was approved.
      required:
      - confirmation
      - final_approver
      - timestamp
      properties:
        confirmation:
          type: string
          description: Confirmation code the user needs to present when resuming the original request.
          example: ba1d75dd-d999-4c1b-944d-25c25440c8af
        final_approver:
          type: string
          description: The ID of the logged-in user whose action created this approval.
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    AcceptedResponse:
      allOf:
      - $ref: '#/components/schemas/ErrorResponse'
      - type: object
    TimeoutErrorCode:
      type: string
      enum:
      - PolicyEngineTimeout
      - WasmPolicyExecutionTimeout
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
  responses:
    CreateKeyResponse:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - keys
            properties:
              keys:
                type: array
                items:
                  $ref: '#/components/schemas/KeyInfo'
                description: The info about the created keys
    OrgExportResponse:
      description: An org-export ciphertext retrieved via the org-export API.
      content:
        application/json:
          schema:
            type: object
            description: An org-export ciphertext retrieved via the org-export API.
            required:
            - ciphertext
            properties:
              ciphertext:
                type: string
                description: A base64-encoded export ciphertext.
    CreateKeyImportKeyResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - $ref: '#/components/schemas/KeyImportKey'
            - type: object
              required:
              - enclave_attestation
              - enclave_signature
              properties:
                enclave_attestation:
                  type: string
                  description: 'An attestation document from a secure enclave, including an

                    RSA signing key used to sign the contents of this message.'
                enclave_signature:
                  type: string
                  description: 'An RSA-PSS-SHA256 signature on the public key and encrypted

                    secrets attesting to their generation inside a secure enclave.'
    PaginatedListKeyRolesResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              required:
              - roles
              properties:
                roles:
                  type: array
                  items:
                    $ref: '#/components/schemas/KeyInRoleInfo'
                  description: All roles the key is in
            - type: object
              properties:
                last_evaluated_key:
                  type: string
                  description: 'If set, the content of `response` does not contain the entire result set.

                    To fetch the next page of the result set, call the same endpoint

                    but specify this value as the ''page.start'' query parameter.'
                  nullable: true
            description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key`

              value (which can the user pass back to use as a url query parameter to continue pagination).'
    EmptyImpl:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            properties:
              status:
                type: string
    KeyInfoJwt:
      description: Response returned when requesting a key attestation.
      content:
        application/json:
          schema:
            type: object
            description: Response returned when requesting a key attestation.
            required:
            - jwt
            properties:
              jwt:
                type: string
                description: A JSON Web Token whose claims contain the `KeyInfo` structure.
    PaginatedListKeysResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              required:
              - keys
              properties:
                keys:
                  type: array
                  items:
                    $ref: '#/components/schemas/KeyInfo'
            - type: object
              properties:
                last_evaluated_key:
                  type: string
                  description: 'If set, the content of `response` does not contain the entire result set.

                    To fetch the next page of the result set, call the same endpoint

                    but specify this value as the ''page.start'' query parameter.'
                  nullable: true
            description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key`

              value (which can the user pass back to use as a url query parameter to continue pagination).'
    KeyInfo:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - $ref: '#/components/schemas/CommonFields'
            - type: object
              required:
              - key_type
              - key_id
              - material_id
              - purpose
              - enabled
              - owner
              - public_key
              - policy
              properties:
                derivation_info:
                  allOf:
                  - $ref: '#/components/schemas/KeyDerivationInfo'
                  nullable: true
                enabled:
                  type: boolean
                  description: Whether the key is enabled (only enabled keys may be used for signing)
                key_id:
                  type: string
                  description: 'The id of the key: "Key#" followed by a unique identifier specific to

                    the type of key (such as a public key for BLS or an ethereum address for Secp)'
                  example: Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
                key_type:
                  $ref: '#/components/schemas/KeyType'
                material_id:
                  type: string
                  description: A unique identifier specific to the type of key, such as a public key or an ethereum address
                  example: '0x8e3484687e66cdd26cf04c3647633ab4f3570148'
                owner:
                  type: string
                  description: Owner of the key
                  example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
                policy:
                  type: array
                  items: {}
                  description: Key policy
                  example:
                  - AllowRawBlobSigning
                  - RequireMfa:
                      count: 1
                properties:
                  allOf:
                  - $ref: '#/components/schemas/KeyPropertiesPatch'
                  nullable: true
                provenance:
                  type: string
                  description: The key provenance.
                  nullable: true
                public_key:
                  type: string
                  description: 'Hex-encoded, serialized public key. The format used depends on the key type:

                    - Secp256k1 keys use 65-byte uncompressed SECG format;

                    - Stark keys use 33-byte compressed SECG format;

                    - BLS keys use 48-byte compressed BLS12-381 (ZCash) format;

                    - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032.'
                  example: '0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431'
                purpose:
                  type: string
                  description: The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages)
                  example: Eth2Validator(1)
                region:
                  type: string
                  description: The region affinity for this key
    PaginatedListHistoricalTxResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              required:
              - txs
              properties:
                txs:
                  type: array
                  items:
                    $ref: '#/components/schemas/HistoricalTx'
                  description: Historical transactions signed with the requested key, sorted from most to least recent.
            - type: object
              properties:
                last_evaluated_key:
                  type: string
                  description: 'If set, the content of `response` does not contain the entire result set.

                    To fetch the next page of the result set, call the same endpoint

                    but specify this value as the ''page.start'' query parameter.'
                  nullable: true
            description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key`

              value (which can the user pass back to use as a url query parameter to continue pagination).'
  securitySchemes:
    Oidc:
      type: apiKey
      in: header
      name: Authorization
      description: OIDC tokens allow users to authenticate using a third-party service. These are exchanged for signer session tokens.
    SignerAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Signing API end-points use session tokens for auth. Specifically, with each request you need to use the \`token\` from your signer session (which you create with `cs token create`).