openapi: 3.0.3 info: title: CubeSigner Account MFA API description: The CubeSigner management and signing service. contact: name: Cubist Inc. email: hello@cubist.dev version: v0.1.0 servers: - url: https://gamma.signer.cubist.dev description: Testing and staging environment - url: https://prod.signer.cubist.dev description: Production environment security: - Cognito: [] tags: - name: MFA paths: /v0/org/{org_id}/mfa: get: tags: - MFA summary: List Pending MFA Requests description: 'List Pending MFA Requests Retrieves and returns all pending MFA requests that are accessible to the current session, i.e., those created by the current session identity plus those in which the current user is listed as an approver NOTE that if pagination is used and a page limit is set, the returned result set may contain either FEWER or MORE elements than the requested page limit.' operationId: mfaList parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: page.size in: query description: 'Max number of items to return per page. If the actual number of returned items may be less that this, even if there exist more data in the result set. To reliably determine if more data is left in the result set, inspect the [UnencryptedLastEvalKey] value in the response object.' required: false schema: type: integer format: int32 default: 1000 maximum: 10001 minimum: 1 style: form - name: page.start in: query description: 'The start of the page. Omit to start from the beginning; otherwise, only specify a the exact value previously returned as ''last_evaluated_key'' from the same endpoint.' required: false schema: type: string nullable: true style: form responses: '200': $ref: '#/components/responses/PaginatedListMfaResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:list /v0/org/{org_id}/mfa/{mfa_id}: get: tags: - MFA summary: Get Pending MFA Request description: 'Get Pending MFA Request Retrieves and returns a pending MFA request by its id.' operationId: mfaGet parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a responses: '200': $ref: '#/components/responses/MfaRequestInfo' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: [] patch: tags: - MFA summary: Approve or Reject MFA Request description: 'Approve or Reject MFA Request Approve or reject request after logging in with CubeSigner. If approving, adds the currently-logged user as an approver of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of approvers is reached, the MFA request is approved; the confirmation receipt can be used to resume the original HTTP request. If rejecting, immediately deletes the pending MFA request.' operationId: mfaVoteCs parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_vote in: query required: false schema: allOf: - $ref: '#/components/schemas/MfaVote' nullable: true style: form responses: '200': $ref: '#/components/responses/MfaRequestInfo' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:cs /v0/org/{org_id}/mfa/{mfa_id}/email: post: tags: - MFA summary: Initiate an Email OTP MFA Approval/Rejection description: 'Initiate an Email OTP MFA Approval/Rejection Initiates the approval/rejection process of an MFA Request using Email OTP.' operationId: mfaEmailInit parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_vote in: query required: false schema: allOf: - $ref: '#/components/schemas/MfaVote' nullable: true style: form responses: '200': $ref: '#/components/responses/EmailOtpResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:email patch: tags: - MFA summary: Finalize a Email OTP MFA Approval/Rejection. description: 'Finalize a Email OTP MFA Approval/Rejection. The request should contain the full JWT obtained by concatenating the partial token returned by the `mfa_email_init` endpoint and the signature emailed to the user issuing the request. If approving, adds an approver to a pending MFA request. If the required number of approvers is reached, the MFA request is approved; the confirmation receipt can be used to resume the original HTTP request. If rejecting, immediately deletes the pending MFA request.' operationId: mfaVoteEmailComplete parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/EmailOtpAnswer' required: true responses: '200': $ref: '#/components/responses/MfaRequestInfo' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:email /v0/org/{org_id}/mfa/{mfa_id}/fido: post: tags: - MFA summary: Initiate a FIDO MFA Approval/Rejection description: 'Initiate a FIDO MFA Approval/Rejection Initiates the approval/rejection process of an MFA Request using FIDO.' operationId: mfaFidoInit parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a responses: '200': $ref: '#/components/responses/FidoAssertChallenge' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:fido patch: tags: - MFA summary: Finalize a FIDO MFA Approval/Rejection description: 'Finalize a FIDO MFA Approval/Rejection If approving, adds an approver to a pending MFA request. If the required number of approvers is reached, the MFA request is approved; the confirmation receipt can be used to resume the original HTTP request. If rejecting, immediately deletes the pending MFA request.' operationId: mfaVoteFidoComplete parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_vote in: query required: false schema: allOf: - $ref: '#/components/schemas/MfaVote' nullable: true style: form requestBody: content: application/json: schema: $ref: '#/components/schemas/FidoAssertAnswer' required: true responses: '200': $ref: '#/components/responses/MfaRequestInfo' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:fido /v0/org/{org_id}/mfa/{mfa_id}/totp: patch: tags: - MFA summary: Approve/Reject a TOTP MFA Request description: 'Approve/Reject a TOTP MFA Request If approving, adds the current user as approver to a pending MFA request by providing TOTP code. If the required number of approvers is reached, the MFA request is approved; the confirmation receipt can be used to resume the original HTTP request. If rejecting, immediately deletes the pending MFA request.' operationId: mfaVoteTotp parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_id in: path description: Name or ID of the desired MfaRequest required: true schema: type: string example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: mfa_vote in: query required: false schema: allOf: - $ref: '#/components/schemas/MfaVote' nullable: true style: form requestBody: content: application/json: schema: $ref: '#/components/schemas/TotpApproveRequest' required: true responses: '200': $ref: '#/components/responses/MfaRequestInfo' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - SignerAuth: - manage:mfa:vote:totp components: schemas: EpochDateTime: type: integer format: int64 description: 'DateTime measured in seconds since unix epoch. A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`] representing the number of seconds since [`SystemTime::UNIX_EPOCH`].' minimum: 0 UserVerificationRequirement: type: string description: 'A WebAuthn Relying Party may require user verification for some of its operations but not for others, and may use this type to express its needs. https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement' enum: - required - discouraged - preferred MfaRequiredArgs: type: object required: - id - ids - org_id properties: id: type: string description: Always set to first MFA id from `Self::ids` ids: type: array items: type: string minLength: 1 description: Non-empty MFA request IDs org_id: type: string description: Organization id policy_eval_tree: description: Optional policy evaluation tree (included in signer responses, when requested) nullable: true session: allOf: - $ref: '#/components/schemas/NewSessionResponse' nullable: true B32: type: string description: Wrapper around a zeroizing 32-byte fixed-size array PublicKeyCredential: type: object description: 'This type represents a wire-encodable form of the PublicKeyCredential interface Clients may need to manually encode into this format to communicate with the server The PublicKeyCredential interface inherits from Credential [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to the caller when a new credential is created, or a new assertion is requested. https://www.w3.org/TR/webauthn-2/#iface-pkcredential' required: - id - response properties: clientExtensionResults: type: object description: 'This internal slot contains the results of processing client extensions requested by the Relying Party upon the Relying Party''s invocation of either navigator.credentials.create() or navigator.credentials.get(). https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc: This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing. https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults ' nullable: true id: type: string description: 'This internal slot contains the credential ID, chosen by the authenticator. The credential ID is used to look up credentials for use, and is therefore expected to be globally unique with high probability across all credentials of the same type, across all authenticators. https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot' response: oneOf: - $ref: '#/components/schemas/AuthenticatorAttestationResponse' - $ref: '#/components/schemas/AuthenticatorAssertionResponse' description: Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface EmailOtpAnswer: type: object description: An answer to the challenge returned by the `mfa_email_init` endpoint. required: - token properties: token: type: string description: 'Full JWT token, constructed by concatenating the "partial token" (i.e., `{header}.{payload}.`) returned by the `mail_email_init` endpoint and the signature sent to the user''s email.' AcceptedValue: oneOf: - type: object required: - SignDryRun properties: SignDryRun: $ref: '#/components/schemas/SignDryRunArgs' - type: object required: - BinanceDryRun properties: BinanceDryRun: $ref: '#/components/schemas/BinanceDryRunArgs' - type: object required: - BybitDryRun properties: BybitDryRun: $ref: '#/components/schemas/BybitDryRunArgs' - type: object required: - CoinbaseDryRun properties: CoinbaseDryRun: $ref: '#/components/schemas/CoinbaseDryRunArgs' - type: object required: - MfaRequired properties: MfaRequired: $ref: '#/components/schemas/MfaRequiredArgs' description: Different responses we return for success status codes. NotFoundErrorCode: type: string enum: - UriSegmentMissing - UriSegmentInvalid - TotpNotConfigured - FidoKeyNotFound - FidoChallengeNotFound - TotpChallengeNotFound - UserExportRequestNotFound - UserExportCiphertextNotFound - OrgExportCiphertextNotFound - UploadObjectNotFound - PolicySecretNotFound - BucketMetaNotFound - TimestreamDisabled - CustomChainNotFound - InvitationNotFound - TransactionNotFound - EmailConfigNotFound HttpRequestCmp: oneOf: - type: string description: The requests must match exactly. Any given MFA receipt can be used at most once. enum: - Eq - type: object required: - EvmTx properties: EvmTx: $ref: '#/components/schemas/EvmTxCmp' - type: object required: - SolanaTx properties: SolanaTx: $ref: '#/components/schemas/SolanaTxCmp' description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request]) AuthenticatorAssertionResponse: type: object description: 'Represents the assertion response used by clients when attempting to log in with a known credential https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse' required: - clientDataJSON - authenticatorData - signature properties: authenticatorData: type: string description: 'Contains the standard CTAP2 authenticator data. Must be a valid [`AuthenticatorData`]. This contains information about how key was invoked. https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-authenticatordata' clientDataJSON: type: string description: 'Contains UTF8 encoded JSON which must be a valid [`ClientData`] This data is combined with `authenticator_data` to produce the signature meaning the client attests to the correctness of this data. https://www.w3.org/TR/webauthn-2/#dom-authenticatorresponse-clientdatajson' signature: type: string description: 'The signature of the concatenated `authenticatorData || hash` where `hash` is the SHA256 hash of the `clientDataJSON` buffer: Field Definition: https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-signature Step 11 of `getAssertion` specifies the concatenation: https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion Requirement for SHA-256: https://www.w3.org/TR/webauthn-2/#collectedclientdata-hash-of-the-serialized-client-data' userHandle: type: string description: 'Allows the authenticator to optionally declare the credential identifier they used. https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-userhandle' nullable: true SolanaTxCmp: type: object properties: ignore_blockhash: type: boolean description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different. ChallengePieces: type: object description: Describes how to derive a WebAuthn challenge value. required: - preimage - random_seed properties: preimage: type: string description: 'A base64url encoding of UTF8 JSON. The data in that JSON is endpoint specific, and describes what this FIDO challenge will be used for. Clients can use `preimage` along with `random_seed` to reconstruct the challenge like so: `challenge = HMAC-SHA256(key=random_seed, message=preimage)`' random_seed: type: string description: A random seed that prevents replay attacks BadGatewayErrorCode: type: string enum: - Generic - CustomChainRpcError - EsploraApiError - SentryApiError - CallWebhookError - OAuthProviderError - OidcDisoveryFailed - OidcIssuerJwkEndpointUnavailable - SmtpServerUnavailable InternalErrorCode: type: string enum: - NoMaterialId - InvalidAuditLogEntry - UnexpectedCheckerRule - UnresolvedPolicyReference - UnexpectedAclAction - FidoKeyAssociatedWithMultipleUsers - ClaimsParseError - InvalidThrottleId - InvalidEmailAddress - EmailTemplateRender - OidcIdentityHeaderMissing - OidcIdentityParseError - SystemTimeError - PasswordHashParseError - SendMailError - ReqwestError - EmailConstructionError - TsWriteError - TsQueryError - DbQueryError - DbGetError - DbDeleteError - DbPutError - DbUpdateError - SerdeError - TestAndSetError - DbGetItemsError - DbWriteError - CubistSignerError - CwListMetricsError - CwPutMetricDataError - GetAwsSecretError - SecretNotFound - KmsGenerateRandomError - MalformedTotpBytes - KmsGenerateRandomNoResponseError - CreateKeyError - ParseDerivationPathError - SplitSignerError - CreateImportKeyError - CreateEotsNoncesError - EotsSignError - BabylonCovSignError - CognitoDeleteUserError - CognitoListUsersError - CognitoGetUserError - MissingUserEmail - CognitoResendUserInvitation - CognitoSetUserPasswordError - GenericInternalError - AssumeRoleWithoutEvidence - OidcAuthWithoutOrg - MissingKeyMetadata - KmsEnableKeyError - KmsDisableKeyError - LambdaInvokeError - LambdaNoResponseError - LambdaFailure - LambdaUnparsableResponse - SerializeEncryptedExportKeyError - DeserializeEncryptedExportKeyError - ReEncryptUserExport - S3UploadError - S3DownloadError - S3CopyError - S3ListObjectsError - S3DeleteObjectsError - S3BuildError - S3PresignedUrlError - ManagedStateMissing - InternalHeaderMissing - InvalidInternalHeaderValue - RequestLocalStateAlreadySet - OidcOrgMismatch - OidcIssuerInvalidJwk - InvalidPkForMaterialId - SegwitTweakFailed - UncheckedOrg - SessionOrgIdMissing - AvaSignCredsMissing - AvaSignSignatureMissing - ExpectedRoleSession - InvalidThirdPartyIdentity - CognitoGetUser - SnsSubscribeError - SnsUnsubscribeError - SnsGetSubscriptionAttributesError - SnsSubscriptionAttributesMissing - SnsSetSubscriptionAttributesError - SnsPublishBatchError - InconsistentMultiValueTestAndSet - MaterialIdError - InvalidBtcAddress - HistoricalTxBodyMissing - InvalidOperation - ParentOrgNotFound - OrgParentLoop - ResolvedParentOrgWithNoScopeCeiling - InvalidUploadObjectId - PolicyEngineNotFound - PolicyEngineError - PolicySecretsEncryptionError - CreatePolicyImportKeyError - InvalidAlias - EmptyUpdateModifiedObject - EmptyUpdateModifiedActions - DbContactAddressesInvalid - InvalidEvmSigedRlp - InvalidErc20Data - InvalidRpcUrl SignerErrorCode: oneOf: - $ref: '#/components/schemas/SignerErrorOwnCodes' - $ref: '#/components/schemas/AcceptedValueCode' - $ref: '#/components/schemas/BadRequestErrorCode' - $ref: '#/components/schemas/BadGatewayErrorCode' - $ref: '#/components/schemas/NotFoundErrorCode' - $ref: '#/components/schemas/ForbiddenErrorCode' - $ref: '#/components/schemas/UnauthorizedErrorCode' - $ref: '#/components/schemas/PreconditionErrorCode' - $ref: '#/components/schemas/TimeoutErrorCode' - $ref: '#/components/schemas/ConflictErrorCode' - $ref: '#/components/schemas/InternalErrorCode' EvmTxDepositErrorCode: type: string enum: - EvmTxDepositReceiverMismatch - EvmTxDepositEmptyData - EvmTxDepositEmptyChainId - EvmTxDepositEmptyReceiver - EvmTxDepositUnexpectedValue - EvmTxDepositUnexpectedDataLength - EvmTxDepositNoAbi - EvmTxDepositNoDepositFunction - EvmTxDepositUnexpectedFunctionName - EvmTxDepositUnexpectedValidatorKey - EvmTxDepositInvalidValidatorKey - EvmTxDepositMissingDepositArg - EvmTxDepositWrongDepositArgType - EvmTxDepositValidatorKeyNotInRole - EvmTxDepositUnexpectedWithdrawalCredentials - EvmTxDepositUnresolvedRole - EvmTxDepositInvalidDepositEncoding PublicKeyCredentialDescriptor: type: object description: 'This dictionary contains the attributes that are specified by a caller when referring to a public key credential as an input parameter to the create() or get() methods. It mirrors the fields of the PublicKeyCredential object returned by the latter methods. https://www.w3.org/TR/webauthn-2/#dictionary-credential-descriptor' required: - type - id properties: id: type: string description: 'This member contains the credential ID of the public key credential the caller is referring to. https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialdescriptor-id' transports: type: array items: $ref: '#/components/schemas/AuthenticatorTransport' description: 'This OPTIONAL member contains a hint as to how the client might communicate with the managing authenticator of the public key credential the caller is referring to. The values SHOULD be members of AuthenticatorTransport but client platforms MUST ignore unknown values. The getTransports() operation can provide suitable values for this member. When registering a new credential, the Relying Party SHOULD store the value returned from getTransports(). When creating a PublicKeyCredentialDescriptor for that credential, the Relying Party SHOULD retrieve that stored value and set it as the value of the transports member.' nullable: true type: $ref: '#/components/schemas/PublicKeyCredentialType' AuthenticatorAttestationResponse: type: object description: 'The AuthenticatorAttestationResponse interface represents the authenticator''s response to a client’s request for the creation of a new public key credential. It contains information about the new credential that can be used to identify it for later use, and metadata that can be used by the WebAuthn Relying Party to assess the characteristics of the credential during registration. https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse' required: - clientDataJSON - attestationObject properties: attestationObject: type: string description: 'This attribute contains an attestation object, which is opaque to, and cryptographically protected against tampering by, the client. The attestation object contains both authenticator data and an attestation statement. The former contains the AAGUID, a unique credential ID, and the credential public key. The contents of the attestation statement are determined by the attestation statement format used by the authenticator. It also contains any additional information that the Relying Party''s server requires to validate the attestation statement, as well as to decode and validate the authenticator data along with the JSON-compatible serialization of client data. For more details, see § 6.5 Attestation, § 6.5.4 Generating an Attestation Object, and Figure 6.' clientDataJSON: type: string description: 'This attribute, inherited from AuthenticatorResponse, contains the JSON-compatible serialization of client data (see § 6.5 Attestation) passed to the authenticator by the client in order to generate this credential. The exact JSON serialization MUST be preserved, as the hash of the serialized client data has been computed over it.' ErrorResponse: type: object description: The structure of ErrorResponse must match the response template that AWS uses required: - message - error_code properties: accepted: allOf: - $ref: '#/components/schemas/AcceptedValue' nullable: true error_code: $ref: '#/components/schemas/SignerErrorCode' message: type: string description: Error message policy_eval_tree: description: Optional policy evaluation tree (included in signer responses, when requested) nullable: true request_id: type: string description: Optional request identifier PreconditionErrorOwnCodes: type: string enum: - FailOnMfaRequired - KeyRegionLocked - KeyRegionChangedRecently - MfaRegionLocked - Eth2ProposerSlotTooLow - Eth2AttestationSourceEpochTooLow - Eth2AttestationTargetEpochTooLow - Eth2ConcurrentBlockSigning - Eth2ConcurrentAttestationSigning - Eth2MultiDepositToNonGeneratedKey - Eth2MultiDepositUnknownInitialDeposit - Eth2MultiDepositWithdrawalAddressMismatch - ConcurrentSigningWhenTimeLimitPolicyIsDefined - BabylonEotsConcurrentSigning - TendermintStateError - TendermintConcurrentSigning - MfaApprovalsNotYetValid ClientSessionInfo: type: object description: 'Session information sent to the client. This struct works in tandem with its server-side counterpart [`SessionData`].' required: - session_id - auth_token - refresh_token - epoch - epoch_token - auth_token_exp - refresh_token_exp properties: auth_token: type: string description: Token to use for authorization. auth_token_exp: $ref: '#/components/schemas/EpochDateTime' epoch: type: integer format: int32 description: Epoch at which the token was last refreshed minimum: 0 epoch_token: $ref: '#/components/schemas/B32' refresh_token: type: string description: Token to use for refreshing the `(auth, refresh)` token pair refresh_token_exp: $ref: '#/components/schemas/EpochDateTime' session_id: type: string description: Session ID PolicyErrorOwnCodes: type: string enum: - Inapplicable - SuiTxReceiversDisallowedTransactionKind - SuiTxReceiversDisallowedTransferAddress - SuiTxReceiversDisallowedCommand - BtcTxDisallowedOutputs - BtcSignatureExceededValue - BtcValueOverflow - BtcSighashTypeDisallowed - Eip7702AddressMismatch - EvmTxReceiverMismatch - EvmTxChainIdMismatch - EvmTxSenderMismatch - EvmTxExceededValue - EvmTxExceededGasCost - EvmTxGasCostUndefined - EvmDataDisallowed - Erc20DataInvalid - EvmContractAddressUndefined - EvmContractChainIdUndefined - EvmDataNotDefined - EvmDataInvalid - EvmContractNotInAllowlist - Erc20ExceededTransferLimit - Erc20ReceiverMismatch - Erc20ExceededApproveLimit - Erc20SpenderMismatch - EvmFunctionNotInAllowlist - EvmFunctionCallInvalid - EvmFunctionCallDisallowedArg - PolicyDisjunctionError - PolicyNegationError - Eth2ExceededMaxUnstake - Eth2ConcurrentUnstaking - NotInIpv4Allowlist - NotInOriginAllowlist - NotInOperationAllowlist - InvalidSourceIp - RawSigningNotAllowed - DiffieHellmanExchangeNotAllowed - Eip712SigningNotAllowed - OidcSourceNotAllowed - NoOidcAuthSourcesDefined - AddKeyToRoleDisallowed - KeysAlreadyInRole - KeyInMultipleRoles - KeyAccessError - RequireRoleSessionKeyAccessError - BtcMessageSigningNotAllowed - Eip191SigningNotAllowed - Eip7702SigningNotAllowed - TaprootSigningDisallowed - SegwitSigningDisallowed - PsbtSigningDisallowed - BabylonStakingDisallowed - TimeLocked - CelPolicyDenied - BabylonStakingNetwork - BabylonStakingParamsVersion - BabylonStakingExplicitParams - BabylonStakingStakerPk - BabylonStakingFinalityProviderPk - BabylonStakingLockTime - BabylonStakingValue - BabylonStakingChangeAddress - BabylonStakingFee - BabylonStakingWithdrawalAddress - BabylonStakingBbnAddress - SolanaInstructionCountLow - SolanaInstructionCountHigh - SolanaNotInInstructionAllowlist - SolanaInstructionMismatch - WasmPoliciesDisabled - WasmPolicyDenied - WasmPolicyFailed - WebhookPoliciesDisabled - DeniedByWebhook - ExplicitlyDenied TotpApproveRequest: type: object required: - code properties: code: type: string description: TOTP verification code AcceptedValueCode: type: string enum: - SignDryRun - BinanceDryRun - BybitDryRun - CoinbaseDryRun - MfaRequired AuthenticatorTransport: type: string description: 'Authenticators may implement various transports for communicating with clients. This enumeration defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a specific credential. Note that these hints represent the WebAuthn Relying Party''s best belief as to how an authenticator may be reached. A Relying Party will typically learn of the supported transports for a public key credential via getTransports(). https://www.w3.org/TR/webauthn-2/#enumdef-authenticatortransport' enum: - usb - nfc - ble - internal BybitDryRunArgs: type: object required: - method - url - payload properties: method: type: string description: The Bybit API method that would have been used payload: type: string description: The request body (for POST endpoints) or query string (for GET endpoints). url: type: string description: The Bybit API url that would have been called BinanceDryRunArgs: type: object required: - method - url properties: method: type: string description: The Binance API method that would have been used url: type: string description: The Binance API url method that would have been called CoinbaseDryRunArgs: type: object required: - method - url properties: method: type: string description: The Coinbase API method that would have been used url: type: string description: The Coinbase API url method that would have been called PublicKeyCredentialType: type: string description: 'This enumeration defines the valid credential types. It is an extension point; values can be added to it in the future, as more credential types are defined. The values of this enumeration are used for versioning the Authentication Assertion and attestation structures according to the type of the authenticator. Currently one credential type is defined, namely "public-key". https://www.w3.org/TR/webauthn-2/#enumdef-publickeycredentialtype' enum: - public-key ConflictErrorCode: type: string enum: - ConcurrentRequestDisallowed - ConcurrentLockCreation Id: type: string SignDryRunArgs: type: object required: - mfa_requests properties: mfa_requests: type: array items: $ref: '#/components/schemas/MfaRequestInfo' description: Whether MFA is required policy_eval_tree: description: Optional policy evaluation tree, if requested nullable: true MfaType: type: string format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`' description: Different types that can be used to approve an MFA request pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$ PolicyErrorCode: oneOf: - $ref: '#/components/schemas/PolicyErrorOwnCodes' - $ref: '#/components/schemas/EvmTxDepositErrorCode' MfaRequestInfo: type: object description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). required: - id - expires_at - request - status - created_by - provenance properties: created_at: $ref: '#/components/schemas/EpochDateTime' created_by: type: string description: The session identity (user or role) that created this request. expires_at: $ref: '#/components/schemas/EpochDateTime' id: type: string description: Approval request ID. not_valid_until: $ref: '#/components/schemas/EpochDateTime' provenance: type: string description: MFA policy provenance enum: - Org - Key - KeyInRole - Role - User - EditPolicy receipt: allOf: - $ref: '#/components/schemas/Receipt' nullable: true region: type: string description: The region this MFA request was created in. It can only be redeemed from the same region. related_ids: type: array items: type: string description: 'If set, contains the IDs of all MFA requests (including this one!) that were generated at once for the same CubeSigner operation. If not set, it means that this was the lone MFA request generated for `request`. This is useful so that a client can discover all the MFAs whose receipts must be submitted together to carry out the original CubeSigner operation.' request: $ref: '#/components/schemas/HttpRequest' status: $ref: '#/components/schemas/Status' BadRequestErrorCode: type: string enum: - GenericBadRequest - DisallowedAllowRuleReference - InvalidPaginationToken - InvalidEmail - InvalidEmailTemplate - QueryMetricsError - InvalidTelegramData - ValidationError - WebhookPolicyTimeoutOutOfBounds - WebhookPolicyDisallowedUrlScheme - WebhookPolicyDisallowedUrlHost - WebhookPolicyDisallowedHeaders - ReservedName - UserEmailNotConfigured - EmailPasswordNotFound - PasswordAuthNotAllowedByInvitation - OneTimeCodeExpired - InvalidBody - InvalidJwt - InvitationNoLongerValid - TokenRequestError - InvalidMfaReceipt - InvalidMfaPolicyCount - InvalidMfaPolicyNumAuthFactors - InvalidMfaPolicyNumAllowedApprovers - InvalidMfaPolicyGracePeriodTooLong - InvalidBabylonStakingPolicyParams - InvalidSuiTxReceiversEmptyAllowlist - InvalidBtcTxReceiversEmptyAllowlist - InvalidRequireRoleSessionAllowlist - InvalidCreateKeyCount - InvalidDiffieHellmanCount - OrgInviteExistingUser - OrgUserAlreadyExists - OrgNameTaken - KwkNotFoundInRegion - OrgIsNotOrgExport - RoleNameTaken - PolicyNameTaken - NameTaken - ContactNameInvalid - ContactAddressesInvalid - ContactLabelInvalid - ContactModified - PolicyNotFound - PolicyVersionNotFound - PolicyRuleDisallowedByType - PolicyTypeDisallowed - PolicyDuplicateError - PolicyStillAttached - PolicyModified - PolicyNotAttached - AddKeyToRoleCountTooHigh - InvalidKeyId - InvalidTimeLockAlreadyInThePast - InvalidRestrictedScopes - InvalidUpdate - InvalidMetadataLength - InvalidLength - InvalidKeyMaterialId - KeyNotFound - SiweChallengeNotFound - SiweInvalidRequest - SiwsChallengeNotFound - SiwsInvalidRequest - UserExportDerivedKey - UserExportPublicKeyInvalid - NistP256PublicKeyInvalid - UnableToAccessSmtpRelay - UserExportInProgress - RoleNotFound - InvalidRoleNameOrId - InvalidMfaReceiptOrgIdMissing - InvalidMfaReceiptInvalidOrgId - MfaRequestNotFound - InvalidKeyType - InvalidPropertiesForKeyType - MismatchedKeyPropertiesPatch - MissingBinanceApiKey - MissingBybitApiKey - MissingCoinbaseApiKey - BinanceKeyMasterMismatch - BybitAccountMismatch - InvalidKeyMaterial - InvalidHexValue - InvalidBase32Value - InvalidBase58Value - InvalidBase64Value - InvalidSs58Value - InvalidForkVersionLength - InvalidEthAddress - InvalidStellarAddress - InvalidOrgNameOrId - InvalidUpdateOrgRequestDisallowedMfaType - InvalidUpdateOrgRequestEmptyAllowedMfaTypes - EmailOtpDelayTooShortForRegisterMfa - InvalidStakeDeposit - InvalidBlobSignRequest - InvalidDiffieHellmanRequest - InvalidSolanaSignRequest - InvalidEip712SignRequest - InvalidEip7702SignRequest - OnlySpecifyOne - IncompatibleParams - NoOidcDataInProof - InvalidEvmSignRequest - InvalidEth2SignRequest - InvalidDeriveKeyRequest - InvalidStakingAmount - CustomStakingAmountNotAllowedForWrapperContract - InvalidUnstakeRequest - InvalidCreateUserRequest - UserAlreadyExists - IdpUserAlreadyExists - CognitoUserAlreadyOrgMember - UserNotFound - UserWithEmailNotFound - PolicyKeyMismatch - EmptyScopes - InvalidScopesForRoleSession - InvalidLifetime - NoSingleKeyForUser - InvalidOrgPolicyRule - SourceIpAllowlistEmpty - LimitWindowTooLong - Erc20ContractDisallowed - EmptyRuleError - PolicyFieldValidationError - OptionalListEmpty - MultipleExclusiveFieldsProvided - DuplicateFieldEntry - InvalidRange - InvalidOrgPolicyRepeatedRule - InvalidSuiTransaction - SuiSenderMismatch - AvaSignHashError - AvaSignError - BtcSegwitHashError - BtcTaprootHashError - BtcSignError - TaprootSignError - Eip712SignError - InvalidMemberRoleInUserAdd - InvalidMemberRoleInRecipientAdd - ThirdPartyUserAlreadyExists - OidcIdentityAlreadyExists - UserAlreadyHasIdentity - ThirdPartyUserNotFound - DeleteOidcUserError - DeleteUserError - SessionRoleMismatch - InvalidOidcToken - InvalidOidcIdentity - OidcIssuerUnsupported - OidcIssuerNotAllowed - OidcIssuerNoApplicableJwk - FidoKeyAlreadyRegistered - FidoKeySignCountTooLow - FidoVerificationFailed - FidoChallengeMfaMismatch - UnsupportedLegacyCognitoSession - InvalidIdentityProof - PaginationDataExpired - ExistingKeysViolateExclusiveKeyAccess - ExportDelayTooShort - ExportWindowTooLong - InvalidTotpFailureLimit - InvalidEip191SignRequest - CannotResendUserInvitation - InvalidNotificationEndpointCount - CannotDeletePendingSubscription - InvalidNotificationUrlProtocol - EmptyOneOfOrgEventFilter - EmptyAllExceptOrgEventFilter - InvalidTapNodeHash - InvalidOneTimeCode - MessageNotFound - MessageAlreadySigned - MessageRejected - MessageReplaced - InvalidMessageType - EmptyAddress - InvalidEth2SigningPolicySlotRange - InvalidEth2SigningPolicyEpochRange - InvalidEth2SigningPolicyTimestampRange - InvalidEth2SigningPolicyOverlappingRule - RpcUrlMissing - MmiChainIdMissing - EthersInvalidRpcUrl - EthersGetTransactionCountError - InvalidPassword - BabylonStakingFeePlusDustOverflow - BabylonStaking - BabylonStakingIncorrectKey - BabylonStakingSegwitNonDeposit - BabylonStakingRegistrationRequiresTaproot - PsbtSigning - TooManyResets - TooManyRequests - TooManyFailedLogins - BadBtcMessageSignP2shFlag - InvalidTendermintRequest - PolicyVersionMaxReached - PolicyVersionInvalid - PolicySecretLimitReached - PolicySecretTooLarge - InvalidImportKey - AlienOwnerInvalid - EmptyUpdateRequest - InvalidPolicyReference - PolicyEngineDisabled - InvalidWasmPolicy - CelProgramTooLarge - InvalidPolicy - RedundantDerivationPath - ImportKeyMissing - InvalidAbiMethods - BabylonCovSign - InvalidPolicyLogsRequest - UserProfileMigrationMultipleEntries - UserProfileMigrationTooManyItems - InputTooShort - InvalidTweakLength - InvalidCustomChains - InvalidRpcRequest MfaVote: type: string enum: - approve - reject SignerErrorOwnCodes: type: string enum: - PreComputed - StatusCodeWithMessage - JrpcError - UnhandledError - ProxyStartError - EnclaveError - PolicyErrorWithEvalTree - RpcApi ForbiddenErrorCode: type: string enum: - AlienKeyCreate - CannotAssumeIdentity - SentryDisallowed - PasskeyLoginDisabled - PasskeyNotRegistered - CannotCreateOrg - WrongMfaEmailOtpJwt - OrgFlagNotSet - FidoRequiredToRemoveTotp - OidcIdentityLimitReached - OidcScopeCeilingMissing - OidcIssuerNotAllowedForMemberRole - OidcNoMemberRolesAllowed - EmailOtpNotConfigured - MfaChallengeExpired - ChainIdNotAllowed - InvalidOrg - OrgIdMismatch - SessionForWrongOrg - SelfDelete - SelfDisable - SelfMfaReset - InvalidOrgMembershipRoleChange - UserDisabled - OrgDisabled - OrgNotFound - OrgWithoutOwner - OrphanedUser - OidcUserNotFound - UserNotInOrg - UserNotOrgOwner - UserNotKeyOwner - InvalidRole - DisabledRole - KeyDisabled - KeyNotInRole - ContactNotInOrg - UserExportRequestNotInOrg - UserExportRequestInvalid - UserExportDisabled - UserNotOriginalKeyOwner - UserNotInRole - MustBeFullMember - SessionExpired - SessionChanged - SessionRevoked - ExpectedUserSession - SessionRoleChanged - ScopedNameNotFound - SessionInvalidEpochToken - SessionInvalidRefreshToken - SessionRefreshTokenExpired - InvalidAuthHeader - SessionNotFound - InvalidArn - SessionInvalidAuthToken - SessionAuthTokenExpired - SessionPossiblyStolenToken - MfaDisallowedIdentity - MfaDisallowedApprover - MfaTypeNotAllowed - MfaNotApprovedYet - MfaConfirmationCodeMismatch - MfaHttpRequestMismatch - MfaRemoveBelowMin - MfaOrgRequirementNotMet - MfaRegistrationDisallowed - TotpAlreadyConfigured - TotpConfigurationChanged - MfaTotpBadConfiguration - MfaTotpBadCode - MfaTotpRateLimit - ImproperSessionScope - FullSessionRequired - SessionWithoutAnyScopeUnder - UserRoleUnprivileged - MemberRoleForbidden - MfaNotConfigured - RemoveLastOidcIdentity - OperationNotAllowed - OrgExportRetrievalDisabled - ChangingKeyExportRequirementIsDisabled - AutoAddBlsKeyToProtectedRole - UserNotPolicyOwner - UserNotContactOwner - UserNotBucketOwner - LegacySessionCannotHaveScopeCeiling - RoleInParentOrgNotAllowed - RemoveKeyFromRoleUserNotAllowed - SiweChallengeExpired - SiweMessageNotValid - SiweMessageInvalidSignature - SiwsChallengeExpired - SiwsDomain - SiwsMessageInvalid - Acl PublicKeyCredentialRequestOptions: type: object description: 'The `PublicKeyCredentialRequestOptions` dictionary supplies get() with the data it needs to generate an assertion. Its challenge member MUST be present, while its other members are OPTIONAL. This struct is also used as part of the verification procedure for assertions' required: - challenge properties: allowCredentials: type: array items: $ref: '#/components/schemas/PublicKeyCredentialDescriptor' description: 'This OPTIONAL member contains a list of PublicKeyCredentialDescriptor objects representing public key credentials acceptable to the caller, in descending order of the caller’s preference (the first item in the list is the most preferred credential, and so on down the list). https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-allowcredentials' challenge: type: string description: 'This member represents a challenge that the selected authenticator signs, along with other data, when producing an authentication assertion. https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-challenge' extensions: type: object nullable: true rpId: type: string description: 'This OPTIONAL member specifies the relying party identifier claimed by the caller. If omitted, its value will be the CredentialsContainer object’s relevant settings object''s origin''s effective domain. https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-rpid' nullable: true timeout: type: integer format: int32 description: 'This OPTIONAL member specifies a time, in milliseconds, that the caller is willing to wait for the call to complete. The value is treated as a hint, and MAY be overridden by the client. https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-timeout' nullable: true minimum: 0 userVerification: $ref: '#/components/schemas/UserVerificationRequirement' FidoAssertAnswer: type: object description: Sent from the client to the server to answer a fido challenge required: - challenge_id - credential properties: challenge_id: type: string description: The ID of the challenge that was returned from the POST endpoint credential: $ref: '#/components/schemas/PublicKeyCredential' PreconditionErrorCode: oneOf: - $ref: '#/components/schemas/PreconditionErrorOwnCodes' - $ref: '#/components/schemas/PolicyErrorCode' ApprovalInfo: type: object required: - timestamp properties: timestamp: $ref: '#/components/schemas/EpochDateTime' HttpRequest: type: object description: 'Information about the request. Captures all the relevant info (including the request body) about requests that require MFA. We use this to verify that when a request is resumed (after obtaining necessary MFA approvals) it is exactly the same as it originally was.' required: - method - path properties: body: type: object description: HTTP request body nullable: true method: type: string description: HTTP method of the request path: type: string description: HTTP path of the request, excluding the host NewSessionResponse: type: object description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). required: - org_id - token - refresh_token - session_info properties: expiration: type: integer format: int64 description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. example: 1701879640 minimum: 0 org_id: $ref: '#/components/schemas/Id' refresh_token: type: string description: Token that can be used to refresh this session. session_info: $ref: '#/components/schemas/ClientSessionInfo' token: type: string description: 'New token to be used for authentication. Requests to signing endpoints should include this value in the `Authorization` header.' Receipt: type: object description: Receipt that an MFA request was approved. required: - confirmation - final_approver - timestamp properties: confirmation: type: string description: Confirmation code the user needs to present when resuming the original request. example: ba1d75dd-d999-4c1b-944d-25c25440c8af final_approver: type: string description: The ID of the logged-in user whose action created this approval. timestamp: $ref: '#/components/schemas/EpochDateTime' UnauthorizedErrorCode: type: string enum: - AuthorizationHeaderMissing - EndpointRequiresUserSession - RefreshTokenMissing TimeoutErrorCode: type: string enum: - PolicyEngineTimeout - WasmPolicyExecutionTimeout Status: type: object required: - count - num_auth_factors - allowed_approvers - approved_by properties: allowed_approvers: type: array items: type: string description: Users who are allowed to approve. Must be non-empty. allowed_mfa_types: type: array items: $ref: '#/components/schemas/MfaType' description: Allowed approval types. When omitted, defaults to any. nullable: true approved_by: type: object description: Users who have already approved additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/ApprovalInfo' count: type: integer format: int32 description: How many users must approve minimum: 0 num_auth_factors: type: integer format: int32 description: How many auth factors to require per user minimum: 0 request_comparer: $ref: '#/components/schemas/HttpRequestCmp' EvmTxCmp: type: object properties: grace: type: integer format: int64 description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once. In this case, however, because EVM transactions already have a replay prevention mechanism (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to indicate how long an MFA receipt should remain valid after its first use. Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to ensure that any subsequent requests that claim the same receipt must sign for the same nonce as the request we signed originally with that receipt. Also note that the grace period cannot extend the lifetime of an MFA request beyond its original expiration date. The grace period must not be greater than 30 days.' nullable: true minimum: 0 ignore_gas: type: boolean description: Whether the 'gas' property of the EVM transaction is allowed to be different. ignore_nonce: type: boolean description: Whether the 'nonce' property of the EVM transaction is allowed to be different. responses: EmailOtpResponse: description: 'The HTTP response to an email OTP request. This response contains an OIDC token without a signature. The signature is sent to the end-user in an email. The token can be reconstructed by concatenating the `partial_token` with the signature.' content: application/json: schema: type: object description: 'The HTTP response to an email OTP request. This response contains an OIDC token without a signature. The signature is sent to the end-user in an email. The token can be reconstructed by concatenating the `partial_token` with the signature.' required: - partial_token properties: partial_token: type: string description: 'The OIDC token without the signature. (The signature, which is actually a MAC, is sent to the end-user in an email)' FidoAssertChallenge: description: '' content: application/json: schema: allOf: - allOf: - $ref: '#/components/schemas/ChallengePieces' - type: object required: - options properties: options: $ref: '#/components/schemas/PublicKeyCredentialRequestOptions' description: 'An extended form of `PublicKeyCredentialRequestOptions` that allows clients to derive the WebAuthn challenge from a structured preimage. This ensures that the webuathn signature can only be used for a specific purpose' - type: object required: - challenge_id properties: challenge_id: type: string description: The id of the challenge. Must be supplied when answering the challenge. MfaRequestInfo: description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). content: application/json: schema: type: object description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). required: - id - expires_at - request - status - created_by - provenance properties: created_at: $ref: '#/components/schemas/EpochDateTime' created_by: type: string description: The session identity (user or role) that created this request. expires_at: $ref: '#/components/schemas/EpochDateTime' id: type: string description: Approval request ID. not_valid_until: $ref: '#/components/schemas/EpochDateTime' provenance: type: string description: MFA policy provenance enum: - Org - Key - KeyInRole - Role - User - EditPolicy receipt: allOf: - $ref: '#/components/schemas/Receipt' nullable: true region: type: string description: The region this MFA request was created in. It can only be redeemed from the same region. related_ids: type: array items: type: string description: 'If set, contains the IDs of all MFA requests (including this one!) that were generated at once for the same CubeSigner operation. If not set, it means that this was the lone MFA request generated for `request`. This is useful so that a client can discover all the MFAs whose receipts must be submitted together to carry out the original CubeSigner operation.' request: $ref: '#/components/schemas/HttpRequest' status: $ref: '#/components/schemas/Status' PaginatedListMfaResponse: description: '' content: application/json: schema: allOf: - type: object required: - mfa_requests properties: mfa_requests: type: array items: $ref: '#/components/schemas/MfaRequestInfo' description: All pending MFA requests - type: object properties: last_evaluated_key: type: string description: 'If set, the content of `response` does not contain the entire result set. To fetch the next page of the result set, call the same endpoint but specify this value as the ''page.start'' query parameter.' nullable: true description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` value (which can the user pass back to use as a url query parameter to continue pagination).' securitySchemes: Oidc: type: apiKey in: header name: Authorization description: OIDC tokens allow users to authenticate using a third-party service. These are exchanged for signer session tokens. SignerAuth: type: apiKey in: header name: Authorization description: Signing API end-points use session tokens for auth. Specifically, with each request you need to use the \`token\` from your signer session (which you create with `cs token create`).