openapi: 3.0.3 info: title: CubeSigner Account OAuth2 API description: The CubeSigner management and signing service. contact: name: Cubist Inc. email: hello@cubist.dev version: v0.1.0 servers: - url: https://gamma.signer.cubist.dev description: Testing and staging environment - url: https://prod.signer.cubist.dev description: Production environment security: - Cognito: [] tags: - name: OAuth2 paths: /v0/oauth/token: post: tags: - OAuth2 summary: Token refresh endpoint, compliant with OAuth. description: 'Token refresh endpoint, compliant with OAuth. The body content type can be either ''application/json'' or ''application/x-www-form-urlencoded''. ' operationId: oauth2TokenRefresh requestBody: content: application/json: schema: $ref: '#/components/schemas/TokenRequest' required: true responses: '200': $ref: '#/components/responses/TokenResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} /v0/org/{org_id}/oauth2/twitter: post: tags: - OAuth2 summary: Mint an OIDC ID token for Twitter description: 'Mint an OIDC ID token for Twitter This function acts identically to Twitter''s [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint, but extends the output with an `id_token`. This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token. Callers must request *at least* scopes `tweet.read` and `users.read` during auth with twitter. By default, the id token does not contain a confirmed email; callers can request this field be populated by requesting the `users.email` scope and adding `fetch_email` as a URL parameter to this route. > [!IMPORTANT] > This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter.' operationId: oauth2Twitter parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a - name: fetch_email in: query required: false schema: type: boolean nullable: true requestBody: content: application/json: schema: type: object additionalProperties: type: string required: true responses: '200': $ref: '#/components/responses/TokenResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} /v0/org/{org_id}/oidc: post: tags: - OAuth2 summary: Login with OIDC description: 'Login with OIDC Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session. MFA is required when: - an MFA policy is explicitly attached to the user logging in (e.g., an org owner can do that at user creation time to require certain kind of MFA) - the user has at least 1 MFA factor configured' operationId: oidcAuth parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/OidcLoginRequest' required: true responses: '200': $ref: '#/components/responses/NewSessionResponse' '202': description: '' content: application/json: schema: $ref: '#/components/schemas/AcceptedResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - Oidc: [] /v0/org/{org_id}/oidc/email-otp: post: tags: - OAuth2 summary: Initiate login via email token description: 'Initiate login via email token This endpoint generates an OIDC token without a signature (of the form `header.payload.`), and sends the signature to the user''s email. Client applications can reconstruct the token by concatenating the `partial_token` with the signature, producing a valid OIDC token of the form `header.payload.signature` The token can then be used to authenticate the user. > [!IMPORTANT] > For this endpoint to succeed, the org must be configured to: > 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID > 2. Have an email sender configured for OTPs' operationId: emailOtpAuth parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/EmailOtpRequest' required: true responses: '200': $ref: '#/components/responses/EmailOtpResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} /v0/org/{org_id}/oidc/siwe: post: tags: - OAuth2 summary: Initiate login via Sign-in With Ethereum (SIWE). description: 'Initiate login via Sign-in With Ethereum (SIWE). This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard OIDC auth route. > [!IMPORTANT] > For this endpoint to succeed, the org must be configured to: > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID' operationId: siweInit parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/SiweInitRequest' required: true responses: '200': $ref: '#/components/responses/SiweInitResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} patch: tags: - OAuth2 summary: Complete login via Sign-in With Ethereum (SIWE) description: 'Complete login via Sign-in With Ethereum (SIWE) If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. > [!IMPORTANT] > For this endpoint to succeed, the org must be configured to: > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID' operationId: siweComplete parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/SiweCompleteRequest' required: true responses: '200': $ref: '#/components/responses/SiweCompleteResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} /v0/org/{org_id}/oidc/siws: post: tags: - OAuth2 summary: Initiate login via Sign-in With Solana (SIWS). description: 'Initiate login via Sign-in With Solana (SIWS). This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard OIDC auth route. > [!IMPORTANT] > For this endpoint to succeed, the org must be configured to: > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID' operationId: siwsInit parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/SiwsInitRequest' required: true responses: '200': $ref: '#/components/responses/SiwsInitResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} patch: tags: - OAuth2 summary: Complete login via Sign-in With Solana (SIWS) description: 'Complete login via Sign-in With Solana (SIWS) If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. > [!IMPORTANT] > For this endpoint to succeed, the org must be configured to: > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID' operationId: siwsComplete parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/SiwsCompleteRequest' required: true responses: '200': $ref: '#/components/responses/SiwsCompleteResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} /v0/org/{org_id}/oidc/telegram: post: tags: - OAuth2 summary: Allows a user to authenticate with the telegram API using the tgWebAppData value description: 'Allows a user to authenticate with the telegram API using the tgWebAppData value The token has the following properties: - The `sub` field is the telegram user ID - The `iss` field depends on the chosen environment: - `https://shim.oauth2.cubist.dev/telegram/production` for the production environment - `https://shim.oauth2.cubist.dev/telegram/test` for the test environment - The `aud` field is the provided telegram bot ID - The `exp` field is derived from the `auth_date` field in the telegram data Fails if the telegram data is invalid or the signature is invalid' operationId: telegramAuth parameters: - name: org_id in: path description: Name or ID of the desired Org required: true schema: type: string example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a requestBody: content: application/json: schema: $ref: '#/components/schemas/TelegramAuthRequest' required: true responses: '200': $ref: '#/components/responses/TelegramAuthResponse' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} components: schemas: EpochDateTime: type: integer format: int64 description: 'DateTime measured in seconds since unix epoch. A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`] representing the number of seconds since [`SystemTime::UNIX_EPOCH`].' minimum: 0 MfaRequiredArgs: type: object required: - id - ids - org_id properties: id: type: string description: Always set to first MFA id from `Self::ids` ids: type: array items: type: string minLength: 1 description: Non-empty MFA request IDs org_id: type: string description: Organization id policy_eval_tree: description: Optional policy evaluation tree (included in signer responses, when requested) nullable: true session: allOf: - $ref: '#/components/schemas/NewSessionResponse' nullable: true B32: type: string description: Wrapper around a zeroizing 32-byte fixed-size array SignInInput: type: object description: 'The structured input to a Sign-In With Solana request (`SolanaSignInInput` in the spec). The relying party fills in `domain`/`address`/`uri`/... and the wallet renders it into the human-readable message (see [SignInInput::to_message_text]) that it signs.' required: - domain - address properties: address: type: string description: The base58-encoded Solana (ed25519) public key performing the sign-in. chainId: allOf: - $ref: '#/components/schemas/SolanaNetwork' nullable: true domain: type: string description: The RFC 3986 authority that is requesting the sign-in. expirationTime: type: string description: The ISO 8601 datetime string after which the signed message is no longer valid. nullable: true issuedAt: type: string description: The ISO 8601 datetime string of the time the message was issued. nullable: true nonce: type: string description: A randomized token used to prevent replay attacks; at least 8 alphanumeric characters. nullable: true notBefore: type: string description: The ISO 8601 datetime string before which the signed message is not yet valid. nullable: true requestId: type: string description: A system-specific identifier that may be used to uniquely refer to the sign-in request. nullable: true resources: type: array items: type: string description: A list of RFC 3986 URIs the user wishes to have resolved as part of the authentication. nullable: true statement: type: string description: A human-readable ASCII assertion that the user will sign; must not contain a newline. nullable: true uri: type: string description: An RFC 3986 URI referring to the resource that is the subject of the sign-in. nullable: true version: type: string description: The version of the message (currently always `1`). nullable: true AcceptedValue: oneOf: - type: object required: - SignDryRun properties: SignDryRun: $ref: '#/components/schemas/SignDryRunArgs' - type: object required: - BinanceDryRun properties: BinanceDryRun: $ref: '#/components/schemas/BinanceDryRunArgs' - type: object required: - BybitDryRun properties: BybitDryRun: $ref: '#/components/schemas/BybitDryRunArgs' - type: object required: - CoinbaseDryRun properties: CoinbaseDryRun: $ref: '#/components/schemas/CoinbaseDryRunArgs' - type: object required: - MfaRequired properties: MfaRequired: $ref: '#/components/schemas/MfaRequiredArgs' description: Different responses we return for success status codes. EmailOtpRequest: type: object description: The request users send to initiate email OTP required: - email properties: email: type: string description: The email which will receive the OTP RatchetConfig: type: object properties: auth_lifetime: type: integer format: int64 description: 'The lifetime (in seconds) of auth tokens for this session. Auth tokens can be refreshed (renewed) using a valid (unexpired) refresh token, but not beyond the session lifetime.' default: 300 example: 3600 minimum: 0 grace_lifetime: type: integer format: int64 description: 'The amount of time (in seconds) that an auth token for this session remains valid after it has been refreshed and a new auth token has been issued. This helps to address concurrency hazards, for example, if one thread makes requests with auth token while another refreshes it.' default: 30 example: 30 minimum: 0 refresh_lifetime: type: integer format: int64 description: 'The lifetime (in seconds) of refresh tokens for this session. If this value is shorter than the session lifetime, inactive sessions will become invalid once the auth and refresh tokens have both expired.' default: 86400 example: 43200 minimum: 0 session_lifetime: type: integer format: int64 description: 'The lifetime (in seconds) of the session. The session cannot be extended beyond its original lifetime.' default: 31536000 example: 86400 minimum: 0 NotFoundErrorCode: type: string enum: - UriSegmentMissing - UriSegmentInvalid - TotpNotConfigured - FidoKeyNotFound - FidoChallengeNotFound - TotpChallengeNotFound - UserExportRequestNotFound - UserExportCiphertextNotFound - OrgExportCiphertextNotFound - UploadObjectNotFound - PolicySecretNotFound - BucketMetaNotFound - TimestreamDisabled - CustomChainNotFound - InvitationNotFound - TransactionNotFound - EmailConfigNotFound HttpRequestCmp: oneOf: - type: string description: The requests must match exactly. Any given MFA receipt can be used at most once. enum: - Eq - type: object required: - EvmTx properties: EvmTx: $ref: '#/components/schemas/EvmTxCmp' - type: object required: - SolanaTx properties: SolanaTx: $ref: '#/components/schemas/SolanaTxCmp' description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request]) BadGatewayErrorCode: type: string enum: - Generic - CustomChainRpcError - EsploraApiError - SentryApiError - CallWebhookError - OAuthProviderError - OidcDisoveryFailed - OidcIssuerJwkEndpointUnavailable - SmtpServerUnavailable SolanaTxCmp: type: object properties: ignore_blockhash: type: boolean description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different. TokenRequest: type: object required: - grant_type - refresh_token properties: grant_type: $ref: '#/components/schemas/RefreshGrantType' refresh_token: type: string description: The refresh token issued to the client. InternalErrorCode: type: string enum: - NoMaterialId - InvalidAuditLogEntry - UnexpectedCheckerRule - UnresolvedPolicyReference - UnexpectedAclAction - FidoKeyAssociatedWithMultipleUsers - ClaimsParseError - InvalidThrottleId - InvalidEmailAddress - EmailTemplateRender - OidcIdentityHeaderMissing - OidcIdentityParseError - SystemTimeError - PasswordHashParseError - SendMailError - ReqwestError - EmailConstructionError - TsWriteError - TsQueryError - DbQueryError - DbGetError - DbDeleteError - DbPutError - DbUpdateError - SerdeError - TestAndSetError - DbGetItemsError - DbWriteError - CubistSignerError - CwListMetricsError - CwPutMetricDataError - GetAwsSecretError - SecretNotFound - KmsGenerateRandomError - MalformedTotpBytes - KmsGenerateRandomNoResponseError - CreateKeyError - ParseDerivationPathError - SplitSignerError - CreateImportKeyError - CreateEotsNoncesError - EotsSignError - BabylonCovSignError - CognitoDeleteUserError - CognitoListUsersError - CognitoGetUserError - MissingUserEmail - CognitoResendUserInvitation - CognitoSetUserPasswordError - GenericInternalError - AssumeRoleWithoutEvidence - OidcAuthWithoutOrg - MissingKeyMetadata - KmsEnableKeyError - KmsDisableKeyError - LambdaInvokeError - LambdaNoResponseError - LambdaFailure - LambdaUnparsableResponse - SerializeEncryptedExportKeyError - DeserializeEncryptedExportKeyError - ReEncryptUserExport - S3UploadError - S3DownloadError - S3CopyError - S3ListObjectsError - S3DeleteObjectsError - S3BuildError - S3PresignedUrlError - ManagedStateMissing - InternalHeaderMissing - InvalidInternalHeaderValue - RequestLocalStateAlreadySet - OidcOrgMismatch - OidcIssuerInvalidJwk - InvalidPkForMaterialId - SegwitTweakFailed - UncheckedOrg - SessionOrgIdMissing - AvaSignCredsMissing - AvaSignSignatureMissing - ExpectedRoleSession - InvalidThirdPartyIdentity - CognitoGetUser - SnsSubscribeError - SnsUnsubscribeError - SnsGetSubscriptionAttributesError - SnsSubscriptionAttributesMissing - SnsSetSubscriptionAttributesError - SnsPublishBatchError - InconsistentMultiValueTestAndSet - MaterialIdError - InvalidBtcAddress - HistoricalTxBodyMissing - InvalidOperation - ParentOrgNotFound - OrgParentLoop - ResolvedParentOrgWithNoScopeCeiling - InvalidUploadObjectId - PolicyEngineNotFound - PolicyEngineError - PolicySecretsEncryptionError - CreatePolicyImportKeyError - InvalidAlias - EmptyUpdateModifiedObject - EmptyUpdateModifiedActions - DbContactAddressesInvalid - InvalidEvmSigedRlp - InvalidErc20Data - InvalidRpcUrl SignerErrorCode: oneOf: - $ref: '#/components/schemas/SignerErrorOwnCodes' - $ref: '#/components/schemas/AcceptedValueCode' - $ref: '#/components/schemas/BadRequestErrorCode' - $ref: '#/components/schemas/BadGatewayErrorCode' - $ref: '#/components/schemas/NotFoundErrorCode' - $ref: '#/components/schemas/ForbiddenErrorCode' - $ref: '#/components/schemas/UnauthorizedErrorCode' - $ref: '#/components/schemas/PreconditionErrorCode' - $ref: '#/components/schemas/TimeoutErrorCode' - $ref: '#/components/schemas/ConflictErrorCode' - $ref: '#/components/schemas/InternalErrorCode' EvmTxCmp: type: object properties: grace: type: integer format: int64 description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once. In this case, however, because EVM transactions already have a replay prevention mechanism (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to indicate how long an MFA receipt should remain valid after its first use. Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to ensure that any subsequent requests that claim the same receipt must sign for the same nonce as the request we signed originally with that receipt. Also note that the grace period cannot extend the lifetime of an MFA request beyond its original expiration date. The grace period must not be greater than 30 days.' nullable: true minimum: 0 ignore_gas: type: boolean description: Whether the 'gas' property of the EVM transaction is allowed to be different. ignore_nonce: type: boolean description: Whether the 'nonce' property of the EVM transaction is allowed to be different. EvmTxDepositErrorCode: type: string enum: - EvmTxDepositReceiverMismatch - EvmTxDepositEmptyData - EvmTxDepositEmptyChainId - EvmTxDepositEmptyReceiver - EvmTxDepositUnexpectedValue - EvmTxDepositUnexpectedDataLength - EvmTxDepositNoAbi - EvmTxDepositNoDepositFunction - EvmTxDepositUnexpectedFunctionName - EvmTxDepositUnexpectedValidatorKey - EvmTxDepositInvalidValidatorKey - EvmTxDepositMissingDepositArg - EvmTxDepositWrongDepositArgType - EvmTxDepositValidatorKeyNotInRole - EvmTxDepositUnexpectedWithdrawalCredentials - EvmTxDepositUnresolvedRole - EvmTxDepositInvalidDepositEncoding ErrorResponse: type: object description: The structure of ErrorResponse must match the response template that AWS uses required: - message - error_code properties: accepted: allOf: - $ref: '#/components/schemas/AcceptedValue' nullable: true error_code: $ref: '#/components/schemas/SignerErrorCode' message: type: string description: Error message policy_eval_tree: description: Optional policy evaluation tree (included in signer responses, when requested) nullable: true request_id: type: string description: Optional request identifier PreconditionErrorOwnCodes: type: string enum: - FailOnMfaRequired - KeyRegionLocked - KeyRegionChangedRecently - MfaRegionLocked - Eth2ProposerSlotTooLow - Eth2AttestationSourceEpochTooLow - Eth2AttestationTargetEpochTooLow - Eth2ConcurrentBlockSigning - Eth2ConcurrentAttestationSigning - Eth2MultiDepositToNonGeneratedKey - Eth2MultiDepositUnknownInitialDeposit - Eth2MultiDepositWithdrawalAddressMismatch - ConcurrentSigningWhenTimeLimitPolicyIsDefined - BabylonEotsConcurrentSigning - TendermintStateError - TendermintConcurrentSigning - MfaApprovalsNotYetValid SiweCompleteRequest: type: object description: Answer to a Sign-in with Ethereum challenge. required: - challenge_id - signature properties: challenge_id: $ref: '#/components/schemas/Id' signature: type: string description: The hex-encoded EIP-191 signature of the message returned by the corresponding POST ('init') endpoint ClientSessionInfo: type: object description: 'Session information sent to the client. This struct works in tandem with its server-side counterpart [`SessionData`].' required: - session_id - auth_token - refresh_token - epoch - epoch_token - auth_token_exp - refresh_token_exp properties: auth_token: type: string description: Token to use for authorization. auth_token_exp: $ref: '#/components/schemas/EpochDateTime' epoch: type: integer format: int32 description: Epoch at which the token was last refreshed minimum: 0 epoch_token: $ref: '#/components/schemas/B32' refresh_token: type: string description: Token to use for refreshing the `(auth, refresh)` token pair refresh_token_exp: $ref: '#/components/schemas/EpochDateTime' session_id: type: string description: Session ID PolicyErrorOwnCodes: type: string enum: - Inapplicable - SuiTxReceiversDisallowedTransactionKind - SuiTxReceiversDisallowedTransferAddress - SuiTxReceiversDisallowedCommand - BtcTxDisallowedOutputs - BtcSignatureExceededValue - BtcValueOverflow - BtcSighashTypeDisallowed - Eip7702AddressMismatch - EvmTxReceiverMismatch - EvmTxChainIdMismatch - EvmTxSenderMismatch - EvmTxExceededValue - EvmTxExceededGasCost - EvmTxGasCostUndefined - EvmDataDisallowed - Erc20DataInvalid - EvmContractAddressUndefined - EvmContractChainIdUndefined - EvmDataNotDefined - EvmDataInvalid - EvmContractNotInAllowlist - Erc20ExceededTransferLimit - Erc20ReceiverMismatch - Erc20ExceededApproveLimit - Erc20SpenderMismatch - EvmFunctionNotInAllowlist - EvmFunctionCallInvalid - EvmFunctionCallDisallowedArg - PolicyDisjunctionError - PolicyNegationError - Eth2ExceededMaxUnstake - Eth2ConcurrentUnstaking - NotInIpv4Allowlist - NotInOriginAllowlist - NotInOperationAllowlist - InvalidSourceIp - RawSigningNotAllowed - DiffieHellmanExchangeNotAllowed - Eip712SigningNotAllowed - OidcSourceNotAllowed - NoOidcAuthSourcesDefined - AddKeyToRoleDisallowed - KeysAlreadyInRole - KeyInMultipleRoles - KeyAccessError - RequireRoleSessionKeyAccessError - BtcMessageSigningNotAllowed - Eip191SigningNotAllowed - Eip7702SigningNotAllowed - TaprootSigningDisallowed - SegwitSigningDisallowed - PsbtSigningDisallowed - BabylonStakingDisallowed - TimeLocked - CelPolicyDenied - BabylonStakingNetwork - BabylonStakingParamsVersion - BabylonStakingExplicitParams - BabylonStakingStakerPk - BabylonStakingFinalityProviderPk - BabylonStakingLockTime - BabylonStakingValue - BabylonStakingChangeAddress - BabylonStakingFee - BabylonStakingWithdrawalAddress - BabylonStakingBbnAddress - SolanaInstructionCountLow - SolanaInstructionCountHigh - SolanaNotInInstructionAllowlist - SolanaInstructionMismatch - WasmPoliciesDisabled - WasmPolicyDenied - WasmPolicyFailed - WebhookPoliciesDisabled - DeniedByWebhook - ExplicitlyDenied ExplicitScope: type: string title: ExplicitScope description: Explicitly named scopes for accessing CubeSigner APIs enum: - sign:* - sign:ava - sign:binance:* - sign:binance:subToMaster - sign:binance:subToSub - sign:binance:universalTransfer - sign:binance:subAccountAssets - sign:binance:accountInfo - sign:binance:subAccountTransferHistory - sign:binance:universalTransferHistory - sign:binance:withdraw - sign:binance:withdrawHistory - sign:binance:deposit - sign:binance:depositHistory - sign:binance:listSubAccounts - sign:binance:coinInfo - sign:bybit:* - sign:bybit:queryUser - sign:bybit:querySubMembers - sign:bybit:queryCoinsBalance - sign:bybit:queryDepositAddress - sign:bybit:universalTransfer - sign:bybit:withdraw - sign:bybit:withdrawals - sign:coinbase:* - sign:coinbase:accounts:list - sign:coinbase:portfolios:list - sign:coinbase:funds:move - sign:blob - sign:diffieHellman - sign:btc:* - sign:btc:segwit - sign:btc:taproot - sign:btc:psbt:* - sign:btc:psbt:doge - sign:btc:psbt:legacy - sign:btc:psbt:segwit - sign:btc:psbt:taproot - sign:btc:psbt:ltcSegwit - sign:btc:message:* - sign:btc:message:segwit - sign:btc:message:legacy - sign:babylon:* - sign:babylon:eots:* - sign:babylon:eots:nonces - sign:babylon:eots:sign - sign:babylon:staking:* - sign:babylon:staking:deposit - sign:babylon:staking:unbond - sign:babylon:staking:withdraw - sign:babylon:staking:slash - sign:babylon:registration - sign:babylon:covenant - sign:evm:* - sign:evm:tx - sign:evm:eip191 - sign:evm:eip712 - sign:evm:eip7702 - sign:eth2:* - sign:eth2:validate - sign:eth2:stake - sign:eth2:unstake - sign:solana - sign:sui - sign:tendermint - sign:mmi - manage:* - manage:readonly - manage:email:* - manage:email:get - manage:email:update - manage:email:delete - manage:mfa:* - manage:mfa:readonly - manage:mfa:list - manage:mfa:vote:* - manage:mfa:vote:cs - manage:mfa:vote:email - manage:mfa:vote:fido - manage:mfa:vote:totp - manage:mfa:register:* - manage:mfa:register:fido - manage:mfa:register:totp - manage:mfa:register:email - manage:mfa:unregister:* - manage:mfa:unregister:fido - manage:mfa:unregister:totp - manage:mfa:verify:* - manage:mfa:verify:totp - manage:key:* - manage:key:readonly - manage:key:get - manage:key:attest - manage:key:listRoles - manage:key:list - manage:key:history:tx:list - manage:key:create - manage:key:import - manage:key:update:* - manage:key:update:owner - manage:key:update:policy - manage:key:update:enabled - manage:key:update:region - manage:key:update:metadata - manage:key:update:properties - manage:key:update:editPolicy - manage:key:delete - manage:policy:* - manage:policy:readonly - manage:policy:create - manage:policy:get - manage:policy:list - manage:policy:delete - manage:policy:update:* - manage:policy:update:owner - manage:policy:update:name - manage:policy:update:acl - manage:policy:update:editPolicy - manage:policy:update:metadata - manage:policy:update:rule - manage:policy:invoke - manage:policy:wasm:* - manage:policy:wasm:upload - manage:policy:secrets:* - manage:policy:secrets:get - manage:policy:secrets:update:* - manage:policy:secrets:update:values - manage:policy:secrets:update:acl - manage:policy:secrets:update:editPolicy - manage:policy:buckets:* - manage:policy:buckets:get - manage:policy:buckets:list - manage:policy:buckets:update:* - manage:policy:buckets:update:owner - manage:policy:buckets:update:acl - manage:policy:buckets:update:metadata - manage:contact:* - manage:contact:readonly - manage:contact:create - manage:contact:get - manage:contact:list - manage:contact:delete - manage:contact:update:* - manage:contact:update:name - manage:contact:update:addresses - manage:contact:update:owner - manage:contact:update:labels - manage:contact:update:metadata - manage:contact:update:editPolicy - manage:contact:lookup:* - manage:contact:lookup:address - manage:policy:createImportKey - manage:role:* - manage:role:readonly - manage:role:create - manage:role:delete - manage:role:get:* - manage:role:attest - manage:role:get:keys - manage:role:get:keys:list - manage:role:get:keys:get - manage:role:get:users - manage:role:list - manage:role:update:* - manage:role:update:enabled - manage:role:update:policy - manage:role:update:editPolicy - manage:role:update:actions - manage:role:update:key:* - manage:role:update:key:add - manage:role:update:key:remove - manage:role:update:user:* - manage:role:update:user:add - manage:role:update:user:remove - manage:role:history:tx:list - manage:identity:* - manage:identity:readonly - manage:identity:verify - manage:identity:add - manage:identity:remove - manage:identity:list - manage:org:* - manage:org:create - manage:org:metrics:query - manage:org:audit:query - manage:org:readonly - manage:org:addUser - manage:org:inviteUser - manage:org:inviteAlien - manage:org:invitation:list - manage:org:invitation:cancel - manage:org:updateMembership:* - manage:org:updateMembership:owner - manage:org:updateMembership:member - manage:org:updateMembership:alien - manage:org:listUsers - manage:org:user:get - manage:org:deleteUser:* - manage:org:deleteUser:owner - manage:org:deleteUser:member - manage:org:deleteUser:alien - manage:org:get - manage:org:update:* - manage:org:update:enabled - manage:org:update:policy - manage:org:update:signPolicy - manage:org:update:export - manage:org:update:totpFailureLimit - manage:org:update:notificationEndpoints - manage:org:update:defaultInviteKind - manage:org:update:idpConfiguration - manage:org:update:passkeyConfiguration - manage:org:update:emailPreferences - manage:org:update:historicalData - manage:org:update:requireScopeCeiling - manage:org:update:alienLoginRequirement - manage:org:update:memberLoginRequirement - manage:org:update:keyExportRequirement - manage:org:update:allowedMfaTypes - manage:org:update:policyEngineConf - manage:org:update:customChains - manage:org:update:extProps - manage:org:update:editPolicy - manage:org:user:resetMfa - manage:session:* - manage:session:readonly - manage:session:get - manage:session:list - manage:session:create - manage:session:extend - manage:session:revoke - manage:export:* - manage:export:readonly - manage:export:org:* - manage:export:org:get - manage:export:user:* - manage:export:user:delete - manage:export:user:list - manage:authMigration:* - manage:authMigration:identity:add - manage:authMigration:identity:remove - manage:authMigration:user:update - manage:mmi:* - manage:mmi:readonly - manage:mmi:get - manage:mmi:list - manage:mmi:reject - manage:mmi:delete - export:* - export:user:* - export:user:init - export:user:complete - mmi:* - orgAccess:* - orgAccess:child:* - rpc:* - rpc:createTransaction:* - rpc:createTransaction:evm - rpc:retryTransaction - rpc:cancelTransaction - rpc:getTransaction - rpc:listTransactions - rpc:btcListUtxos - rpc:binance - rpc:bybit - rpc:coinbase AcceptedValueCode: type: string enum: - SignDryRun - BinanceDryRun - BybitDryRun - CoinbaseDryRun - MfaRequired BinanceDryRunArgs: type: object required: - method - url properties: method: type: string description: The Binance API method that would have been used url: type: string description: The Binance API url method that would have been called BybitDryRunArgs: type: object required: - method - url - payload properties: method: type: string description: The Bybit API method that would have been used payload: type: string description: The request body (for POST endpoints) or query string (for GET endpoints). url: type: string description: The Bybit API url that would have been called RefreshGrantType: type: string enum: - refresh_token CoinbaseDryRunArgs: type: object required: - method - url properties: method: type: string description: The Coinbase API method that would have been used url: type: string description: The Coinbase API url method that would have been called SignDryRunArgs: type: object required: - mfa_requests properties: mfa_requests: type: array items: $ref: '#/components/schemas/MfaRequestInfo' description: Whether MFA is required policy_eval_tree: description: Optional policy evaluation tree, if requested nullable: true SiwsInitRequest: type: object description: 'Initialize the request to sign in with Solana. The response will contain a structured `SignInInput` that the client must render to text, sign, and submit via the corresponding PATCH endpoint within 5 minutes.' required: - address - domain properties: address: type: string description: The base58-encoded Solana (ed25519) public key performing the signing. chain_id: allOf: - $ref: '#/components/schemas/SolanaNetwork' nullable: true domain: type: string description: The RFC 3986 authority that is requesting the signing. expiration_time: type: string description: The ISO 8601 datetime string that, if present, indicates when the signed authentication message is no longer valid. nullable: true not_before: type: string description: The ISO 8601 datetime string that, if present, indicates when the signed authentication message will become valid. nullable: true request_id: type: string description: A system-specific identifier that may be used to uniquely refer to the sign-in request. nullable: true resources: type: array items: type: string description: A list of RFC 3986 URIs the user wishes to have resolved as part of authentication by the relying party. statement: type: string description: A human-readable ASCII assertion that the user will sign, and it must not contain '\n' (the byte 0x0a). nullable: true uri: type: string description: An RFC 3986 URI referring to the resource that is the subject of the signing (as in the subject of a claim). nullable: true Id: type: string SiwsCompleteRequest: type: object description: Answer to a Sign-in with Solana challenge. required: - challenge_id - signature properties: challenge_id: $ref: '#/components/schemas/Id' signature: type: string description: The base58-encoded ed25519 signature of the challenge's canonical message text (the rendered `SignInInput`). MfaType: type: string format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`' description: Different types that can be used to approve an MFA request pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$ PolicyErrorCode: oneOf: - $ref: '#/components/schemas/PolicyErrorOwnCodes' - $ref: '#/components/schemas/EvmTxDepositErrorCode' MfaRequestInfo: type: object description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). required: - id - expires_at - request - status - created_by - provenance properties: created_at: $ref: '#/components/schemas/EpochDateTime' created_by: type: string description: The session identity (user or role) that created this request. expires_at: $ref: '#/components/schemas/EpochDateTime' id: type: string description: Approval request ID. not_valid_until: $ref: '#/components/schemas/EpochDateTime' provenance: type: string description: MFA policy provenance enum: - Org - Key - KeyInRole - Role - User - EditPolicy receipt: allOf: - $ref: '#/components/schemas/Receipt' nullable: true region: type: string description: The region this MFA request was created in. It can only be redeemed from the same region. related_ids: type: array items: type: string description: 'If set, contains the IDs of all MFA requests (including this one!) that were generated at once for the same CubeSigner operation. If not set, it means that this was the lone MFA request generated for `request`. This is useful so that a client can discover all the MFAs whose receipts must be submitted together to carry out the original CubeSigner operation.' request: $ref: '#/components/schemas/HttpRequest' status: $ref: '#/components/schemas/Status' BadRequestErrorCode: type: string enum: - GenericBadRequest - DisallowedAllowRuleReference - InvalidPaginationToken - InvalidEmail - InvalidEmailTemplate - QueryMetricsError - InvalidTelegramData - ValidationError - WebhookPolicyTimeoutOutOfBounds - WebhookPolicyDisallowedUrlScheme - WebhookPolicyDisallowedUrlHost - WebhookPolicyDisallowedHeaders - ReservedName - UserEmailNotConfigured - EmailPasswordNotFound - PasswordAuthNotAllowedByInvitation - OneTimeCodeExpired - InvalidBody - InvalidJwt - InvitationNoLongerValid - TokenRequestError - InvalidMfaReceipt - InvalidMfaPolicyCount - InvalidMfaPolicyNumAuthFactors - InvalidMfaPolicyNumAllowedApprovers - InvalidMfaPolicyGracePeriodTooLong - InvalidBabylonStakingPolicyParams - InvalidSuiTxReceiversEmptyAllowlist - InvalidBtcTxReceiversEmptyAllowlist - InvalidRequireRoleSessionAllowlist - InvalidCreateKeyCount - InvalidDiffieHellmanCount - OrgInviteExistingUser - OrgUserAlreadyExists - OrgNameTaken - KwkNotFoundInRegion - OrgIsNotOrgExport - RoleNameTaken - PolicyNameTaken - NameTaken - ContactNameInvalid - ContactAddressesInvalid - ContactLabelInvalid - ContactModified - PolicyNotFound - PolicyVersionNotFound - PolicyRuleDisallowedByType - PolicyTypeDisallowed - PolicyDuplicateError - PolicyStillAttached - PolicyModified - PolicyNotAttached - AddKeyToRoleCountTooHigh - InvalidKeyId - InvalidTimeLockAlreadyInThePast - InvalidRestrictedScopes - InvalidUpdate - InvalidMetadataLength - InvalidLength - InvalidKeyMaterialId - KeyNotFound - SiweChallengeNotFound - SiweInvalidRequest - SiwsChallengeNotFound - SiwsInvalidRequest - UserExportDerivedKey - UserExportPublicKeyInvalid - NistP256PublicKeyInvalid - UnableToAccessSmtpRelay - UserExportInProgress - RoleNotFound - InvalidRoleNameOrId - InvalidMfaReceiptOrgIdMissing - InvalidMfaReceiptInvalidOrgId - MfaRequestNotFound - InvalidKeyType - InvalidPropertiesForKeyType - MismatchedKeyPropertiesPatch - MissingBinanceApiKey - MissingBybitApiKey - MissingCoinbaseApiKey - BinanceKeyMasterMismatch - BybitAccountMismatch - InvalidKeyMaterial - InvalidHexValue - InvalidBase32Value - InvalidBase58Value - InvalidBase64Value - InvalidSs58Value - InvalidForkVersionLength - InvalidEthAddress - InvalidStellarAddress - InvalidOrgNameOrId - InvalidUpdateOrgRequestDisallowedMfaType - InvalidUpdateOrgRequestEmptyAllowedMfaTypes - EmailOtpDelayTooShortForRegisterMfa - InvalidStakeDeposit - InvalidBlobSignRequest - InvalidDiffieHellmanRequest - InvalidSolanaSignRequest - InvalidEip712SignRequest - InvalidEip7702SignRequest - OnlySpecifyOne - IncompatibleParams - NoOidcDataInProof - InvalidEvmSignRequest - InvalidEth2SignRequest - InvalidDeriveKeyRequest - InvalidStakingAmount - CustomStakingAmountNotAllowedForWrapperContract - InvalidUnstakeRequest - InvalidCreateUserRequest - UserAlreadyExists - IdpUserAlreadyExists - CognitoUserAlreadyOrgMember - UserNotFound - UserWithEmailNotFound - PolicyKeyMismatch - EmptyScopes - InvalidScopesForRoleSession - InvalidLifetime - NoSingleKeyForUser - InvalidOrgPolicyRule - SourceIpAllowlistEmpty - LimitWindowTooLong - Erc20ContractDisallowed - EmptyRuleError - PolicyFieldValidationError - OptionalListEmpty - MultipleExclusiveFieldsProvided - DuplicateFieldEntry - InvalidRange - InvalidOrgPolicyRepeatedRule - InvalidSuiTransaction - SuiSenderMismatch - AvaSignHashError - AvaSignError - BtcSegwitHashError - BtcTaprootHashError - BtcSignError - TaprootSignError - Eip712SignError - InvalidMemberRoleInUserAdd - InvalidMemberRoleInRecipientAdd - ThirdPartyUserAlreadyExists - OidcIdentityAlreadyExists - UserAlreadyHasIdentity - ThirdPartyUserNotFound - DeleteOidcUserError - DeleteUserError - SessionRoleMismatch - InvalidOidcToken - InvalidOidcIdentity - OidcIssuerUnsupported - OidcIssuerNotAllowed - OidcIssuerNoApplicableJwk - FidoKeyAlreadyRegistered - FidoKeySignCountTooLow - FidoVerificationFailed - FidoChallengeMfaMismatch - UnsupportedLegacyCognitoSession - InvalidIdentityProof - PaginationDataExpired - ExistingKeysViolateExclusiveKeyAccess - ExportDelayTooShort - ExportWindowTooLong - InvalidTotpFailureLimit - InvalidEip191SignRequest - CannotResendUserInvitation - InvalidNotificationEndpointCount - CannotDeletePendingSubscription - InvalidNotificationUrlProtocol - EmptyOneOfOrgEventFilter - EmptyAllExceptOrgEventFilter - InvalidTapNodeHash - InvalidOneTimeCode - MessageNotFound - MessageAlreadySigned - MessageRejected - MessageReplaced - InvalidMessageType - EmptyAddress - InvalidEth2SigningPolicySlotRange - InvalidEth2SigningPolicyEpochRange - InvalidEth2SigningPolicyTimestampRange - InvalidEth2SigningPolicyOverlappingRule - RpcUrlMissing - MmiChainIdMissing - EthersInvalidRpcUrl - EthersGetTransactionCountError - InvalidPassword - BabylonStakingFeePlusDustOverflow - BabylonStaking - BabylonStakingIncorrectKey - BabylonStakingSegwitNonDeposit - BabylonStakingRegistrationRequiresTaproot - PsbtSigning - TooManyResets - TooManyRequests - TooManyFailedLogins - BadBtcMessageSignP2shFlag - InvalidTendermintRequest - PolicyVersionMaxReached - PolicyVersionInvalid - PolicySecretLimitReached - PolicySecretTooLarge - InvalidImportKey - AlienOwnerInvalid - EmptyUpdateRequest - InvalidPolicyReference - PolicyEngineDisabled - InvalidWasmPolicy - CelProgramTooLarge - InvalidPolicy - RedundantDerivationPath - ImportKeyMissing - InvalidAbiMethods - BabylonCovSign - InvalidPolicyLogsRequest - UserProfileMigrationMultipleEntries - UserProfileMigrationTooManyItems - InputTooShort - InvalidTweakLength - InvalidCustomChains - InvalidRpcRequest SignerErrorOwnCodes: type: string enum: - PreComputed - StatusCodeWithMessage - JrpcError - UnhandledError - ProxyStartError - EnclaveError - PolicyErrorWithEvalTree - RpcApi Scope: oneOf: - $ref: '#/components/schemas/ExplicitScope' - type: string title: OtherScopes description: Scopes including wildcard fragments for accessing CubeSigner APIs pattern: ^(orgAccess:child)(:[^:]+)?$ description: All scopes for accessing CubeSigner APIs Seconds: type: integer format: int64 description: 'Duration measured in seconds A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.' minimum: 0 ClientProfile: type: object description: Client information representing the nature of front-end in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`]. properties: agent: type: string description: Agent/Product name example: Mozilla Firefox nullable: true engine: type: string description: Name of the engine example: Gecko nullable: true version: type: string description: Agent/product version example: '41.2' nullable: true ClientSessionMetadata: type: object description: Attributes that are expected to be provided by the client properties: client: $ref: '#/components/schemas/ClientProfile' os_info: $ref: '#/components/schemas/OsInfo' SiweInitRequest: type: object description: 'Initialize the request to sign in with ethereum. The response will contain a SIWE message that the client has to sign and submit via the corresponding PATCH endpoint within 5 minutes.' required: - address - domain - uri properties: address: type: string description: The Ethereum address performing the signing conformant to capitalization encoded checksum specified in EIP-55. domain: type: string description: The RFC 3986 authority that is requesting the signing. expiration_time: type: string description: The ISO 8601 datetime string that, if present, indicates when the signed authentication message is no longer valid. nullable: true not_before: type: string description: The ISO 8601 datetime string that, if present, indicates when the signed authentication message will become valid. nullable: true request_id: type: string description: A system-specific identifier that may be used to uniquely refer to the sign-in request. nullable: true resources: type: array items: type: string description: A list of information or references to information the user wishes to have resolved as part of authentication by the relying party. They are expressed as RFC 3986 URIs separated by "\n- " where \n is the byte 0x0a. statement: type: string description: A human-readable ASCII assertion that the user will sign, and it must not contain '\n' (the byte 0x0a). nullable: true uri: type: string description: An RFC 3986 URI referring to the resource that is the subject of the signing (as in the subject of a claim). PreconditionErrorCode: oneOf: - $ref: '#/components/schemas/PreconditionErrorOwnCodes' - $ref: '#/components/schemas/PolicyErrorCode' SolanaNetwork: type: string description: The Solana network a SIWS message is bound to (the `Chain ID` field). enum: - mainnet - testnet - devnet - localnet - solana:mainnet - solana:testnet - solana:devnet - solana:localnet NewSessionResponse: type: object description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). required: - org_id - token - refresh_token - session_info properties: expiration: type: integer format: int64 description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. example: 1701879640 minimum: 0 org_id: $ref: '#/components/schemas/Id' refresh_token: type: string description: Token that can be used to refresh this session. session_info: $ref: '#/components/schemas/ClientSessionInfo' token: type: string description: 'New token to be used for authentication. Requests to signing endpoints should include this value in the `Authorization` header.' HttpRequest: type: object description: 'Information about the request. Captures all the relevant info (including the request body) about requests that require MFA. We use this to verify that when a request is resumed (after obtaining necessary MFA approvals) it is exactly the same as it originally was.' required: - method - path properties: body: type: object description: HTTP request body nullable: true method: type: string description: HTTP method of the request path: type: string description: HTTP path of the request, excluding the host ApprovalInfo: type: object required: - timestamp properties: timestamp: $ref: '#/components/schemas/EpochDateTime' Receipt: type: object description: Receipt that an MFA request was approved. required: - confirmation - final_approver - timestamp properties: confirmation: type: string description: Confirmation code the user needs to present when resuming the original request. example: ba1d75dd-d999-4c1b-944d-25c25440c8af final_approver: type: string description: The ID of the logged-in user whose action created this approval. timestamp: $ref: '#/components/schemas/EpochDateTime' UnauthorizedErrorCode: type: string enum: - AuthorizationHeaderMissing - EndpointRequiresUserSession - RefreshTokenMissing AcceptedResponse: allOf: - $ref: '#/components/schemas/ErrorResponse' - type: object OidcLoginRequest: allOf: - $ref: '#/components/schemas/ClientSessionMetadata' - type: object required: - scopes properties: purpose: type: string description: A human readable description of the purpose of the session nullable: true scopes: type: array items: $ref: '#/components/schemas/Scope' description: Controls what capabilities this session will have. example: - sign:* minItems: 1 tokens: $ref: '#/components/schemas/RatchetConfig' description: OIDC login request TimeoutErrorCode: type: string enum: - PolicyEngineTimeout - WasmPolicyExecutionTimeout ForbiddenErrorCode: type: string enum: - AlienKeyCreate - CannotAssumeIdentity - SentryDisallowed - PasskeyLoginDisabled - PasskeyNotRegistered - CannotCreateOrg - WrongMfaEmailOtpJwt - OrgFlagNotSet - FidoRequiredToRemoveTotp - OidcIdentityLimitReached - OidcScopeCeilingMissing - OidcIssuerNotAllowedForMemberRole - OidcNoMemberRolesAllowed - EmailOtpNotConfigured - MfaChallengeExpired - ChainIdNotAllowed - InvalidOrg - OrgIdMismatch - SessionForWrongOrg - SelfDelete - SelfDisable - SelfMfaReset - InvalidOrgMembershipRoleChange - UserDisabled - OrgDisabled - OrgNotFound - OrgWithoutOwner - OrphanedUser - OidcUserNotFound - UserNotInOrg - UserNotOrgOwner - UserNotKeyOwner - InvalidRole - DisabledRole - KeyDisabled - KeyNotInRole - ContactNotInOrg - UserExportRequestNotInOrg - UserExportRequestInvalid - UserExportDisabled - UserNotOriginalKeyOwner - UserNotInRole - MustBeFullMember - SessionExpired - SessionChanged - SessionRevoked - ExpectedUserSession - SessionRoleChanged - ScopedNameNotFound - SessionInvalidEpochToken - SessionInvalidRefreshToken - SessionRefreshTokenExpired - InvalidAuthHeader - SessionNotFound - InvalidArn - SessionInvalidAuthToken - SessionAuthTokenExpired - SessionPossiblyStolenToken - MfaDisallowedIdentity - MfaDisallowedApprover - MfaTypeNotAllowed - MfaNotApprovedYet - MfaConfirmationCodeMismatch - MfaHttpRequestMismatch - MfaRemoveBelowMin - MfaOrgRequirementNotMet - MfaRegistrationDisallowed - TotpAlreadyConfigured - TotpConfigurationChanged - MfaTotpBadConfiguration - MfaTotpBadCode - MfaTotpRateLimit - ImproperSessionScope - FullSessionRequired - SessionWithoutAnyScopeUnder - UserRoleUnprivileged - MemberRoleForbidden - MfaNotConfigured - RemoveLastOidcIdentity - OperationNotAllowed - OrgExportRetrievalDisabled - ChangingKeyExportRequirementIsDisabled - AutoAddBlsKeyToProtectedRole - UserNotPolicyOwner - UserNotContactOwner - UserNotBucketOwner - LegacySessionCannotHaveScopeCeiling - RoleInParentOrgNotAllowed - RemoveKeyFromRoleUserNotAllowed - SiweChallengeExpired - SiweMessageNotValid - SiweMessageInvalidSignature - SiwsChallengeExpired - SiwsDomain - SiwsMessageInvalid - Acl TelegramEnvironment: type: string description: 'Telegram has two environments: production and test Each one has an associated public key for verifying signatures, and we assign each one a unique OIDC issuer' enum: - production - test TelegramAuthRequest: type: object required: - tg_web_app_data - bot_id - environment properties: bot_id: type: string description: The telegram bot ID environment: $ref: '#/components/schemas/TelegramEnvironment' tg_web_app_data: type: string description: The telegram webapp data (found in the `tgWebAppData` parameter encoded in the hash section of the URL) OsInfo: type: object description: OS information set in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`] properties: architecture: type: string example: arm64 nullable: true name: type: string example: Mac OS nullable: true version: type: string example: 14.5.0 nullable: true word_size: type: string example: 64-bit nullable: true Status: type: object required: - count - num_auth_factors - allowed_approvers - approved_by properties: allowed_approvers: type: array items: type: string description: Users who are allowed to approve. Must be non-empty. allowed_mfa_types: type: array items: $ref: '#/components/schemas/MfaType' description: Allowed approval types. When omitted, defaults to any. nullable: true approved_by: type: object description: Users who have already approved additionalProperties: type: object additionalProperties: $ref: '#/components/schemas/ApprovalInfo' count: type: integer format: int32 description: How many users must approve minimum: 0 num_auth_factors: type: integer format: int32 description: How many auth factors to require per user minimum: 0 request_comparer: $ref: '#/components/schemas/HttpRequestCmp' ConflictErrorCode: type: string enum: - ConcurrentRequestDisallowed - ConcurrentLockCreation responses: NewSessionResponse: description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). content: application/json: schema: type: object description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). required: - org_id - token - refresh_token - session_info properties: expiration: type: integer format: int64 description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. example: 1701879640 minimum: 0 org_id: $ref: '#/components/schemas/Id' refresh_token: type: string description: Token that can be used to refresh this session. session_info: $ref: '#/components/schemas/ClientSessionInfo' token: type: string description: 'New token to be used for authentication. Requests to signing endpoints should include this value in the `Authorization` header.' EmailOtpResponse: description: 'The HTTP response to an email OTP request. This response contains an OIDC token without a signature. The signature is sent to the end-user in an email. The token can be reconstructed by concatenating the `partial_token` with the signature.' content: application/json: schema: type: object description: 'The HTTP response to an email OTP request. This response contains an OIDC token without a signature. The signature is sent to the end-user in an email. The token can be reconstructed by concatenating the `partial_token` with the signature.' required: - partial_token properties: partial_token: type: string description: 'The OIDC token without the signature. (The signature, which is actually a MAC, is sent to the end-user in an email)' TokenResponse: description: 'OAuth2 standard Token Response. https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2' content: application/json: schema: allOf: - type: object description: 'OAuth2 standard Token Response. https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2' required: - access_token - token_type - expires_in properties: access_token: type: string description: The access token issued by the authorization server. expires_in: $ref: '#/components/schemas/Seconds' id_token: type: string description: An OIDC token issued by Cubist, containing user information nullable: true refresh_token: type: string description: The refresh token issued by the authorization server. nullable: true token_type: type: string description: The type of the token issued. Value is case insensitive. additionalProperties: description: 'We don''t inspect all values in the token response but we hold onto them to forward to the client' - type: object description: 'OAuth2 standard Token Response. https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2' SiwsCompleteResponse: description: Returned upon a successful SIWS authentication. content: application/json: schema: type: object description: Returned upon a successful SIWS authentication. required: - id_token properties: id_token: type: string description: The OIDC token corresponding to the user with the requested SIWS identity. TelegramAuthResponse: description: '' content: application/json: schema: type: object required: - id_token properties: id_token: type: string description: The OIDC token corresponding to this telegram user SiweCompleteResponse: description: Returned upon a successful SIWE authentication. content: application/json: schema: type: object description: Returned upon a successful SIWE authentication. required: - id_token properties: id_token: type: string description: The OIDC token corresponding to the user with the requested SIWE identity. SiwsInitResponse: description: 'A challenge returned in response to a Sign-In with Solana request. Contains a structured [SignInInput] that the client must render to its canonical text and sign (ed25519) with the requested key in order to complete authentication. The client has until the message expires (but no more than 5 minutes) to complete the challenge.' content: application/json: schema: type: object description: 'A challenge returned in response to a Sign-In with Solana request. Contains a structured [SignInInput] that the client must render to its canonical text and sign (ed25519) with the requested key in order to complete authentication. The client has until the message expires (but no more than 5 minutes) to complete the challenge.' required: - challenge_id - sign_in_input properties: challenge_id: type: string description: The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) sign_in_input: $ref: '#/components/schemas/SignInInput' SiweInitResponse: description: 'A challenge returned in response to a Sign-In with Ethereum request. Contains a message that the client must sign following EIP-191 with the requested key in order to complete authentication. The client has until the message expires (but no more than 5 minutes) to complete the challenge.' content: application/json: schema: type: object description: 'A challenge returned in response to a Sign-In with Ethereum request. Contains a message that the client must sign following EIP-191 with the requested key in order to complete authentication. The client has until the message expires (but no more than 5 minutes) to complete the challenge.' required: - challenge_id - message properties: challenge_id: type: string description: The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) message: type: string description: The message to sign following the EIP-191 standard. securitySchemes: Oidc: type: apiKey in: header name: Authorization description: OIDC tokens allow users to authenticate using a third-party service. These are exchanged for signer session tokens. SignerAuth: type: apiKey in: header name: Authorization description: Signing API end-points use session tokens for auth. Specifically, with each request you need to use the \`token\` from your signer session (which you create with `cs token create`).