openapi: 3.0.3
info:
  title: CubeSigner Account User API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: User
paths:
  /v0/about_me:
    get:
      tags:
      - User
      summary: User Info
      description: 'User Info


        Retrieves information about the current user.


        PREFER `GET /v0/orgs/{org_id}/user/me`'
      operationId: aboutMeLegacy
      responses:
        '200':
          $ref: '#/components/responses/UserInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - ''
  /v0/org/{org_id}/user/me:
    get:
      tags:
      - User
      summary: User Info
      description: 'User Info


        Retrieves information about the current user.'
      operationId: aboutMe
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/UserInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth: []
  /v0/org/{org_id}/user/me/email:
    post:
      tags:
      - User
      summary: Initiate Reset Verified Email Flow
      description: 'Initiate Reset Verified Email Flow

        '
      operationId: userResetEmailInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailResetRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmailOtpResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:email
    patch:
      tags:
      - User
      summary: Finalize a Reset Verified Email Flow
      description: Finalize a Reset Verified Email Flow
      operationId: userResetEmailComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailOtpAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:email
  /v0/org/{org_id}/user/me/fido:
    post:
      tags:
      - User
      summary: Initiate registration of a FIDO key.
      description: 'Initiate registration of a FIDO key.


        If a discoverable key is requested, user verification (PIN) is required.


        Generates a challenge that must be answered to prove ownership of a key.'
      operationId: userRegisterFidoInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/FidoCreateChallengeResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:fido
    patch:
      tags:
      - User
      summary: Finalize registration of a FIDO key
      description: 'Finalize registration of a FIDO key


        Accepts the response to the challenge generated by the POST to this endpoint.'
      operationId: userRegisterFidoComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:fido
  /v0/org/{org_id}/user/me/fido/{fido_id}:
    delete:
      tags:
      - User
      summary: Delete FIDO key
      description: 'Delete FIDO key


        Deletes a FIDO key from the user''s account (if the key is not the sole MFA factor). MFA is always required.'
      operationId: userDeleteFido
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: fido_id
        in: path
        description: Name or ID of the desired FidoKey
        required: true
        schema:
          type: string
        example: FidoKey#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:unregister:fido
  /v0/org/{org_id}/user/me/totp:
    post:
      tags:
      - User
      summary: Initialize TOTP Reset
      description: 'Initialize TOTP Reset


        Creates a new TOTP challenge that must be answered to prove that the new TOTP

        was successfully imported into an authenticator app.


        This operation is allowed if EITHER

        - the user account is not yet initialized and no TOTP is already set, OR

        - the user has not configured any auth factors;

        otherwise, MFA is required.'
      operationId: userResetTotpInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/TotpResetRequest'
              nullable: true
        required: false
      responses:
        '200':
          $ref: '#/components/responses/TotpInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:totp
    delete:
      tags:
      - User
      summary: Delete TOTP
      description: 'Delete TOTP


        Deletes TOTP from the user''s account (if TOTP is not the sole MFA factor). MFA is always required.

        '
      operationId: userDeleteTotp
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:unregister:totp
    patch:
      tags:
      - User
      summary: Finalize resetting TOTP
      description: 'Finalize resetting TOTP


        Checks if the response contains the correct TOTP code corresponding to the

        challenge generated by the POST method of this endpoint.'
      operationId: userResetTotpComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:totp
  /v0/org/{org_id}/user/me/totp/verify:
    post:
      tags:
      - User
      summary: Verify TOTP
      description: 'Verify TOTP


        Checks if a given code matches the current TOTP code for the current user.

        Errors with 403 if the current user has not set up TOTP or the code fails verification.'
      operationId: userVerifyTotp
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpApproveRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:verify:totp
  /v0/user/me/fido:
    post:
      tags:
      - User
      summary: Initiate registration of a FIDO key
      description: 'Initiate registration of a FIDO key


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/fido` instead.


        Generates a challenge that must be answered to prove ownership of a key'
      operationId: registerFidoInitLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/FidoCreateChallengeResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:fido
    patch:
      tags:
      - User
      summary: Finalize registration of a FIDO key
      description: 'Finalize registration of a FIDO key


        DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/fido` instead.


        Accepts the response to the challenge generated by the POST to this endpoint.'
      operationId: registerFidoCompleteLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:fido
  /v0/user/me/totp:
    post:
      tags:
      - User
      summary: Initialize TOTP Reset
      description: 'Initialize TOTP Reset


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp` instead.


        Creates a new TOTP challenge that must be answered to prove that the new TOTP

        was successfully imported into an authenticator app.


        This operation is allowed if EITHER

        - the user account is not yet initialized and no TOTP is already set, OR

        - the user has not configured any auth factors;

        otherwise, MFA is required.'
      operationId: resetTotpInitLegacy
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/TotpResetRequest'
              nullable: true
        required: false
      responses:
        '200':
          $ref: '#/components/responses/TotpInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:totp
    patch:
      tags:
      - User
      summary: Finalize resetting TOTP
      description: 'Finalize resetting TOTP


        DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/totp` instead.


        Checks if the response contains the correct TOTP code corresponding to the

        challenge generated by the POST method of this endpoint.'
      operationId: resetTotpCompleteLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:totp
  /v0/user/me/totp/verify:
    post:
      tags:
      - User
      summary: Verify TOTP
      description: 'Verify TOTP


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp/verify` instead.


        Checks if a given code matches the current TOTP code for the current user.

        Errors with 403 if the current user has not set up TOTP or the code fails verification.'
      operationId: verifyTotpLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpApproveRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:verify:totp
  /v0/user/orgs:
    get:
      tags:
      - User
      summary: Retrieves all the orgs the user is a part of
      description: Retrieves all the orgs the user is a part of
      operationId: userOrgs
      responses:
        '200':
          $ref: '#/components/responses/UserOrgsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - Oidc: []
components:
  schemas:
    Empty:
      default: null
      nullable: true
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    ClientSessionInfo:
      type: object
      description: 'Session information sent to the client.

        This struct works in tandem with its server-side counterpart [`SessionData`].'
      required:
      - session_id
      - auth_token
      - refresh_token
      - epoch
      - epoch_token
      - auth_token_exp
      - refresh_token_exp
      properties:
        auth_token:
          type: string
          description: Token to use for authorization.
        auth_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        epoch:
          type: integer
          format: int32
          description: Epoch at which the token was last refreshed
          minimum: 0
        epoch_token:
          $ref: '#/components/schemas/B32'
        refresh_token:
          type: string
          description: Token to use for refreshing the `(auth, refresh)` token pair
        refresh_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        session_id:
          type: string
          description: Session ID
    PublicKeyCredentialParameters:
      type: object
      description: 'This dictionary is used to supply additional parameters when creating a new

        credential.


        https://www.w3.org/TR/webauthn-2/#dictionary-credential-params'
      required:
      - type
      - alg
      properties:
        alg:
          type: integer
          format: int64
          description: 'This member specifies the cryptographic signature algorithm with which

            the newly generated credential will be used, and thus also the type of

            asymmetric key pair to be generated, e.g., RSA or Elliptic Curve.'
        type:
          $ref: '#/components/schemas/PublicKeyCredentialType'
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    PublicKeyCredentialCreationOptions:
      type: object
      description: 'Defines the parameters for the creation of a new public key credential


        https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialcreationoptions'
      required:
      - rp
      - user
      - challenge
      - pubKeyCredParams
      properties:
        attestation:
          $ref: '#/components/schemas/AttestationConveyancePreference'
        authenticatorSelection:
          allOf:
          - $ref: '#/components/schemas/AuthenticatorSelectionCriteria'
          nullable: true
        challenge:
          type: string
          description: 'This member contains a challenge intended to be used for generating the

            newly created credential’s attestation object. See the § 13.4.3

            Cryptographic Challenges security consideration.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-challenge'
        excludeCredentials:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialDescriptor'
          description: 'This member is intended for use by Relying Parties that wish to limit

            the creation of multiple credentials for the same account on a single

            authenticator. The client is requested to return an error if the new

            credential would be created on an authenticator that also contains one

            of the credentials enumerated in this parameter.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-excludecredentials'
        extensions:
          type: object
          description: 'This member contains additional parameters requesting additional

            processing by the client and authenticator. For example, the caller may

            request that only authenticators with certain capabilities be used to

            create the credential, or that particular information be returned in the

            attestation object. Some extensions are defined in § 9 WebAuthn

            Extensions; consult the IANA "WebAuthn Extension Identifiers" registry

            [IANA-WebAuthn-Registries] established by [RFC8809] for an up-to-date

            list of registered WebAuthn Extensions.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-extensions'
          nullable: true
        pubKeyCredParams:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialParameters'
          description: 'This member contains information about the desired properties of the

            credential to be created. The sequence is ordered from most preferred to

            least preferred. The client makes a best-effort to create the most

            preferred credential that it can.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-pubkeycredparams'
        rp:
          $ref: '#/components/schemas/PublicKeyCredentialRpEntity'
        timeout:
          type: integer
          format: int32
          description: 'This member specifies a time, in milliseconds, that the caller is

            willing to wait for the call to complete. This is treated as a hint, and

            MAY be overridden by the client.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-timeout'
          nullable: true
          minimum: 0
        user:
          $ref: '#/components/schemas/PublicKeyCredentialUserEntity'
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    FidoCreateChallengeAnswer:
      type: object
      description: Sent from the client to the server to answer a fido challenge
      required:
      - challenge_id
      - credential
      properties:
        challenge_id:
          type: string
          description: The ID of the challenge that was returned from the POST endpoint
        credential:
          $ref: '#/components/schemas/PublicKeyCredential'
    MfaPolicy:
      type: object
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. If empty at creation time, default to the current user.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        count:
          type: integer
          format: int32
          description: How many users to require to approve (defaults to 1).
          minimum: 0
        lifetime:
          $ref: '#/components/schemas/Seconds'
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user (defaults to 1).
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
        restricted_operations:
          type: array
          items:
            $ref: '#/components/schemas/OperationKind'
          description: 'CubeSigner operations to which this policy should apply.

            When omitted, applies to all operations.'
          nullable: true
        time_delay:
          $ref: '#/components/schemas/Seconds'
      example:
        allowed_approvers:
        - User#fabc3f88-04e0-471b-9657-0ae12a3cd73e
        - User#d796c369-9974-473b-ab9e-e4a2418d2d07
        count: 2
        lifetime: 900
    PublicKeyCredentialRpEntity:
      type: object
      description: 'The PublicKeyCredentialRpEntity dictionary is used to supply additional

        Relying Party attributes when creating a new credential.


        https://www.w3.org/TR/webauthn-2/#dictionary-rp-credential-params'
      required:
      - name
      properties:
        id:
          type: string
          description: 'A unique identifier for the Relying Party entity, which sets the RP ID.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrpentity-id'
          nullable: true
        name:
          type: string
          description: 'A human-palatable name for the entity. Its function depends on what the

            PublicKeyCredentialEntity represents: When inherited by

            PublicKeyCredentialRpEntity it is a human-palatable identifier for the

            Relying Party, intended only for display. For example, "ACME

            Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".


            Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3

            of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass

            [RFC8264], when setting name''s value, or displaying the value to the

            user.


            This string MAY contain language and direction metadata. Relying Parties

            SHOULD consider providing this information. See § 6.4.2 Language and

            Direction Encoding about how this metadata is encoded.'
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    ResidentKeyRequirement:
      type: string
      description: 'This enumeration’s values describe the Relying Party''s requirements for

        client-side discoverable credentials (formerly known as resident credentials

        or resident keys):


        https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement'
      enum:
      - discouraged
      - preferred
      - required
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    AuthenticatorSelectionCriteria:
      type: object
      description: 'WebAuthn Relying Parties may use the AuthenticatorSelectionCriteria

        dictionary to specify their requirements regarding authenticator

        attributes.


        https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria'
      properties:
        authenticatorAttachment:
          allOf:
          - $ref: '#/components/schemas/AuthenticatorAttachment'
          nullable: true
        requireResidentKey:
          type: boolean
          description: 'This member is retained for backwards compatibility with WebAuthn Level

            1 and, for historical reasons, its naming retains the deprecated

            “resident” terminology for discoverable credentials. Relying Parties

            SHOULD set it to true if, and only if, residentKey is set to required.


            https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-requireresidentkey'
        residentKey:
          allOf:
          - $ref: '#/components/schemas/ResidentKeyRequirement'
          nullable: true
        userVerification:
          $ref: '#/components/schemas/UserVerificationRequirement'
    EvmTxDepositErrorCode:
      type: string
      enum:
      - EvmTxDepositReceiverMismatch
      - EvmTxDepositEmptyData
      - EvmTxDepositEmptyChainId
      - EvmTxDepositEmptyReceiver
      - EvmTxDepositUnexpectedValue
      - EvmTxDepositUnexpectedDataLength
      - EvmTxDepositNoAbi
      - EvmTxDepositNoDepositFunction
      - EvmTxDepositUnexpectedFunctionName
      - EvmTxDepositUnexpectedValidatorKey
      - EvmTxDepositInvalidValidatorKey
      - EvmTxDepositMissingDepositArg
      - EvmTxDepositWrongDepositArgType
      - EvmTxDepositValidatorKeyNotInRole
      - EvmTxDepositUnexpectedWithdrawalCredentials
      - EvmTxDepositUnresolvedRole
      - EvmTxDepositInvalidDepositEncoding
    PublicKeyCredentialDescriptor:
      type: object
      description: 'This dictionary contains the attributes that are specified by a caller when

        referring to a public key credential as an input parameter to the create()

        or get() methods. It mirrors the fields of the PublicKeyCredential object

        returned by the latter methods.


        https://www.w3.org/TR/webauthn-2/#dictionary-credential-descriptor'
      required:
      - type
      - id
      properties:
        id:
          type: string
          description: 'This member contains the credential ID of the public key credential the caller is referring to.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialdescriptor-id'
        transports:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticatorTransport'
          description: 'This OPTIONAL member contains a hint as to how the client might

            communicate with the managing authenticator of the public key credential

            the caller is referring to. The values SHOULD be members of

            AuthenticatorTransport but client platforms MUST ignore unknown values.


            The getTransports() operation can provide suitable values for this

            member. When registering a new credential, the Relying Party SHOULD

            store the value returned from getTransports(). When creating a

            PublicKeyCredentialDescriptor for that credential, the Relying Party

            SHOULD retrieve that stored value and set it as the value of the

            transports member.'
          nullable: true
        type:
          $ref: '#/components/schemas/PublicKeyCredentialType'
    AuthenticatorAttestationResponse:
      type: object
      description: 'The AuthenticatorAttestationResponse interface represents the authenticator''s

        response to a client’s request for the creation of a new public key

        credential. It contains information about the new credential that can be

        used to identify it for later use, and metadata that can be used by the

        WebAuthn Relying Party to assess the characteristics of the credential

        during registration.


        https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse'
      required:
      - clientDataJSON
      - attestationObject
      properties:
        attestationObject:
          type: string
          description: 'This attribute contains an attestation object, which is opaque to, and

            cryptographically protected against tampering by, the client. The

            attestation object contains both authenticator data and an attestation

            statement. The former contains the AAGUID, a unique credential ID, and

            the credential public key. The contents of the attestation statement are

            determined by the attestation statement format used by the

            authenticator. It also contains any additional information that the

            Relying Party''s server requires to validate the attestation statement,

            as well as to decode and validate the authenticator data along with the

            JSON-compatible serialization of client data. For more details, see

            § 6.5 Attestation, § 6.5.4 Generating an Attestation Object, and Figure

            6.'
        clientDataJSON:
          type: string
          description: 'This attribute, inherited from AuthenticatorResponse, contains the

            JSON-compatible serialization of client data (see § 6.5 Attestation)

            passed to the authenticator by the client in order to generate this

            credential. The exact JSON serialization MUST be preserved, as the hash

            of the serialized client data has been computed over it.'
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
          nullable: true
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        request_id:
          type: string
          description: Optional request identifier
    AttestationConveyancePreference:
      type: string
      description: 'WebAuthn Relying Parties may use AttestationConveyancePreference to specify

        their preference regarding attestation conveyance during credential

        generation.


        https://www.w3.org/TR/webauthn-2/#enumdef-attestationconveyancepreference'
      enum:
      - none
      - indirect
      - direct
      - enterprise
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    AuthenticatorTransport:
      type: string
      description: 'Authenticators may implement various transports for communicating with

        clients. This enumeration defines hints as to how clients might communicate

        with a particular authenticator in order to obtain an assertion for a

        specific credential. Note that these hints represent the WebAuthn Relying

        Party''s best belief as to how an authenticator may be reached. A Relying

        Party will typically learn of the supported transports for a public key

        credential via getTransports().


        https://www.w3.org/TR/webauthn-2/#enumdef-authenticatortransport'
      enum:
      - usb
      - nfc
      - ble
      - internal
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
          nullable: true
    PublicKeyCredentialType:
      type: string
      description: 'This enumeration defines the valid credential types. It is an extension

        point; values can be added to it in the future, as more credential types are

        defined. The values of this enumeration are used for versioning the

        Authentication Assertion and attestation structures according to the type of

        the authenticator.  Currently one credential type is defined, namely

        "public-key".


        https://www.w3.org/TR/webauthn-2/#enumdef-publickeycredentialtype'
      enum:
      - public-key
    EmailResetRequest:
      type: object
      description: Request to reset verified email.
      required:
      - email
      properties:
        allow_otp_login:
          type: boolean
          description: 'Whether this email should be usable for email OTP login. The request

            will fail if this field is set to `true`, and the org does not have

            email OTP enabled. Default: `false`'
          nullable: true
        email:
          type: string
          description: The email to register
    FidoCreateRequest:
      type: object
      description: Declares intent to register a new FIDO key
      required:
      - name
      properties:
        discoverable:
          type: boolean
          description: Whether this key can be used for passwordless login
        name:
          type: string
          description: A human-readable name for the new fido credential
          example: Work Yubikey
        request_device_identifier:
          type: boolean
          description: 'Whether to request the unique authenticator device manufacturer identifier.

            This information can be used to render the manufacturer name (e.g., "YubiKey",

            or "Google Password Manager", or "1Password", etc.). When requested, some user

            agents (e.g., Firefox) will ask the user to agree or disagree, whereas some

            (e.g., Chrome) will silently agree.'
    Seconds:
      type: integer
      format: int64
      description: 'Duration measured in seconds

        A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.'
      minimum: 0
    PublicKeyCredentialUserEntity:
      type: object
      description: 'The PublicKeyCredentialUserEntity dictionary is used to supply additional

        user account attributes when creating a new credential.'
      required:
      - id
      - displayName
      - name
      properties:
        displayName:
          type: string
          description: 'A human-palatable name for the user account, intended only for display.

            For example, "Alex Müller" or "田中倫". The Relying Party SHOULD let the

            user choose this, and SHOULD NOT restrict the choice more than

            necessary.


            Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3

            of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass

            [RFC8264], when setting displayName''s value, or displaying the value to

            the user.


            This string MAY contain language and direction metadata. Relying Parties

            SHOULD consider providing this information. See § 6.4.2 Language and

            Direction Encoding about how this metadata is encoded.


            Clients SHOULD perform enforcement, as prescribed in Section 2.3 of

            [RFC8266] for the Nickname Profile of the PRECIS FreeformClass

            [RFC8264], on displayName''s value prior to displaying the value to the

            user or including the value as a parameter of the

            authenticatorMakeCredential operation.


            When clients, client platforms, or authenticators display a

            displayName''s value, they should always use UI elements to provide a

            clear boundary around the displayed value, and not allow overflow into

            other elements [css-overflow-3].


            Authenticators MUST accept and store a 64-byte minimum length for a

            displayName member’s value. Authenticators MAY truncate a displayName

            member’s value so that it fits within 64 bytes. See § 6.4.1 String

            Truncation about truncation and other considerations.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-displayname'
        id:
          type: string
          description: 'The user handle of the user account entity. A user handle is an opaque

            byte sequence with a maximum size of 64 bytes, and is not meant to be

            displayed to the user.


            To ensure secure operation, authentication and authorization decisions

            MUST be made on the basis of this id member, not the displayName nor

            name members. See Section 6.1 of [RFC8266].


            The user handle MUST NOT contain personally identifying information

            about the user, such as a username or e-mail address; see § 14.6.1 User

            Handle Contents for details. The user handle MUST NOT be empty, though

            it MAY be null.


            Note: the user handle ought not be a constant value across different

            accounts, even for non-discoverable credentials, because some

            authenticators always create discoverable credentials. Thus a constant

            user handle would prevent a user from using such an authenticator with

            more than one account at the Relying Party.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-id'
        name:
          type: string
          description: 'When inherited by PublicKeyCredentialUserEntity, it is a human-palatable

            identifier for a user account. It is intended only for display, i.e.,

            aiding the user in determining the difference between user accounts with

            similar displayNames. For example, "alexm", "alex.mueller@example.com"

            or "+14255551234".


            The Relying Party MAY let the user choose this value. The Relying Party

            SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265]

            for the UsernameCasePreserved Profile of the PRECIS IdentifierClass

            [RFC8264], when setting name''s value, or displaying the value to the

            user.


            This string MAY contain language and direction metadata. Relying Parties

            SHOULD consider providing this information. See § 6.4.2 Language and

            Direction Encoding about how this metadata is encoded.


            Clients SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265] for the UsernameCasePreserved Profile of the PRECIS IdentifierClass [RFC8264], on name''s value prior to displaying the value to the user or including the value as a parameter of the authenticatorMakeCredential operation.'
    AcceptedResponse:
      allOf:
      - $ref: '#/components/schemas/ErrorResponse'
      - type: object
    MemberRole:
      type: string
      description: Describes whether a user in an org is an Owner or just a regular member
      enum:
      - Alien
      - Member
      - Owner
    EvmTxCmp:
      type: object
      properties:
        grace:
          type: integer
          format: int64
          description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.


            In this case, however, because EVM transactions already have a replay prevention mechanism

            (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to

            indicate how long an MFA receipt should remain valid after its first use.


            Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request

            enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to

            ensure that any subsequent requests that claim the same receipt must sign for the same

            nonce as the request we signed originally with that receipt.


            Also note that the grace period cannot extend the lifetime of an MFA request beyond its

            original expiration date.


            The grace period must not be greater than 30 days.'
          nullable: true
          minimum: 0
        ignore_gas:
          type: boolean
          description: Whether the 'gas' property of the EVM transaction is allowed to be different.
        ignore_nonce:
          type: boolean
          description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
    PublicKeyCredential:
      type: object
      description: 'This type represents a wire-encodable form of the PublicKeyCredential interface

        Clients may need to manually encode into this format to communicate with the server


        The PublicKeyCredential interface inherits from Credential

        [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to

        the caller when a new credential is created, or a new assertion is

        requested.


        https://www.w3.org/TR/webauthn-2/#iface-pkcredential'
      required:
      - id
      - response
      properties:
        clientExtensionResults:
          type: object
          description: 'This internal slot contains the results of processing client extensions

            requested by the Relying Party upon the Relying Party''s invocation of

            either navigator.credentials.create() or navigator.credentials.get().


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot


            IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc:


            This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing.

            https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults


            '
          nullable: true
        id:
          type: string
          description: 'This internal slot contains the credential ID, chosen by the

            authenticator. The credential ID is used to look up credentials for use,

            and is therefore expected to be globally unique with high probability

            across all credentials of the same type, across all authenticators.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot'
        response:
          oneOf:
          - $ref: '#/components/schemas/AuthenticatorAttestationResponse'
          - $ref: '#/components/schemas/AuthenticatorAssertionResponse'
          description: Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface
    ChallengePieces:
      type: object
      description: Describes how to derive a WebAuthn challenge value.
      required:
      - preimage
      - random_seed
      properties:
        preimage:
          type: string
          description: 'A base64url encoding of UTF8 JSON. The data in that JSON is endpoint specific, and describes what this FIDO challenge will be used for.


            Clients can use `preimage` along with `random_seed` to reconstruct the challenge like so:


            `challenge = HMAC-SHA256(key=random_seed, message=preimage)`'
        random_seed:
          type: string
          description: A random seed that prevents replay attacks
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    UserInOrgMembership:
      type: object
      description: 'Information about a user''s membership in an organization

        (without including any info about the user)'
      required:
      - org_id
      - membership
      - status
      properties:
        membership:
          $ref: '#/components/schemas/MemberRole'
        org_id:
          type: string
          description: Organization id
          example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
        status:
          $ref: '#/components/schemas/MembershipStatus'
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    Id:
      type: string
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    AuthenticatorAttachment:
      type: string
      description: 'This enumeration’s values describe authenticators'' attachment modalities.

        Relying Parties use this to express a preferred authenticator attachment

        modality when calling navigator.credentials.create() to create a credential.


        https://www.w3.org/TR/webauthn-2/#enumdef-authenticatorattachment'
      enum:
      - platform
      - cross-platform
    HttpRequest:
      type: object
      description: 'Information about the request.


        Captures all the relevant info (including the request body) about requests that require MFA.

        We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)

        it is exactly the same as it originally was.'
      required:
      - method
      - path
      properties:
        body:
          type: object
          description: HTTP request body
          nullable: true
        method:
          type: string
          description: HTTP method of the request
        path:
          type: string
          description: HTTP path of the request, excluding the host
    Receipt:
      type: object
      description: Receipt that an MFA request was approved.
      required:
      - confirmation
      - final_approver
      - timestamp
      properties:
        confirmation:
          type: string
          description: Confirmation code the user needs to present when resuming the original request.
          example: ba1d75dd-d999-4c1b-944d-25c25440c8af
        final_approver:
          type: string
          description: The ID of the logged-in user whose action created this approval.
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    TotpChallengeAnswer:
      type: object
      description: Sent from the client to the server to answer a TOTP challenge
      required:
      - totp_id
      - code
      properties:
        code:
          type: string
          description: The current TOTP code
        totp_id:
          type: string
          description: The ID of the challenge that was returned from the POST endpoint
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    UserVerificationRequirement:
      type: string
      description: 'A WebAuthn Relying Party may require user verification for some of its

        operations but not for others, and may use this type to express its needs.


        https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement'
      enum:
      - required
      - discouraged
      - preferred
    ConfiguredMfa:
      oneOf:
      - type: object
        required:
        - type
        properties:
          type:
            type: string
            enum:
            - totp
      - type: object
        description: Named FIDO device (multiple can be configured per user)
        required:
        - name
        - discoverable
        - id
        - created_at
        - last_used_at
        - aaguid
        - type
        properties:
          aaguid:
            type: string
            description: UUID of the device type
          created_at:
            type: integer
            format: int64
            description: Creation date
            minimum: 0
          discoverable:
            type: boolean
            description: Whether this key was requested to be discoverable.
          id:
            type: string
            description: A unique credential id
          last_used_at:
            type: integer
            format: int64
            description: Last used date
            minimum: 0
          name:
            type: string
            description: A human-readable name given to the key
          type:
            type: string
            enum:
            - fido
      discriminator:
        propertyName: type
    EmailOtpAnswer:
      type: object
      description: An answer to the challenge returned by the `mfa_email_init` endpoint.
      required:
      - token
      properties:
        token:
          type: string
          description: 'Full JWT token, constructed by concatenating the "partial token"

            (i.e., `{header}.{payload}.`) returned by the `mail_email_init` endpoint

            and the signature sent to the user''s email.'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    AuthenticatorAssertionResponse:
      type: object
      description: 'Represents the assertion response used by clients when attempting to log in with a known credential

        https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse'
      required:
      - clientDataJSON
      - authenticatorData
      - signature
      properties:
        authenticatorData:
          type: string
          description: 'Contains the standard CTAP2 authenticator data. Must be a valid [`AuthenticatorData`].

            This contains information about how key was invoked.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-authenticatordata'
        clientDataJSON:
          type: string
          description: 'Contains UTF8 encoded JSON which must be a valid [`ClientData`]

            This data is combined with `authenticator_data` to produce the signature

            meaning the client attests to the correctness of this data.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorresponse-clientdatajson'
        signature:
          type: string
          description: 'The signature of the concatenated `authenticatorData || hash` where

            `hash` is the SHA256 hash of the `clientDataJSON` buffer:


            Field Definition: https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-signature

            Step 11 of `getAssertion` specifies the concatenation: https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion

            Requirement for SHA-256: https://www.w3.org/TR/webauthn-2/#collectedclientdata-hash-of-the-serialized-client-data'
        userHandle:
          type: string
          description: 'Allows the authenticator to optionally declare the credential identifier they used.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-userhandle'
          nullable: true
    MembershipStatus:
      type: string
      enum:
      - enabled
      - disabled
    TotpResetRequest:
      type: object
      description: Request to reset TOTP.
      properties:
        issuer:
          type: string
          description: The name of the issuer; defaults to "Cubist".
          nullable: true
    OperationKind:
      type: string
      description: All different kinds of sensitive operations
      enum:
      - AvaSign
      - AvaChainTxSign
      - BabylonCovSign
      - BabylonRegistration
      - BabylonStaking
      - BinanceSubToMaster
      - BinanceSubToSub
      - BinanceUniversalTransfer
      - BinanceSubAccountAssets
      - BinanceAccountInfo
      - BinanceSubAccountTransferHistory
      - BinanceUniversalTransferHistory
      - BinanceWithdraw
      - BinanceWithdrawHistory
      - BinanceDeposit
      - BinanceDepositHistory
      - BinanceListSubAccounts
      - BinanceCoinInfo
      - BlobSign
      - BtcMessageSign
      - BtcSign
      - BybitQueryUser
      - BybitQuerySubMembers
      - BybitQueryCoinsBalance
      - BybitQueryDepositAddress
      - BybitUniversalTransfer
      - BybitWithdraw
      - BybitWithdrawals
      - CoinbaseListAccounts
      - CoinbaseListPortfolios
      - CoinbaseMoveFunds
      - DiffieHellman
      - PsbtSign
      - TaprootSign
      - Eip191Sign
      - Eip712Sign
      - Eip7702Sign
      - EotsNonces
      - EotsSign
      - Eth1Sign
      - Eth2Sign
      - Eth2Stake
      - Eth2Unstake
      - SolanaSign
      - SuiSign
      - TendermintSign
      - RoleUpdate
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    TotpApproveRequest:
      type: object
      required:
      - code
      properties:
        code:
          type: string
          description: TOTP verification code
    MfaType:
      type: string
      format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
      description: Different types that can be used to approve an MFA request
      pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
    PolicyErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PolicyErrorOwnCodes'
      - $ref: '#/components/schemas/EvmTxDepositErrorCode'
    MfaRequestInfo:
      type: object
      description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp').
      required:
      - id
      - expires_at
      - request
      - status
      - created_by
      - provenance
      properties:
        created_at:
          $ref: '#/components/schemas/EpochDateTime'
        created_by:
          type: string
          description: The session identity (user or role) that created this request.
        expires_at:
          $ref: '#/components/schemas/EpochDateTime'
        id:
          type: string
          description: Approval request ID.
        not_valid_until:
          $ref: '#/components/schemas/EpochDateTime'
        provenance:
          type: string
          description: MFA policy provenance
          enum:
          - Org
          - Key
          - KeyInRole
          - Role
          - User
          - EditPolicy
        receipt:
          allOf:
          - $ref: '#/components/schemas/Receipt'
          nullable: true
        region:
          type: string
          description: The region this MFA request was created in.  It can only be redeemed from the same region.
        related_ids:
          type: array
          items:
            type: string
          description: 'If set, contains the IDs of all MFA requests (including this one!) that

            were generated at once for the same CubeSigner operation.


            If not set, it means that this was the lone MFA request generated for `request`.


            This is useful so that a client can discover all the MFAs whose receipts must

            be submitted together to carry out the original CubeSigner operation.'
        request:
          $ref: '#/components/schemas/HttpRequest'
        status:
          $ref: '#/components/schemas/Status'
    VerifiedEmail:
      type: object
      required:
      - email
      - updated_at
      properties:
        email:
          type: string
          description: Email address
        updated_at:
          type: integer
          format: int64
          description: Last time this record was updated (in seconds since unix epoch)
          minimum: 0
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    NewSessionResponse:
      type: object
      description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.).
      required:
      - org_id
      - token
      - refresh_token
      - session_info
      properties:
        expiration:
          type: integer
          format: int64
          description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed.
          example: 1701879640
          minimum: 0
        org_id:
          $ref: '#/components/schemas/Id'
        refresh_token:
          type: string
          description: Token that can be used to refresh this session.
        session_info:
          $ref: '#/components/schemas/ClientSessionInfo'
        token:
          type: string
          description: 'New token to be used for authentication. Requests to signing endpoints

            should include this value in the `Authorization` header.'
    ApprovalInfo:
      type: object
      required:
      - timestamp
      properties:
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    OrgData:
      type: object
      required:
      - org_id
      properties:
        org_id:
          type: string
          description: The id of the org
          example: Org#123...
        org_name:
          type: string
          description: The human-readable name for the org
          example: my_org_name
          nullable: true
    TimeoutErrorCode:
      type: string
      enum:
      - PolicyEngineTimeout
      - WasmPolicyExecutionTimeout
  responses:
    EmptyImpl:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            properties:
              status:
                type: string
    TotpInfo:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - totp_id
            - totp_url
            properties:
              totp_id:
                type: string
                description: The ID of the TOTP challenge.
                example: TotpChallenge#7892ebba-563e-485b-bb7d-e26267363286
              totp_url:
                type: string
                description: Standard TOTP url which includes everything needed to initialize TOTP.
                example: otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist
    FidoCreateChallengeResponse:
      description: 'Sent by the server to the client. Contains the challenge data that must be

        used to generate a new credential'
      content:
        application/json:
          schema:
            allOf:
            - allOf:
              - $ref: '#/components/schemas/ChallengePieces'
              - type: object
                required:
                - options
                properties:
                  options:
                    $ref: '#/components/schemas/PublicKeyCredentialCreationOptions'
              description: 'An extended form of `PublicKeyCredentialCreationOptions` that allows clients to derive the WebAuthn challenge

                from a structured preimage.


                This ensures that the webuathn signature can only be used for a specific purpose'
            - type: object
              required:
              - challenge_id
              properties:
                challenge_id:
                  type: string
                  description: The id of the challenge. Must be supplied when answering the challenge.
            description: 'Sent by the server to the client. Contains the challenge data that must be

              used to generate a new credential'
    EmailOtpResponse:
      description: 'The HTTP response to an email OTP request.


        This response contains an OIDC token without a signature.

        The signature is sent to the end-user in an email.

        The token can be reconstructed by concatenating the `partial_token` with the signature.'
      content:
        application/json:
          schema:
            type: object
            description: 'The HTTP response to an email OTP request.


              This response contains an OIDC token without a signature.

              The signature is sent to the end-user in an email.

              The token can be reconstructed by concatenating the `partial_token` with the signature.'
            required:
            - partial_token
            properties:
              partial_token:
                type: string
                description: 'The OIDC token without the signature.

                  (The signature, which is actually a MAC, is sent to the end-user in an email)'
    UserInfo:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - user_id
            - org_ids
            - orgs
            - mfa
            properties:
              email:
                type: string
                description: Optional email
                example: alice@example.com
                nullable: true
              mfa:
                type: array
                items:
                  $ref: '#/components/schemas/ConfiguredMfa'
                description: All multi-factor authentication methods configured for this user
              mfa_policy:
                allOf:
                - $ref: '#/components/schemas/MfaPolicy'
                nullable: true
              name:
                type: string
                description: Optional name
                example: Alice
                nullable: true
              org_ids:
                type: array
                items:
                  type: string
                description: All organizations the user belongs to. Deprecated in favor of 'orgs'.
                deprecated: true
                example:
                - Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
              orgs:
                type: array
                items:
                  $ref: '#/components/schemas/UserInOrgMembership'
                description: All organizations the user belongs to, including the membership role in each.
              user_id:
                type: string
                description: The id of the currently logged in user
                example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
              verified_email:
                allOf:
                - $ref: '#/components/schemas/VerifiedEmail'
                nullable: true
    UserOrgsResponse:
      description: The response to the user/orgs endpoint
      content:
        application/json:
          schema:
            type: object
            description: The response to the user/orgs endpoint
            required:
            - orgs
            properties:
              orgs:
                type: array
                items:
                  $ref: '#/components/schemas/OrgData'
                description: The list of orgs this user is a member of
  securitySchemes:
    Oidc:
      type: apiKey
      in: header
      name: Authorization
      description: OIDC tokens allow users to authenticate using a third-party service. These are exchanged for signer session tokens.
    SignerAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Signing API end-points use session tokens for auth. Specifically, with each request you need to use the \`token\` from your signer session (which you create with `cs token create`).