openapi: 3.0.3
info:
  title: CubeSigner Account Users In Org API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Users In Org
paths:
  /v0/org/{org_id}/invitations:
    get:
      tags:
      - Users In Org
      summary: List pending invitations
      description: 'List pending invitations


        Returns all pending (not yet accepted) invitations for the organization.'
      operationId: listInvitations
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListInvitationsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:invitation:list
    delete:
      tags:
      - Users In Org
      summary: Cancel a pending invitation
      description: 'Cancel a pending invitation


        Removes a pending invitation from the organization. If no pending invitation

        exists for the given email address, a not-found error is returned.'
      operationId: cancelInvitation
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CancelInvitationRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:invitation:cancel
  /v0/org/{org_id}/invite:
    post:
      tags:
      - Users In Org
      summary: Invite User
      description: 'Invite User


        Creates a new user in an existing org and sends that user an invite email.'
      operationId: invite
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InviteRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:inviteUser
  /v0/org/{org_id}/users:
    get:
      tags:
      - Users In Org
      summary: List users in organization
      description: 'List users in organization


        If a query is defined, the result will contain only the users whose name or

        email contain the query string. NOTE that if pagination is used and a page

        limit is set, the returned result set may contain FEWER elements than the

        requested page limit.

        '
      operationId: listUsersInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      - name: q
        in: query
        description: A query string. If defined, all returned users will contain this string in their name or email.
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedGetUsersInOrgResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:user:list
    post:
      tags:
      - Users In Org
      summary: Add a third-party user to the org
      description: 'Add a third-party user to the org

        '
      operationId: createOidcUser
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddThirdPartyUserRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/AddThirdPartyUserResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:addUser
  /v0/org/{org_id}/users/email/{email}:
    get:
      tags:
      - Users In Org
      summary: Get user by email.
      description: 'Get user by email.


        The search includes all users and their third-party identities.'
      operationId: getUserInOrgByEmail
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: email
        in: path
        description: The email associated with the user.
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/GetUserByEmailResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:user:get
  /v0/org/{org_id}/users/oidc:
    delete:
      tags:
      - Users In Org
      summary: Remove a third-party user from the org
      description: 'Remove a third-party user from the org

        '
      operationId: deleteOidcUser
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: revoke_role_sessions_they_created
        in: query
        required: false
        schema:
          type: boolean
          nullable: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OidcIdentity'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:deleteUser
  /v0/org/{org_id}/users/oidc/{iss}/{sub}:
    get:
      tags:
      - Users In Org
      summary: Get a user by their OIDC identity
      description: 'Get a user by their OIDC identity


        Retrieves a user in the organization by their OIDC issuer and subject.'
      operationId: getUserInOrgByOidc
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: iss
        in: path
        description: The OIDC issuer.
        required: true
        schema:
          type: string
      - name: sub
        in: path
        description: The OIDC subject.
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/GetUserByOidcResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:user:get
  /v0/org/{org_id}/users/reset_mfa:
    post:
      tags:
      - Users In Org
      summary: Initialize MFA reset for user
      description: Initialize MFA reset for user
      operationId: resetMemberMfa
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MfaResetRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:resetMfa
    patch:
      tags:
      - Users In Org
      summary: Complete MFA reset for user
      description: Complete MFA reset for user
      operationId: completeResetMemberMfa
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteMfaResetRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - Oidc: []
  /v0/org/{org_id}/users/{user_id}:
    get:
      tags:
      - Users In Org
      summary: Get user by id
      description: 'Get user by id


        If the requesting user is an owner of the org, the response additionally

        includes the user''s OIDC identities.'
      operationId: getUserInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: user_id
        in: path
        description: ID of the desired User
        required: true
        schema:
          type: string
        example: User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/UserInOrgInfoWithIdentity'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:user:get
    delete:
      tags:
      - Users In Org
      summary: Remove a user from the org
      description: 'Remove a user from the org

        '
      operationId: deleteUser
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: user_id
        in: path
        description: ID of the desired User
        required: true
        schema:
          type: string
        example: User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: revoke_role_sessions_they_created
        in: query
        required: false
        schema:
          type: boolean
          nullable: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:deleteUser
  /v0/org/{org_id}/users/{user_id}/membership:
    patch:
      tags:
      - Users In Org
      summary: Update a user's membership in the org
      description: 'Update a user''s membership in the org


        Enable/disable another user in the org, or change their membership role.'
      operationId: updateUserMembership
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: user_id
        in: path
        description: ID of the desired User
        required: true
        schema:
          type: string
        example: User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserMembershipRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/UserInOrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:updateMembership
components:
  schemas:
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    InvitationInfo:
      type: object
      description: Information about a pending invitation
      required:
      - email
      - name
      - role
      - created
      - expiration
      properties:
        created:
          $ref: '#/components/schemas/EpochDateTime'
        email:
          type: string
          description: The email address the invitation was sent to
        expiration:
          $ref: '#/components/schemas/EpochDateTime'
        inviter:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
        name:
          type: string
          description: The invited user's name
        role:
          $ref: '#/components/schemas/MemberRole'
    Empty:
      default: null
      nullable: true
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    ConfiguredMfa:
      oneOf:
      - type: object
        required:
        - type
        properties:
          type:
            type: string
            enum:
            - totp
      - type: object
        description: Named FIDO device (multiple can be configured per user)
        required:
        - name
        - discoverable
        - id
        - created_at
        - last_used_at
        - aaguid
        - type
        properties:
          aaguid:
            type: string
            description: UUID of the device type
          created_at:
            type: integer
            format: int64
            description: Creation date
            minimum: 0
          discoverable:
            type: boolean
            description: Whether this key was requested to be discoverable.
          id:
            type: string
            description: A unique credential id
          last_used_at:
            type: integer
            format: int64
            description: Last used date
            minimum: 0
          name:
            type: string
            description: A human-readable name given to the key
          type:
            type: string
            enum:
            - fido
      discriminator:
        propertyName: type
    IdentityInfo:
      allOf:
      - $ref: '#/components/schemas/OidcIdentity'
      - $ref: '#/components/schemas/OidcUserInfo'
      - type: object
      description: 'Information about a linked OIDC identity including unique identifiers and user info

        (e.g., email)'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    AddThirdPartyUserRequest:
      type: object
      required:
      - role
      properties:
        email:
          type: string
          description: Optional user email
          example: alice@example.com
          nullable: true
        identity:
          allOf:
          - $ref: '#/components/schemas/OidcIdentity'
          nullable: true
        mfa_policy:
          type: object
          description: Optional login MFA policy
          nullable: true
        name:
          type: string
          description: Optional user full name
          example: Alice Wonderland
          nullable: true
        proof:
          allOf:
          - $ref: '#/components/schemas/IdentityProof'
          nullable: true
        role:
          $ref: '#/components/schemas/MemberRole'
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    MembershipStatus:
      type: string
      enum:
      - enabled
      - disabled
    UpdateUserMembershipRequest:
      type: object
      description: Request to update an existing user
      properties:
        disabled:
          type: boolean
          description: Enable or disable user
          nullable: true
        role:
          allOf:
          - $ref: '#/components/schemas/MemberRole'
          nullable: true
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    IdentityProof:
      allOf:
      - type: object
        description: 'Evidence is used in non-custodial deployments to prove to a third-party that

          a user has indeed authenticated with CubeSigner.


          This evidence can be obtained by either logging in with an OIDC token or with

          a CubeSigner session token. In the latter case, no [Proof::aud] is set.'
        required:
        - exp_epoch
        properties:
          aud:
            allOf:
            - $ref: '#/components/schemas/Aud'
            nullable: true
          email:
            type: string
            description: The email associated with the user
            example: user@email.com
            nullable: true
          exp_epoch:
            $ref: '#/components/schemas/EpochDateTime'
          identity:
            allOf:
            - $ref: '#/components/schemas/OidcIdentity'
            nullable: true
          preferred_username:
            type: string
            description: The username (if any) associated with the user
            example: cubistdev
            nullable: true
          user_info:
            allOf:
            - $ref: '#/components/schemas/CubeSignerUserInfo'
            nullable: true
      - type: object
        required:
        - id
        properties:
          id:
            type: string
            description: An opaque identifier for the proof
      description: 'Proof that an end-user provided CubeSigner with a valid auth token

        (either an OIDC token or a CubeSigner session token)'
    Aud:
      oneOf:
      - type: string
      - type: array
        items:
          type: string
      description: 'Audience(s) that this ID Token is intended for. It MUST contain the

        OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain

        identifiers for other audiences. In the general case, the aud value is an array of

        case-sensitive strings. In the common special case when there is one audience,

        the aud value MAY be a single case-sensitive string.'
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    EvmTxCmp:
      type: object
      properties:
        grace:
          type: integer
          format: int64
          description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.


            In this case, however, because EVM transactions already have a replay prevention mechanism

            (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to

            indicate how long an MFA receipt should remain valid after its first use.


            Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request

            enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to

            ensure that any subsequent requests that claim the same receipt must sign for the same

            nonce as the request we signed originally with that receipt.


            Also note that the grace period cannot extend the lifetime of an MFA request beyond its

            original expiration date.


            The grace period must not be greater than 30 days.'
          nullable: true
          minimum: 0
        ignore_gas:
          type: boolean
          description: Whether the 'gas' property of the EVM transaction is allowed to be different.
        ignore_nonce:
          type: boolean
          description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
    EvmTxDepositErrorCode:
      type: string
      enum:
      - EvmTxDepositReceiverMismatch
      - EvmTxDepositEmptyData
      - EvmTxDepositEmptyChainId
      - EvmTxDepositEmptyReceiver
      - EvmTxDepositUnexpectedValue
      - EvmTxDepositUnexpectedDataLength
      - EvmTxDepositNoAbi
      - EvmTxDepositNoDepositFunction
      - EvmTxDepositUnexpectedFunctionName
      - EvmTxDepositUnexpectedValidatorKey
      - EvmTxDepositInvalidValidatorKey
      - EvmTxDepositMissingDepositArg
      - EvmTxDepositWrongDepositArgType
      - EvmTxDepositValidatorKeyNotInRole
      - EvmTxDepositUnexpectedWithdrawalCredentials
      - EvmTxDepositUnresolvedRole
      - EvmTxDepositInvalidDepositEncoding
    OidcUserInfo:
      type: object
      properties:
        email:
          type: string
          description: The email associated with the user
          example: user@email.com
          nullable: true
        preferred_username:
          type: string
          description: The user name (if any) associated with the user
          example: dril
          nullable: true
    CubeSignerUserInfo:
      type: object
      required:
      - user_id
      - initialized
      - configured_mfa
      properties:
        configured_mfa:
          type: array
          items:
            $ref: '#/components/schemas/ConfiguredMfa'
          description: All multi-factor authentication methods configured for this user
        initialized:
          type: boolean
          description: Set once the user successfully logs into CubeSigner
        name:
          type: string
          description: Optional human name for the user
          nullable: true
        user_id:
          type: string
          description: CubeSigner's user identifier
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
          nullable: true
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        request_id:
          type: string
          description: Optional request identifier
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    OidcIdentity:
      type: object
      description: 'Represents a globally unique OIDC-authorized user by expressing the full "path" to a user. That is:


        (iss)       (sub)

        Issuer -> Subresource'
      required:
      - iss
      - sub
      properties:
        iss:
          type: string
          description: 'The root-level issuer who administrates this user. From the OIDC spec:

            Issuer Identifier for the Issuer of the response. The iss

            value is a case sensitive URL using the https scheme that contains

            scheme, host, and optionally, port number and path components and

            no query or fragment components.'
          example: https://accounts.google.com
        sub:
          type: string
          description: 'From the OIDC spec:


            A locally unique and never reassigned identifier within the Issuer for

            the End-User, which is intended to be consumed by the Client, e.g.,

            24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed

            255 ASCII characters in length. The sub value is a case sensitive

            string.'
          example: '10769150350006150715113082367'
    ClientSessionInfo:
      type: object
      description: 'Session information sent to the client.

        This struct works in tandem with its server-side counterpart [`SessionData`].'
      required:
      - session_id
      - auth_token
      - refresh_token
      - epoch
      - epoch_token
      - auth_token_exp
      - refresh_token_exp
      properties:
        auth_token:
          type: string
          description: Token to use for authorization.
        auth_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        epoch:
          type: integer
          format: int32
          description: Epoch at which the token was last refreshed
          minimum: 0
        epoch_token:
          $ref: '#/components/schemas/B32'
        refresh_token:
          type: string
          description: Token to use for refreshing the `(auth, refresh)` token pair
        refresh_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        session_id:
          type: string
          description: Session ID
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    InviteKind:
      type: string
      description: Indicates the auth sources allowed to an invited user
      enum:
      - Cognito
      - IdpAndSso
      - Sso
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    Email:
      type: string
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    MfaResetRequest:
      type: object
      required:
      - user_id
      properties:
        user_id:
          type: string
          description: The id of the user you want to reset MFA for
          example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
          nullable: true
    Id:
      type: string
    UserInOrgInfoWithIdentity:
      allOf:
      - type: object
        required:
        - id
        - membership
        - status
        properties:
          email:
            type: string
            description: The user's email (optional)
            example: alice@example.com
            nullable: true
          id:
            type: string
            description: The id of the user
            example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
          initialized:
            type: boolean
            description: Whether the user has ever successfully logged in
          membership:
            $ref: '#/components/schemas/MemberRole'
          name:
            type: string
            description: Optional user name.
            nullable: true
          status:
            $ref: '#/components/schemas/MembershipStatus'
          verified_email:
            allOf:
            - $ref: '#/components/schemas/VerifiedEmail'
            nullable: true
      - type: object
        properties:
          identities:
            type: array
            items:
              $ref: '#/components/schemas/IdentityInfo'
            description: Optional third-party identities via which the user was found
    MfaType:
      type: string
      format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
      description: Different types that can be used to approve an MFA request
      pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
    PolicyErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PolicyErrorOwnCodes'
      - $ref: '#/components/schemas/EvmTxDepositErrorCode'
    MfaRequestInfo:
      type: object
      description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp').
      required:
      - id
      - expires_at
      - request
      - status
      - created_by
      - provenance
      properties:
        created_at:
          $ref: '#/components/schemas/EpochDateTime'
        created_by:
          type: string
          description: The session identity (user or role) that created this request.
        expires_at:
          $ref: '#/components/schemas/EpochDateTime'
        id:
          type: string
          description: Approval request ID.
        not_valid_until:
          $ref: '#/components/schemas/EpochDateTime'
        provenance:
          type: string
          description: MFA policy provenance
          enum:
          - Org
          - Key
          - KeyInRole
          - Role
          - User
          - EditPolicy
        receipt:
          allOf:
          - $ref: '#/components/schemas/Receipt'
          nullable: true
        region:
          type: string
          description: The region this MFA request was created in.  It can only be redeemed from the same region.
        related_ids:
          type: array
          items:
            type: string
          description: 'If set, contains the IDs of all MFA requests (including this one!) that

            were generated at once for the same CubeSigner operation.


            If not set, it means that this was the lone MFA request generated for `request`.


            This is useful so that a client can discover all the MFAs whose receipts must

            be submitted together to carry out the original CubeSigner operation.'
        request:
          $ref: '#/components/schemas/HttpRequest'
        status:
          $ref: '#/components/schemas/Status'
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    InviteRequest:
      type: object
      required:
      - email
      - name
      properties:
        email:
          type: string
          description: The user's email address
          example: alice@acme.com
        invite_kind:
          allOf:
          - $ref: '#/components/schemas/InviteKind'
          nullable: true
        mfa_policy:
          type: object
          description: Optional login MFA policy
          nullable: true
        name:
          type: string
          description: The user's full name
          example: Alice Wonderland
        role:
          allOf:
          - $ref: '#/components/schemas/MemberRole'
          nullable: true
        skip_email:
          type: boolean
          description: 'Skip sending an invitation email to this user if true.


            NOTE: this field is for internal testing use ONLY. If you do not

            send an invitation email (and the invite kind is not SSO), the user will never be able to log in.'
          example: 'false'
    CancelInvitationRequest:
      type: object
      required:
      - email
      properties:
        email:
          $ref: '#/components/schemas/Email'
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    CompleteMfaResetRequest:
      type: object
      required:
      - token
      properties:
        token:
          type: string
          description: The reset token emailed to the user
          example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
    VerifiedEmail:
      type: object
      required:
      - email
      - updated_at
      properties:
        email:
          type: string
          description: Email address
        updated_at:
          type: integer
          format: int64
          description: Last time this record was updated (in seconds since unix epoch)
          minimum: 0
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    NewSessionResponse:
      type: object
      description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.).
      required:
      - org_id
      - token
      - refresh_token
      - session_info
      properties:
        expiration:
          type: integer
          format: int64
          description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed.
          example: 1701879640
          minimum: 0
        org_id:
          $ref: '#/components/schemas/Id'
        refresh_token:
          type: string
          description: Token that can be used to refresh this session.
        session_info:
          $ref: '#/components/schemas/ClientSessionInfo'
        token:
          type: string
          description: 'New token to be used for authentication. Requests to signing endpoints

            should include this value in the `Authorization` header.'
    HttpRequest:
      type: object
      description: 'Information about the request.


        Captures all the relevant info (including the request body) about requests that require MFA.

        We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)

        it is exactly the same as it originally was.'
      required:
      - method
      - path
      properties:
        body:
          type: object
          description: HTTP request body
          nullable: true
        method:
          type: string
          description: HTTP method of the request
        path:
          type: string
          description: HTTP path of the request, excluding the host
    ApprovalInfo:
      type: object
      required:
      - timestamp
      properties:
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    Receipt:
      type: object
      description: Receipt that an MFA request was approved.
      required:
      - confirmation
      - final_approver
      - timestamp
      properties:
        confirmation:
          type: string
          description: Confirmation code the user needs to present when resuming the original request.
          example: ba1d75dd-d999-4c1b-944d-25c25440c8af
        final_approver:
          type: string
          description: The ID of the logged-in user whose action created this approval.
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    MemberRole:
      type: string
      description: Describes whether a user in an org is an Owner or just a regular member
      enum:
      - Alien
      - Member
      - Owner
    TimeoutErrorCode:
      type: string
      enum:
      - PolicyEngineTimeout
      - WasmPolicyExecutionTimeout
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    UserInOrgInfo:
      type: object
      required:
      - id
      - membership
      - status
      properties:
        email:
          type: string
          description: The user's email (optional)
          example: alice@example.com
          nullable: true
        id:
          type: string
          description: The id of the user
          example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
        initialized:
          type: boolean
          description: Whether the user has ever successfully logged in
        membership:
          $ref: '#/components/schemas/MemberRole'
        name:
          type: string
          description: Optional user name.
          nullable: true
        status:
          $ref: '#/components/schemas/MembershipStatus'
        verified_email:
          allOf:
          - $ref: '#/components/schemas/VerifiedEmail'
          nullable: true
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
  responses:
    PaginatedGetUsersInOrgResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              required:
              - users
              properties:
                users:
                  type: array
                  items:
                    $ref: '#/components/schemas/UserInOrgInfo'
                  description: The list of users in the org
            - type: object
              properties:
                last_evaluated_key:
                  type: string
                  description: 'If set, the content of `response` does not contain the entire result set.

                    To fetch the next page of the result set, call the same endpoint

                    but specify this value as the ''page.start'' query parameter.'
                  nullable: true
            description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key`

              value (which can the user pass back to use as a url query parameter to continue pagination).'
    PaginatedListInvitationsResponse:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              description: List of pending invitations
              required:
              - invitations
              properties:
                invitations:
                  type: array
                  items:
                    $ref: '#/components/schemas/InvitationInfo'
                  description: Pending invitations
            - type: object
              properties:
                last_evaluated_key:
                  type: string
                  description: 'If set, the content of `response` does not contain the entire result set.

                    To fetch the next page of the result set, call the same endpoint

                    but specify this value as the ''page.start'' query parameter.'
                  nullable: true
            description: 'Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key`

              value (which can the user pass back to use as a url query parameter to continue pagination).'
    EmptyImpl:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            properties:
              status:
                type: string
    UserInOrgInfo:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - id
            - membership
            - status
            properties:
              email:
                type: string
                description: The user's email (optional)
                example: alice@example.com
                nullable: true
              id:
                type: string
                description: The id of the user
                example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
              initialized:
                type: boolean
                description: Whether the user has ever successfully logged in
              membership:
                $ref: '#/components/schemas/MemberRole'
              name:
                type: string
                description: Optional user name.
                nullable: true
              status:
                $ref: '#/components/schemas/MembershipStatus'
              verified_email:
                allOf:
                - $ref: '#/components/schemas/VerifiedEmail'
                nullable: true
    GetUserByOidcResponse:
      description: ''
      content:
        application/json:
          schema:
            type: object
            properties:
              user:
                allOf:
                - $ref: '#/components/schemas/UserInOrgInfoWithIdentity'
                nullable: true
    AddThirdPartyUserResponse:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - user_id
            properties:
              user_id:
                type: string
                example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
    GetUserByEmailResponse:
      description: ''
      content:
        application/json:
          schema:
            type: object
            required:
            - users
            properties:
              users:
                type: array
                items:
                  $ref: '#/components/schemas/UserInOrgInfoWithIdentity'
                description: 'Typically, this array is either empty (if no user with a given email was found)

                  or contains a single element, i.e., the user with a given email.'
    UserInOrgInfoWithIdentity:
      description: ''
      content:
        application/json:
          schema:
            allOf:
            - type: object
              required:
              - id
              - membership
              - status
              properties:
                email:
                  type: string
                  description: The user's email (optional)
                  example: alice@example.com
                  nullable: true
                id:
                  type: string
                  description: The id of the user
                  example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
                initialized:
                  type: boolean
                  description: Whether the user has ever successfully logged in
                membership:
                  $ref: '#/components/schemas/MemberRole'
                name:
                  type: string
                  description: Optional user name.
                  nullable: true
                status:
                  $ref: '#/components/schemas/MembershipStatus'
                verified_email:
                  allOf:
                  - $ref: '#/components/schemas/VerifiedEmail'
                  nullable: true
            - type: object
              properties:
                identities:
                  type: array
                  items:
                    $ref: '#/components/schemas/IdentityInfo'
                  description: Optional third-party identities via which the user was found
  securitySchemes:
    Oidc:
      type: apiKey
      in: header
      name: Authorization
      description: OIDC tokens allow users to authenticate using a third-party service. These are exchanged for signer session tokens.
    SignerAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Signing API end-points use session tokens for auth. Specifically, with each request you need to use the \`token\` from your signer session (which you create with `cs token create`).