Cubist Keys API

openapi: 3.0.3
info:
  title: CubeSigner Account Keys API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Keys
paths:
  /v0/org/{org_id}/derive_key:
    put:
      tags:
      - Keys
      summary: Derive Key From Long-Lived Mnemonic
      description: 'Derive Key From Long-Lived Mnemonic


        Derives a key of a specified type using a supplied derivation path and an

        existing long-lived mnemonic.'
      operationId: deriveKeyLegacy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeriveKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/derive_keys:
    put:
      tags:
      - Keys
      summary: Derive Key From New Or Existing Long-Lived Mnemonic
      description: 'Derive Key From New Or Existing Long-Lived Mnemonic


        Uses either a new or existing long-lived mnemonic to derive keys of

        one or more specified types via specified derivation paths.'
      operationId: deriveKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeriveKeysRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/export/{key_id}:
    get:
      tags:
      - Keys
      summary: Get an Org-Export Ciphertext
      description: 'Get an Org-Export Ciphertext


        Returns the export ciphertext associated with the provided key-id.

        In order to use this API, you must be an org owner and your org must

        be configured for org export and for API-based export delivery.'
      operationId: getOrgExport
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/OrgExportResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:export:org:get
  /v0/org/{org_id}/import_key:
    get:
      tags:
      - Keys
      summary: Create Key-Import Key
      description: 'Create Key-Import Key


        Generate an ephemeral key that a client can use for key-import encryption.'
      operationId: createKeyImportKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyImportKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:import
    put:
      tags:
      - Keys
      summary: Import Key
      description: 'Import Key


        Securely imports an existing key using a previously generated key-import key.'
      operationId: importKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ImportKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:import
  /v0/org/{org_id}/keys:
    get:
      tags:
      - Keys
      summary: List Keys
      description: 'List Keys


        Gets the list of accessible keys in a given org (to org owner, all org keys

        are accessible; to members, only their own keys are accessible).


        If a search condition is, the result will contain only the keys whose either

        material ID or metadata contain the search condition string.


        NOTE that if pagination is used and a page limit is set, the returned result

        set may contain either FEWER or MORE elements than the requested page limit.'
      operationId: listKeysInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      - name: key_type
        in: query
        description: Filter by key type
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/KeyType'
          nullable: true
        style: form
        example: SecpEthAddr
      - name: key_owner
        in: query
        description: Filter by key owner
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
        style: form
        example: User#5269c579-b4f9-4620-9e90-e46a5a0ffb4d
      - name: search
        in: query
        description: Search key metadata
        required: false
        schema:
          type: string
          nullable: true
        style: form
        example: some value
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListKeysResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:list
    post:
      tags:
      - Keys
      summary: Create Key
      description: 'Create Key


        Creates one or more new keys of the specified type.'
      operationId: createKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/CreateKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:create
  /v0/org/{org_id}/keys/{key_id}:
    get:
      tags:
      - Keys
      summary: Get Key
      description: 'Get Key


        Returns the properties of a key.'
      operationId: getKeyInOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:get
    delete:
      tags:
      - Keys
      summary: Delete Key
      description: 'Delete Key


        Deletes a key specified by its ID.


        Only the key owner and org owners are allowed to delete keys.

        Additionally, the role''s edit policy (if set) must permit the update.'
      operationId: deleteKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:delete
    patch:
      tags:
      - Keys
      summary: Update Key
      description: 'Update Key


        Enable or disable a key.  The user must be the owner of the key or

        organization to perform this action.


        For each requested update, the session must have the corresponding ''manage:key:update:_'' scope;

        if no updates are requested, the session must have ''manage:key:get''.'
      operationId: updateKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateKeyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:update:enabled
        - manage:key:update:metadata
        - manage:key:update:policy
        - manage:key:update:owner
        - manage:key:update:editPolicy
  /v0/org/{org_id}/keys/{key_id}/attest:
    get:
      tags:
      - Keys
      summary: Attest to Key Properties
      description: 'Attest to Key Properties


        The response is a JWT whose claims are the key properties.'
      operationId: attestKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: include_roles
        in: query
        required: false
        schema:
          type: boolean
          nullable: true
      responses:
        '200':
          $ref: '#/components/responses/KeyInfoJwt'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:attest
  /v0/org/{org_id}/keys/{key_id}/roles:
    get:
      tags:
      - Keys
      summary: List Key Roles
      description: 'List Key Roles


        Get all roles the key is in'
      operationId: listKeyRoles
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListKeyRolesResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:list_roles
  /v0/org/{org_id}/keys/{key_id}/tx:
    get:
      tags:
      - Keys
      summary: List Historical Transactions
      description: 'List Historical Transactions


        Returns a sorted, paginated list of transactions signed by a given key,

        ordered from most recent first.'
      operationId: listHistoricalKeyTx
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListHistoricalTxResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:history:tx:list
  /v0/org/{org_id}/keys/{key_type}/{material_id}:
    get:
      tags:
      - Keys
      summary: Get Key by Material ID
      description: 'Get Key by Material ID


        Returns the properties of a key.'
      operationId: getKeyByMaterialId
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_type
        in: path
        description: Type of the key to look up
        required: true
        schema:
          type: string
      - name: material_id
        in: path
        description: Material ID of the key to look up
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/KeyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:get
components:
  schemas:
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    ImportKeyRequestMaterial:
      type: object
      required:
      - ikm_enc
      - salt
      - client_public_key
      properties:
        client_public_key:
          type: string
          description: 'The client''s ephemeral public key used to derive a shared key.

            This is a base64-encoded, SEC1-encoded P384 public key.'
        ikm_enc:
          type: string
          description: 'The encrypted keying material to be imported.

            This is a base64-encoded ciphertext.'
        salt:
          type: string
          description: 'A salt value used to derive a shared key.

            This is a base64-encoded byte string.'
    Empty:
      default: null
      nullable: true
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    KeyDerivationInfo:
      type: object
      description: Derivation-related metadata for keys derived from a long-lived mnemonic
      required:
      - mnemonic_id
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: The derivation path used to derive this key
        mnemonic_id:
          type: string
          description: The mnemonic-id of the key's parent mnemonic
    CoinbaseApiPropertiesPatch:
      type: object
      description: 'Wire-format patch payload for [`KeyProperties::CoinbaseApi`].


        Every field follows the same per-field PATCH semantics: a missing field

        leaves the existing value alone, a JSON `null` clears it, and a value sets it.'
      properties:
        api_key_id:
          type: string
          description: 'Identifier of the Coinbase API key this key authenticates as. Plain

            (non-secret) value; appears in JWT `kid`/`sub` claims.'
          nullable: true
        portfolio_name:
          type: string
          description: Coinbase portfolio name.
          nullable: true
        portfolio_uuid:
          type: string
          description: Coinbase portfolio UUID.
          nullable: true
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    KeyTypeAndDerivationPath:
      type: object
      required:
      - key_type
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: List of derivation paths for which to derive.
          example: m/44'/60'/0'/0/0
        key_type:
          $ref: '#/components/schemas/KeyType'
        policy:
          type: array
          items: {}
          description: 'Policies to apply to this key. It is an error to specify a policy

            that is not compatible with `key_type`.'
          example:
          - AllowRawBlobSigning
          - RequireMfa:
              count: 1
          nullable: true
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    EvmTxCmp:
      type: object
      properties:
        grace:
          type: integer
          format: int64
          description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.


            In this case, however, because EVM transactions already have a replay prevention mechanism

            (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to

            indicate how long an MFA receipt should remain valid after its first use.


            Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request

            enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to

            ensure that any subsequent requests that claim the same receipt must sign for the same

            nonce as the request we signed originally with that receipt.


            Also note that the grace period cannot extend the lifetime of an MFA request beyond its

            original expiration date.


            The grace period must not be greater than 30 days.'
          nullable: true
          minimum: 0
        ignore_gas:
          type: boolea

# --- truncated at 32 KB (92 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-keys-api-openapi.yml