Cubist Login API

openapi: 3.2.0
info:
  title: CubeSigner Account Login API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Login
paths:
  /v0/org/{org_id}/idp/authenticate:
    post:
      tags:
      - Login
      summary: Authenticate
      description: 'Authenticate


        This endpoint exchanges an email & password for an OIDC token'
      operationId: idpAuthenticate
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/AuthenticationResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security: []
  /v0/passkey:
    post:
      tags:
      - Login
      summary: Initiate Login with Passkey
      description: 'Initiate Login with Passkey


        The response contains a FIDO challenge that the client must answer with any of their

        discoverable credentials.  The answer should be submitted with the corresponding PATCH request.'
      operationId: passkeyAuthInit
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PasskeyAssertChallenge'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
    patch:
      tags:
      - Login
      summary: Complete Login with Passkey
      description: 'Complete Login with Passkey


        The request should contain an answer to the challenge issued by the corresponding POST request.

        The challenge may be answered with any of the user''s discoverable credentials; if the credential

        included in the answer is registered with a user and an organization, the response will contain

        a CubeSigner session (with the parameters supplied in the previous POST request) for that user

        in that organization.'
      operationId: passkeyAuthComplete
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyAssertAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/NewSessionResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
components:
  schemas:
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    ClientSessionMetadata:
      type: object
      description: Attributes that are expected to be provided by the client
      properties:
        client:
          $ref: '#/components/schemas/ClientProfile'
        os_info:
          $ref: '#/components/schemas/OsInfo'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    ClientProfile:
      type: object
      description: Client information representing the nature of front-end in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`].
      properties:
        agent:
          type:
          - string
          - 'null'
          description: Agent/Product name
          example: Mozilla Firefox
        engine:
          type:
          - string
          - 'null'
          description: Name of the engine
          example: Gecko
        version:
          type:
          - string
          - 'null'
          description: Agent/product version
          example: '41.2'
    Id:
      type: string
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    PublicKeyCredential:
      type: object
      description: 'This type represents a wire-encodable form of the PublicKeyCredential interface

        Clients may need to manually encode into this format to communicate with the server


        The PublicKeyCredential interface inherits from Credential

        [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to

        the caller when a new credential is created, or a new assertion is

        requested.


        https://www.w3.org/TR/webauthn-2/#iface-pkcredential'
      required:
      - id
      - response
      properties:
        clientExtensionResults:
          type:
          - object
          - 'null'
          description: 'This internal slot contains the results of processing client extensions

            requested by the Relying Party upon the Relying Party''s invocation of

            either navigator.credentials.create() or navigator.credentials.get().


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot


            IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc:


            This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing.

            https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults


            '
        id:
          type: string
          description: 'This internal slot contains the credential ID, chosen by the

            authenticator. The credential ID is used to look up credentials for use,

            and is therefore expected to be globally unique with high probability

            across all credentials of the same type, across all authenticators.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot'
        response:
          oneOf:
          - $ref: '#/components/schemas/AuthenticatorAttestationResponse'
          - $ref: '#/components/schemas/AuthenticatorAssertionResponse'
          description: Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    AuthenticationRequest:
      type: object
      description: The request body for the idp authenticate endpoint
      required:
      - email
      - password
      properties:
        email:
          type: string
          description: The email address of the user attempting to authenticate
          example: alice@example.com
        password:
          type: string
          description: The password for that user
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    RatchetConfig:
      type: object
      properties:
        auth_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of auth tokens for this session.

            Auth tokens can be refreshed (renewed) using a valid (unexpired)

            refresh token, but not beyond the session lifetime.'
          default: 300
          example: 3600
          minimum: 0
        grace_lifetime:
          type: integer
          format: int64
          description: 'The amount of time (in seconds) that an auth token for this session remains

            valid after it has been refreshed and a new auth token has been issued. This

            helps to address concurrency hazards, for example, if one thread makes requests

            with auth token while another refreshes it.'
          default: 30
          example: 30
          minimum: 0
        refresh_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of refresh tokens for this session.

            If this value is shorter than the session lifetime, inactive sessions

            will become invalid once the auth and refresh tokens have both expired.'
          default: 86400
          example: 43200
          minimum: 0
        session_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of the session.

            The session cannot be extended beyond its original lifetime.'
          default: 31536000
          example: 86400
          minimum: 0
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        request_id:
          type: string
          description: Optional request identifier
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
    AuthenticatorAssertionResponse:
      type: object
      description: 'Represents the assertion response used by clients when attempting to log in with a known credential

        https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse'
      required:
      - clientDataJSON
      - authenticatorData
      - signature
      properties:
        authenticatorData:
          type: string
          description: 'Contains the standard CTAP2 authenticator data. Must be a valid [`AuthenticatorData`].

            This contains information about how key was invoked.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-authenticatordata'
        clientDataJSON:
          type: string
          description: 'Contains UTF8 encoded JSON which must be a valid [`ClientData`]

            This data is combined with `authenticator_data` to produce the signature

            meaning the client attests to the correctness of this data.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorresponse-clientdatajson'
        signature:
          type: string
          description: 'The signature of the concatenated `authenticatorData || hash` where

            `hash` is the SHA256 hash of the `clientDataJSON` buffer:


            Field Definition: https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-signature

            Step 11 of `getAssertion` specifies the concatenation: https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion

            Requirement for SHA-256: https://www.w3.org/TR/webauthn-2/#collectedclientdata-hash-of-the-serialized-client-data'
        userHandle:
          type:
          - string
          - 'null'
          description: 'Allows the authenticator to optionally declare the credential identifier they used.

            https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-userhandle'
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    UserVerificationRequirement:
      type: string
      description: 'A WebAuthn Relying Party may require user verification for some of its

        operations but not for others, and may use this type to express its needs.


        https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement'
      enum:
      - required
      - discouraged
      - preferred
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    PolicyErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PolicyErrorOwnCodes'
      - $ref: '#/components/schemas/EvmTxDepositErrorCode'
    OsInfo:
      type: object
      description: OS information set in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`]
      properties:
        architecture:
          type:
          - string
          - 'null'
          example: arm64
        name:
          type:
          - string
          - 'null'
          example: Mac OS
        version:
          type:
          - string
          - 'null'
          example: 14.5.0
        word_size:
          type:
          - string
          - 'null'
          example: 64-bit
    MfaType:
      type: string
      format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
      description: Different types that can be used to approve an MFA request
      pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
    Scope:
      oneOf:
      - $ref: '#/components/schemas/ExplicitScope'
      - type: string
        title: OtherScopes
        description: Scopes including wildcard fragments for accessing CubeSigner APIs
        pattern: ^(orgAccess:child)(:[^:]+)?$
      description: All scopes for accessing CubeSigner APIs
    AuthenticatorAttestationResponse:
      type: object
      description: 'The AuthenticatorAttestationResponse interface represents the authenticator''s

        response to a client’s request for the creation of a new public key

        credential. It contains information about the new credential that can be

        used to identify it for later use, and metadata that can be used by the

        WebAuthn Relying Party to assess the characteristics of the credential

        during registration.


        https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse'
      required:
      - clientDataJSON
      - attestationObject
      properties:
        attestationObject:
          type: string
          description: 'This attribute contains an attestation object, which is opaque to, and

   

# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-login-api-openapi.yml