Cubist

Cubist MFA API

The MFA API from Cubist — 5 operation(s) for mfa.

GitHub OpenAPI

Operations 8

GET /v0/org/{org_id}/mfa List Pending MFA Requests #
GET /v0/org/{org_id}/mfa/{mfa_id} Get Pending MFA Request #
PATCH /v0/org/{org_id}/mfa/{mfa_id} Approve or Reject MFA Request #
POST /v0/org/{org_id}/mfa/{mfa_id}/email Initiate an Email OTP MFA Approval/Rejection #
PATCH /v0/org/{org_id}/mfa/{mfa_id}/email Finalize a Email OTP MFA Approval/Rejection. #
POST /v0/org/{org_id}/mfa/{mfa_id}/fido Initiate a FIDO MFA Approval/Rejection #
PATCH /v0/org/{org_id}/mfa/{mfa_id}/fido Finalize a FIDO MFA Approval/Rejection #
PATCH /v0/org/{org_id}/mfa/{mfa_id}/totp Approve/Reject a TOTP MFA Request #

Documentation

📖
Documentation
https://cubist.dev/product-suite

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-mfa-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/cubist-mfa-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

cubist-mfa-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: CubeSigner Account MFA API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: MFA
paths:
  /v0/org/{org_id}/mfa:
    get:
      tags:
      - MFA
      summary: List Pending MFA Requests
      description: 'List Pending MFA Requests


        Retrieves and returns all pending MFA requests that are accessible to the current session,

        i.e., those created by the current session identity plus those in which the current user

        is listed as an approver


        NOTE that if pagination is used and a page limit is set, the returned result

        set may contain either FEWER or MORE elements than the requested page limit.'
      operationId: mfaList
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type:
          - string
          - 'null'
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListMfaResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:list
  /v0/org/{org_id}/mfa/{mfa_id}:
    get:
      tags:
      - MFA
      summary: Get Pending MFA Request
      description: 'Get Pending MFA Request


        Retrieves and returns a pending MFA request by its id.'
      operationId: mfaGet
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/MfaRequestInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth: []
    patch:
      tags:
      - MFA
      summary: Approve or Reject MFA Request
      description: 'Approve or Reject MFA Request


        Approve or reject request after logging in with CubeSigner.


        If approving, adds the currently-logged user as an approver

        of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of

        approvers is reached, the MFA request is approved; the confirmation receipt can be used to

        resume the original HTTP request.


        If rejecting, immediately deletes the pending MFA request.'
      operationId: mfaVoteCs
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_vote
        in: query
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/MfaVote'
        style: form
      responses:
        '200':
          $ref: '#/components/responses/MfaRequestInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:cs
  /v0/org/{org_id}/mfa/{mfa_id}/email:
    post:
      tags:
      - MFA
      summary: Initiate an Email OTP MFA Approval/Rejection
      description: 'Initiate an Email OTP MFA Approval/Rejection


        Initiates the approval/rejection process of an MFA Request using Email OTP.'
      operationId: mfaEmailInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_vote
        in: query
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/MfaVote'
        style: form
      responses:
        '200':
          $ref: '#/components/responses/EmailOtpResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:email
    patch:
      tags:
      - MFA
      summary: Finalize a Email OTP MFA Approval/Rejection.
      description: 'Finalize a Email OTP MFA Approval/Rejection.


        The request should contain the full JWT obtained by concatenating the

        partial token returned by the `mfa_email_init` endpoint and the signature

        emailed to the user issuing the request.


        If approving, adds an approver to a pending MFA request.

        If the required number of approvers is reached, the MFA request is approved;

        the confirmation receipt can be used to resume the original HTTP request.


        If rejecting, immediately deletes the pending MFA request.'
      operationId: mfaVoteEmailComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailOtpAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/MfaRequestInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:email
  /v0/org/{org_id}/mfa/{mfa_id}/fido:
    post:
      tags:
      - MFA
      summary: Initiate a FIDO MFA Approval/Rejection
      description: 'Initiate a FIDO MFA Approval/Rejection


        Initiates the approval/rejection process of an MFA Request using FIDO.'
      operationId: mfaFidoInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/FidoAssertChallenge'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:fido
    patch:
      tags:
      - MFA
      summary: Finalize a FIDO MFA Approval/Rejection
      description: 'Finalize a FIDO MFA Approval/Rejection


        If approving, adds an approver to a pending MFA request.

        If the required number of approvers is reached, the MFA request is approved;

        the confirmation receipt can be used to resume the original HTTP request.


        If rejecting, immediately deletes the pending MFA request.'
      operationId: mfaVoteFidoComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_vote
        in: query
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/MfaVote'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoAssertAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/MfaRequestInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:fido
  /v0/org/{org_id}/mfa/{mfa_id}/totp:
    patch:
      tags:
      - MFA
      summary: Approve/Reject a TOTP MFA Request
      description: 'Approve/Reject a TOTP MFA Request


        If approving, adds the current user as approver to a pending MFA request by

        providing TOTP code. If the required number of approvers is reached, the MFA request is

        approved; the confirmation receipt can be used to resume the original HTTP request.


        If rejecting, immediately deletes the pending MFA request.'
      operationId: mfaVoteTotp
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_id
        in: path
        description: Name or ID of the desired MfaRequest
        required: true
        schema:
          type: string
        example: MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: mfa_vote
        in: query
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/MfaVote'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpApproveRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/MfaRequestInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:vote:totp
components:
  schemas:
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    MfaVote:
      type: string
      enum:
      - approve
      - reject
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    Id:
      type: string
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    PublicKeyCredential:
      type: object
      description: 'This type represents a wire-encodable form of the PublicKeyCredential interface

        Clients may need to manually encode into this format to communicate with the server


        The PublicKeyCredential interface inherits from Credential

        [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to

        the caller when a new credential is created, or a new assertion is

        requested.


        https://www.w3.org/TR/webauthn-2/#iface-pkcredential'
      required:
      - id
      - response
      properties:
        clientExtensionResults:
          type:
          - object
          - 'null'
          description: 'This internal slot contains the results of processing client extensions

            requested by the Relying Party upon the Relying Party''s invocation of

            either navigator.credentials.create() or navigator.credentials.get().


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot


            IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc:


            This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing.

            https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults


            '
        id:
          type: string
          description: 'This internal slot contains the credential ID, chosen by the

            authenticator. The credential ID is used to look up credentials for use,

            and is therefore expected to be globally unique with high probability

            across all credentials of the same type, across all authenticators.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot'
        response:
          oneOf:
          - $ref: '#/components/schemas/AuthenticatorAttestationResponse'
          - $ref: '#/components/schemas/AuthenticatorAssertionResponse'
          description: Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        request_id:
          type: string
          description: Optional request identifier
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
    AuthenticatorAssertionResponse:
      type: object
      description: 'Represents the assertion response used by clients when attempting to log in with a known credential

        https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse'
      required:
      - clientDataJSON
      - authenticatorData
      - signature
      properties:
        authenticatorData:
          type: string
          description: 'Contains the standard CTAP2 authenticator data. Must be a valid [`Authenticato

# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-mfa-api-openapi.yml