Cubist OAuth2 API
The OAuth2 API from Cubist — 7 operation(s) for oauth2.
OpenAPI Specification
openapi: 3.0.3
info:
title: CubeSigner Account OAuth2 API
description: The CubeSigner management and signing service.
contact:
name: Cubist Inc.
email: hello@cubist.dev
version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
description: Testing and staging environment
- url: https://prod.signer.cubist.dev
description: Production environment
security:
- Cognito: []
tags:
- name: OAuth2
paths:
/v0/oauth/token:
post:
tags:
- OAuth2
summary: Token refresh endpoint, compliant with OAuth.
description: 'Token refresh endpoint, compliant with OAuth.
The body content type can be either ''application/json'' or ''application/x-www-form-urlencoded''.
'
operationId: oauth2TokenRefresh
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TokenRequest'
required: true
responses:
'200':
$ref: '#/components/responses/TokenResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
/v0/org/{org_id}/oauth2/twitter:
post:
tags:
- OAuth2
summary: Mint an OIDC ID token for Twitter
description: 'Mint an OIDC ID token for Twitter
This function acts identically to Twitter''s [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint,
but extends the output with an `id_token`.
This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token.
Callers must request *at least* scopes `tweet.read` and `users.read` during auth with twitter.
By default, the id token does not contain a confirmed email;
callers can request this field be populated by requesting the `users.email` scope
and adding `fetch_email` as a URL parameter to this route.
> [!IMPORTANT]
> This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter.'
operationId: oauth2Twitter
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
- name: fetch_email
in: query
required: false
schema:
type: boolean
nullable: true
requestBody:
content:
application/json:
schema:
type: object
additionalProperties:
type: string
required: true
responses:
'200':
$ref: '#/components/responses/TokenResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
/v0/org/{org_id}/oidc:
post:
tags:
- OAuth2
summary: Login with OIDC
description: 'Login with OIDC
Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session.
MFA is required when:
- an MFA policy is explicitly attached to the user logging in
(e.g., an org owner can do that at user creation time to require certain kind of MFA)
- the user has at least 1 MFA factor configured'
operationId: oidcAuth
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/OidcLoginRequest'
required: true
responses:
'200':
$ref: '#/components/responses/NewSessionResponse'
'202':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/AcceptedResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- Oidc: []
/v0/org/{org_id}/oidc/email-otp:
post:
tags:
- OAuth2
summary: Initiate login via email token
description: 'Initiate login via email token
This endpoint generates an OIDC token without a signature (of the form `header.payload.`), and sends the signature to the user''s email.
Client applications can reconstruct the token by concatenating the `partial_token` with the signature, producing a valid OIDC token of the form `header.payload.signature`
The token can then be used to authenticate the user.
> [!IMPORTANT]
> For this endpoint to succeed, the org must be configured to:
> 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID
> 2. Have an email sender configured for OTPs'
operationId: emailOtpAuth
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EmailOtpRequest'
required: true
responses:
'200':
$ref: '#/components/responses/EmailOtpResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
/v0/org/{org_id}/oidc/siwe:
post:
tags:
- OAuth2
summary: Initiate login via Sign-in With Ethereum (SIWE).
description: 'Initiate login via Sign-in With Ethereum (SIWE).
This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint)
to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard
OIDC auth route.
> [!IMPORTANT]
> For this endpoint to succeed, the org must be configured to:
> Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID'
operationId: siweInit
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SiweInitRequest'
required: true
responses:
'200':
$ref: '#/components/responses/SiweInitResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
patch:
tags:
- OAuth2
summary: Complete login via Sign-in With Ethereum (SIWE)
description: 'Complete login via Sign-in With Ethereum (SIWE)
If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint
generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route.
> [!IMPORTANT]
> For this endpoint to succeed, the org must be configured to:
> Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID'
operationId: siweComplete
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SiweCompleteRequest'
required: true
responses:
'200':
$ref: '#/components/responses/SiweCompleteResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
/v0/org/{org_id}/oidc/siws:
post:
tags:
- OAuth2
summary: Initiate login via Sign-in With Solana (SIWS).
description: 'Initiate login via Sign-in With Solana (SIWS).
This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint)
to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard
OIDC auth route.
> [!IMPORTANT]
> For this endpoint to succeed, the org must be configured to:
> Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID'
operationId: siwsInit
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SiwsInitRequest'
required: true
responses:
'200':
$ref: '#/components/responses/SiwsInitResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
patch:
tags:
- OAuth2
summary: Complete login via Sign-in With Solana (SIWS)
description: 'Complete login via Sign-in With Solana (SIWS)
If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint
generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route.
> [!IMPORTANT]
> For this endpoint to succeed, the org must be configured to:
> Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID'
operationId: siwsComplete
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SiwsCompleteRequest'
required: true
responses:
'200':
$ref: '#/components/responses/SiwsCompleteResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
/v0/org/{org_id}/oidc/telegram:
post:
tags:
- OAuth2
summary: Allows a user to authenticate with the telegram API using the tgWebAppData value
description: 'Allows a user to authenticate with the telegram API using the tgWebAppData value
The token has the following properties:
- The `sub` field is the telegram user ID
- The `iss` field depends on the chosen environment:
- `https://shim.oauth2.cubist.dev/telegram/production` for the production environment
- `https://shim.oauth2.cubist.dev/telegram/test` for the test environment
- The `aud` field is the provided telegram bot ID
- The `exp` field is derived from the `auth_date` field in the telegram data
Fails if the telegram data is invalid or the signature is invalid'
operationId: telegramAuth
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TelegramAuthRequest'
required: true
responses:
'200':
$ref: '#/components/responses/TelegramAuthResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- {}
components:
schemas:
EpochDateTime:
type: integer
format: int64
description: 'DateTime measured in seconds since unix epoch.
A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]
representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
minimum: 0
MfaRequiredArgs:
type: object
required:
- id
- ids
- org_id
properties:
id:
type: string
description: Always set to first MFA id from `Self::ids`
ids:
type: array
items:
type: string
minLength: 1
description: Non-empty MFA request IDs
org_id:
type: string
description: Organization id
policy_eval_tree:
description: Optional policy evaluation tree (included in signer responses, when requested)
nullable: true
session:
allOf:
- $ref: '#/components/schemas/NewSessionResponse'
nullable: true
B32:
type: string
description: Wrapper around a zeroizing 32-byte fixed-size array
SignInInput:
type: object
description: 'The structured input to a Sign-In With Solana request (`SolanaSignInInput` in the spec).
The relying party fills in `domain`/`address`/`uri`/... and the wallet renders it into the
human-readable message (see [SignInInput::to_message_text]) that it signs.'
required:
- domain
- address
properties:
address:
type: string
description: The base58-encoded Solana (ed25519) public key performing the sign-in.
chainId:
allOf:
- $ref: '#/components/schemas/SolanaNetwork'
nullable: true
domain:
type: string
description: The RFC 3986 authority that is requesting the sign-in.
expirationTime:
type: string
description: The ISO 8601 datetime string after which the signed message is no longer valid.
nullable: true
issuedAt:
type: string
description: The ISO 8601 datetime string of the time the message was issued.
nullable: true
nonce:
type: string
description: A randomized token used to prevent replay attacks; at least 8 alphanumeric characters.
nullable: true
notBefore:
type: string
description: The ISO 8601 datetime string before which the signed message is not yet valid.
nullable: true
requestId:
type: string
description: A system-specific identifier that may be used to uniquely refer to the sign-in request.
nullable: true
resources:
type: array
items:
type: string
description: A list of RFC 3986 URIs the user wishes to have resolved as part of the authentication.
nullable: true
statement:
type: string
description: A human-readable ASCII assertion that the user will sign; must not contain a newline.
nullable: true
uri:
type: string
description: An RFC 3986 URI referring to the resource that is the subject of the sign-in.
nullable: true
version:
type: string
description: The version of the message (currently always `1`).
nullable: true
AcceptedValue:
oneOf:
- type: object
required:
- SignDryRun
properties:
SignDryRun:
$ref: '#/components/schemas/SignDryRunArgs'
- type: object
required:
- BinanceDryRun
properties:
BinanceDryRun:
$ref: '#/components/schemas/BinanceDryRunArgs'
- type: object
required:
- BybitDryRun
properties:
BybitDryRun:
$ref: '#/components/schemas/BybitDryRunArgs'
- type: object
required:
- CoinbaseDryRun
properties:
CoinbaseDryRun:
$ref: '#/components/schemas/CoinbaseDryRunArgs'
- type: object
required:
- MfaRequired
properties:
MfaRequired:
$ref: '#/components/schemas/MfaRequiredArgs'
description: Different responses we return for success status codes.
EmailOtpRequest:
type: object
description: The request users send to initiate email OTP
required:
- email
properties:
email:
type: string
description: The email which will receive the OTP
RatchetConfig:
type: object
properties:
auth_lifetime:
type: integer
format: int64
description: 'The lifetime (in seconds) of auth tokens for this session.
Auth tokens can be refreshed (renewed) using a valid (unexpired)
refresh token, but not beyond the session lifetime.'
default: 300
example: 3600
minimum: 0
grace_lifetime:
type: integer
format: int64
description: 'The amount of time (in seconds) that an auth token for this session remains
valid after it has been refreshed and a new auth token has been issued. This
helps to address concurrency hazards, for example, if one thread makes requests
with auth token while another refreshes it.'
default: 30
example: 30
minimum: 0
refresh_lifetime:
type: integer
format: int64
description: 'The lifetime (in seconds) of refresh tokens for this session.
If this value is shorter than the session lifetime, inactive sessions
will become invalid once the auth and refresh tokens have both expired.'
default: 86400
example: 43200
minimum: 0
session_lifetime:
type: integer
format: int64
description: 'The lifetime (in seconds) of the session.
The session cannot be extended beyond its original lifetime.'
default: 31536000
example: 86400
minimum: 0
NotFoundErrorCode:
type: string
enum:
- UriSegmentMissing
- UriSegmentInvalid
- TotpNotConfigured
- FidoKeyNotFound
- FidoChallengeNotFound
- TotpChallengeNotFound
- UserExportRequestNotFound
- UserExportCiphertextNotFound
- OrgExportCiphertextNotFound
- UploadObjectNotFound
- PolicySecretNotFound
- BucketMetaNotFound
- TimestreamDisabled
- CustomChainNotFound
- InvitationNotFound
- TransactionNotFound
- EmailConfigNotFound
HttpRequestCmp:
oneOf:
- type: string
description: The requests must match exactly. Any given MFA receipt can be used at most once.
enum:
- Eq
- type: object
required:
- EvmTx
properties:
EvmTx:
$ref: '#/components/schemas/EvmTxCmp'
- type: object
required:
- SolanaTx
properties:
SolanaTx:
$ref: '#/components/schemas/SolanaTxCmp'
description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
BadGatewayErrorCode:
type: string
enum:
- Generic
- CustomChainRpcError
- EsploraApiError
- SentryApiError
- CallWebhookError
- OAuthProviderError
- OidcDisoveryFailed
- OidcIssuerJwkEndpointUnavailable
- SmtpServerUnavailable
SolanaTxCmp:
type: object
properties:
ignore_blockhash:
type: boolean
description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
TokenRequest:
type: object
required:
- grant_type
- refresh_token
properties:
grant_type:
$ref: '#/components/schemas/RefreshGrantType'
refresh_token:
type: string
description: The refresh token issued to the client.
InternalErrorCode:
type: string
enum:
- NoMaterialId
- InvalidAuditLogEntry
- UnexpectedCheckerRule
- UnresolvedPolicyReference
- UnexpectedAclAction
- FidoKeyAssociatedWithMultipleUsers
- ClaimsParseError
- InvalidThrottleId
- InvalidEmailAddress
- EmailTemplateRender
- OidcIdentityHeaderMissing
- OidcIdentityParseError
- SystemTimeError
- PasswordHashParseError
- SendMailError
- ReqwestError
- EmailConstructionError
- TsWriteError
- TsQueryError
- DbQueryError
- DbGetError
- DbDeleteError
- DbPutError
- DbUpdateError
- SerdeError
- TestAndSetError
- DbGetItemsError
- DbWriteError
- CubistSignerError
- CwListMetricsError
- CwPutMetricDataError
- GetAwsSecretError
- SecretNotFound
- KmsGenerateRandomError
- MalformedTotpBytes
- KmsGenerateRandomNoResponseError
- CreateKeyError
- ParseDerivationPathError
- SplitSignerError
- CreateImportKeyError
- CreateEotsNoncesError
- EotsSignError
- BabylonCovSignError
- CognitoDeleteUserError
- CognitoListUsersError
- CognitoGetUserError
- MissingUserEmail
- CognitoResendUserInvitation
- CognitoSetUserPasswordError
- GenericInternalError
- AssumeRoleWithoutEvidence
- OidcAuthWithoutOrg
- MissingKeyMetadata
- KmsEnableKeyError
- KmsDisableKeyError
- LambdaInvokeError
- LambdaNoResponseError
- LambdaFailure
- LambdaUnparsableResponse
- SerializeEncryptedExportKeyError
- DeserializeEncryptedExportKeyError
- ReEncryptUserExport
- S3UploadError
- S3DownloadError
- S3CopyError
- S3ListObjectsError
- S3DeleteObjectsError
- S3BuildError
- S3PresignedUrlError
- ManagedStateMissing
- InternalHeaderMissing
- InvalidInternalHeaderValue
- RequestLocalStateAlreadySet
- OidcOrgMismatch
- OidcIssuerInvalidJwk
- InvalidPkForMaterialId
- SegwitTweakFailed
- UncheckedOrg
- SessionOrgIdMissing
- AvaSignCredsMissing
- AvaSignSignatureMissing
- ExpectedRoleSession
- InvalidThirdPartyIdentity
- CognitoGetUser
- SnsSubscribeError
- SnsUnsubscribeError
- SnsGetSubscriptionAttributesError
- SnsSubscriptionAttributesMissing
- SnsSetSubscriptionAttributesError
- SnsPublishBatchError
- InconsistentMultiValueTestAndSet
- MaterialIdError
- InvalidBtcAddress
- HistoricalTxBodyMissing
- InvalidOperation
- ParentOrgNotFound
- OrgParentLoop
- ResolvedParentOrgWithNoScopeCeiling
- InvalidUploadObjectId
- PolicyEngineNotFound
- PolicyEngineError
- PolicySecretsEncryptionError
- CreatePolicyImportKeyError
- InvalidAlias
- EmptyUpdateModifiedObject
- EmptyUpdateModifiedActions
- DbContactAddressesInvalid
- InvalidEvmSigedRlp
- InvalidErc20Data
- InvalidRpcUrl
SignerErrorCode:
oneOf:
- $ref: '#/components/schemas/SignerErrorOwnCodes'
- $ref: '#/components/schemas/AcceptedValueCode'
- $ref: '#/components/schemas/BadRequestErrorCode'
- $ref: '#/components/schemas/BadGatewayErrorCode'
- $ref: '#/components/schemas/NotFoundErrorCode'
- $ref: '#/components/schemas/ForbiddenErrorCode'
- $ref: '#/components/schemas/UnauthorizedErrorCode'
- $ref: '#/components/schemas/PreconditionErrorCode'
- $ref: '#/components/schemas/TimeoutErrorCode'
- $ref: '#/components/schemas/ConflictErrorCode'
- $ref: '#/components/schemas/InternalErrorCode'
EvmTxCmp:
type: object
properties:
grace:
type: integer
format: int64
description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.
In this case, however, because EVM transactions already have a replay prevention mechanism
(namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to
indicate how long an MFA receipt should remain valid after its first use.
Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request
enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to
ensure that any subsequent requests that claim the same receipt must sign for the same
nonce as the request we signed originally with that receipt.
Also note that the grace period cannot extend the lifetime of an MFA request beyond its
original expiration date.
The grace period must not be greater than 30 days.'
nullable: true
minimum: 0
ignore_gas:
type: boolean
description: Whether the 'gas' property of the EVM transaction is allowed to be different.
ignore_nonce:
type: boolean
description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
EvmTxDepositErrorCode:
type: string
enum:
- EvmTxDepositReceiverMismatch
- EvmTxDepositEmptyData
- EvmTxDepositEmptyChainId
- EvmTxDepositEmptyReceiver
- EvmTxDepositUnexpectedValue
- EvmTxDepositUnexpectedDataLength
- EvmTxDepositNoAbi
- EvmTxDepositNoDepositFunction
- EvmTxDepositUnexpectedFunctionName
- EvmTxDepositUnexpectedValidatorKey
- EvmTxDepositInvalidValidatorKey
- EvmTxDepositMissingDepositArg
- EvmTxDepositWrongDepositArgType
- EvmTxDepositValidatorKeyNotInRole
- EvmTxDepositUnexpectedWithdrawalCredentials
- EvmTxDepositUnresolvedRole
- EvmTxDepositInvalidDepositEncoding
ErrorResponse:
type: object
description: The structure of ErrorResponse must match the response template that AWS uses
required:
- message
- error_code
properties:
accepted:
allOf:
- $ref: '#/components/schemas/AcceptedValue'
nullable: true
error_code:
$ref: '#/components/schemas/SignerErrorCode'
message:
type: string
description: Error message
policy_eval_tree:
description: Optional policy evaluation tree (included in signer responses, when requested)
nullable: true
request_id:
type: string
description: Optional request identifier
PreconditionErrorOwnCodes:
type: string
enum:
- FailOnMfaRequired
- KeyRegionLocked
- KeyRegionChangedRecently
- MfaRegionLocked
- Eth2ProposerSlotTooLow
- Eth2AttestationSourceEpochTooLow
- Eth2AttestationTargetEpochTooLow
- Eth2ConcurrentBlockSigning
- Eth2ConcurrentAttestationSigning
- Eth2MultiDepositToNonGeneratedKey
- Eth2MultiDepositUnknownInitialDeposit
- Eth2MultiDepositWithdrawalAddressMismatch
- ConcurrentSigningWhenTimeLimitPolicyIsDefined
- BabylonEotsConcurrentSigning
- TendermintStateError
- TendermintConcurrentSigning
- MfaApprovalsNotYetValid
SiweCompleteRequest:
type: object
description: Answer to a Sign-in with Ethereum challenge.
required:
- challenge_id
- signature
properties:
challenge_id:
$ref: '#/components/schemas/Id'
signature:
type: string
description: The hex-encoded EIP-191 signature of the message returned by the corresponding POST ('init') endpoint
ClientSessionInfo:
type: object
description: 'Session information sent to the client.
This struct works in tandem with its server-side counterpart [`SessionData`].'
required:
- session_id
- auth_token
- refresh_token
- epoch
- epoch_token
- auth_token_exp
- refresh_token_exp
properties:
auth_token:
type: string
description: Token to use for authorization.
auth_token_exp:
$ref: '#/components/schemas/EpochDateTime'
epoch:
type: integer
format: int32
description: Epoch at which the token was last refreshed
minimum: 0
epoch_token:
$ref: '#/components/schemas/B32'
refresh_token:
type: string
description: Token to use for refreshing the `(auth, refresh)` token pair
refresh_token_exp:
$ref: '#/components/schemas/EpochDateTime'
session_id:
type: string
description: Session ID
PolicyErrorOwnCodes:
type: string
enum:
- Inapplicable
- SuiTxReceiversDisallowedTransactionKind
- SuiTxReceiversDisallowedTransferAddress
- SuiTxReceiversDisallowedCommand
- BtcTxDisallowedOutputs
- BtcSignatureExceededValue
- BtcValueOverflow
- BtcSighashTypeDisallowed
- Eip7702AddressMismatch
- EvmTxReceiverMismatch
- EvmTxChainIdMismatch
- EvmTxSenderMismatch
- EvmTxExceededValue
- EvmTxExceededGasCost
- EvmTxGasCostUndefined
- EvmDataDisallowed
- Erc20DataInvalid
- EvmContractAddressUndefined
- EvmContractChainIdUndefined
- EvmDataNotDefined
- EvmDataInvalid
- EvmContractNotInAllowlist
- Erc20ExceededTransferLimit
- Erc20ReceiverMismatch
- Erc20ExceededApproveLimit
- Erc20SpenderMismatch
- EvmFunctionNotInAllowlist
- EvmFunctionCallInvalid
- EvmFunctionCallDisallowedArg
- PolicyDisjunctionError
- PolicyNegationError
- Eth2ExceededMaxUnstake
- Eth2ConcurrentUnstaking
- NotInIpv4Allowlist
- NotInOriginAllowlist
- NotInOperationAllowlist
- InvalidSourceIp
- RawSigningNotAllowed
- DiffieHellmanExchangeNotAllowed
- Eip712SigningNotAllowed
- OidcSourceNotAllowed
- NoOidcAuthSourcesDefined
- AddKeyToRoleDisallowed
- KeysAlreadyInRole
- KeyInMultipleRoles
- KeyAccessError
- RequireRoleSessionKeyAccessError
- BtcMessageSigningNotAllowed
- Eip191SigningNotAllowed
- Eip7702SigningNotAllowed
- TaprootSigningDisallowed
- SegwitSigningDisallowed
- PsbtSigningDisallowed
- BabylonStakingDisallowed
- TimeLocked
- CelPolicyDenied
- BabylonStakingNetwork
- BabylonStakingParamsVersion
- BabylonStakingExplicitParams
- BabylonStakingStakerPk
- BabylonStakingFinalityProviderPk
- BabylonStakingLockTime
- BabylonStakingValue
- BabylonStakingChangeAddress
- BabylonStakingFee
- BabylonStakingWithdrawalAddress
- BabylonStakingBbnAddress
- SolanaInstructionCountLow
- SolanaInstructionCountHigh
- SolanaNotInInstructionAllowlist
- SolanaInstructionMismatch
- WasmPoliciesDisabled
- WasmPolicyDenied
- WasmPolicyFailed
- WebhookPoliciesDisabled
- DeniedByWebhook
- ExplicitlyDenied
ExplicitScope:
type: string
title: ExplicitScope
description: Explicitly named scopes for accessing CubeSigner APIs
enum:
- sign:*
- sign:ava
- sign:binance:*
- sign:binance:subToMaster
- sign:binance:subToSub
- sign:binance:universalTransfer
- sign:binance:subAccountAssets
- sign:binance:accountInfo
- sign:binance:subAccountTra
# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-oauth2-api-openapi.yml