Cubist Orgs API

openapi: 3.2.0
info:
  title: CubeSigner Account Orgs API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Orgs
paths:
  /v0/email/orgs:
    get:
      tags:
      - Orgs
      summary: List accessible organizations.
      description: 'List accessible organizations.


        Unauthenticated endpoint for retrieving all organizations accessible to a user.

        This information is emailed to the provided email address.

        '
      operationId: email_my_orgs
      parameters:
      - name: email
        in: query
        description: The email of the user
        required: true
        schema:
          type: string
        style: form
        example: alice@example.com
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
  /v0/org/{org_id}:
    get:
      tags:
      - Orgs
      summary: Get Org
      description: 'Get Org


        Retrieves information about an organization.'
      operationId: getOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/OrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:get
    patch:
      tags:
      - Orgs
      summary: Update Org
      description: 'Update Org


        Update organization attributes (enabled flag, name, and policies).'
      operationId: updateOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrgRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/UpdateOrgResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:update:*
  /v0/org/{org_id}/info:
    get:
      tags:
      - Orgs
      summary: Public Org Info
      description: 'Public Org Info


        Unauthenticated endpoint that returns publicly-available information about an organization.

        '
      operationId: public_org_info
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/PublicOrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
  /v0/org/{org_id}/orgs:
    post:
      tags:
      - Orgs
      summary: Create Org
      description: 'Create Org


        Creates a new organization. The new org is a child of the

        current org and inherits its key-export policy. The new org

        is created with one owner, the caller of this API.'
      operationId: createOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrgRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/OrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:create
components:
  schemas:
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    CreateOrgRequest:
      type: object
      required:
      - name
      properties:
        metrics_enabled:
          type: boolean
          description: Whether to enable metrics for the new organization
        name:
          type: string
          description: The human readable name of the new organization
          example: My Cool Org
    OperationKind:
      type: string
      description: All different kinds of sensitive operations
      enum:
      - AvaSign
      - AvaChainTxSign
      - BabylonCovSign
      - BabylonRegistration
      - BabylonStaking
      - BinanceSubToMaster
      - BinanceSubToSub
      - BinanceUniversalTransfer
      - BinanceSubAccountAssets
      - BinanceAccountInfo
      - BinanceSubAccountTransferHistory
      - BinanceUniversalTransferHistory
      - BinanceWithdraw
      - BinanceWithdrawHistory
      - BinanceDeposit
      - BinanceDepositHistory
      - BinanceListSubAccounts
      - BinanceCoinInfo
      - BlobSign
      - BtcMessageSign
      - BtcSign
      - BybitQueryUser
      - BybitQuerySubMembers
      - BybitQueryCoinsBalance
      - BybitQueryDepositAddress
      - BybitUniversalTransfer
      - BybitWithdraw
      - BybitWithdrawals
      - CoinbaseListAccounts
      - CoinbaseListPortfolios
      - CoinbaseMoveFunds
      - DiffieHellman
      - PsbtSign
      - TaprootSign
      - Eip191Sign
      - Eip712Sign
      - Eip7702Sign
      - EotsNonces
      - EotsSign
      - Eth1Sign
      - Eth2Sign
      - Eth2Stake
      - Eth2Unstake
      - SolanaSign
      - SuiSign
      - TendermintSign
      - RoleUpdate
    IdpConfig:
      type: object
      description: IDP configuration
      properties:
        throttle:
          allOf:
          - $ref: '#/components/schemas/ThrottleConfig'
        users:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/MemberRole'
          description: Enable for certain user roles
          uniqueItems: true
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        request_id:
          type: string
          description: Optional request identifier
    HttpRequest:
      type: object
      description: 'Information about the request.


        Captures all the relevant info (including the request body) about requests that require MFA.

        We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)

        it is exactly the same as it originally was.'
      required:
      - method
      - path
      properties:
        body:
          type:
          - object
          - 'null'
          description: HTTP request body
        method:
          type: string
          description: HTTP method of the request
        path:
          type: string
          description: HTTP path of the request, excluding the host
    ThrottleConfig:
      type: object
      description: Configuration object for a throttle which limits the number of entities within a given time window
      required:
      - threshold
      - window
      properties:
        threshold:
          type: integer
          format: int32
          description: The number of entities allowed within the window
          minimum: 0
        window:
          $ref: '#/components/schemas/Seconds'
    HistoricalTxConfiguration:
      type: object
      description: Configuration governing whether and how to save historical transactions.
      properties:
        lifetime:
          allOf:
          - $ref: '#/components/schemas/Seconds'
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    UpdateOrgRequest:
      type: object
      properties:
        alien_login_requirement:
          allOf:
          - $ref: '#/components/schemas/SecondFactorRequirement'
        allowed_mfa_types:
          type:
          - object
          - 'null'
          description: 'MFA types that are allowed to be used for implicitly security-sensitive

            operations (like logging in, adding an MFA factor, exporting keys, etc.).'
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/MfaType'
            uniqueItems: true
          example:
            Default:
            - Fido
            - Totp
            - EmailOtp
            KeyExport:
            - Fido
        custom_chains:
          allOf:
          - $ref: '#/components/schemas/CustomChainsData'
        default_invite_kind:
          allOf:
          - $ref: '#/components/schemas/InviteKind'
        edit_policy:
          allOf:
          - $ref: '#/components/schemas/EditPolicy'
        email_preferences:
          allOf:
          - $ref: '#/components/schemas/EmailPreferences'
        enabled:
          type:
          - boolean
          - 'null'
          description: If set, update this org's `enabled` field to this value.
        ext_props:
          allOf:
          - allOf:
            - type: object
              description: Extended org properties, which are rarely used and thus not stored within the [Org] record.
              properties:
                alien_key_count_threshold:
                  type:
                  - integer
                  - 'null'
                  format: int32
                  description: 'Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users.


                    This setting is checked only when an alien user requests to create or import a new key.

                    In other words, org admins can still assign unlimited number of keys to their alien users.'
                  minimum: 0
                aliens_can_update_key_policy:
                  type:
                  - boolean
                  - 'null'
                  description: 'Whether alien users are allowed to update their own key policies.

                    Defaults to ''false''.'
            - type: object
              properties:
                version:
                  type:
                  - integer
                  - 'null'
                  format: int64
                  description: If set, updating will succeed if the current version matches this value
                  minimum: 0
            description: Request to update org's extended properties
        historical_data_configuration:
          allOf:
          - $ref: '#/components/schemas/HistoricalDataConfiguration'
        idp_configuration:
          allOf:
          - $ref: '#/components/schemas/IdpConfig'
        key_export_requirement:
          allOf:
          - $ref: '#/components/schemas/SecondFactorRequirement'
        member_login_requirement:
          allOf:
          - $ref: '#/components/schemas/SecondFactorRequirement'
        notification_endpoints:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/NotificationEndpointConfiguration'
          description: 'If set, update this org''s notification endpoints. Notification endpoints are expected to be

            HTTPS URLs, which accept POST requests. The body of the requests sent to these endpoints are

            are formatted in JSON and have the following format:


            ```json

            {

            "org": "...",

            "utc_timestamp": "...",

            "org_event": "...",

            ...

            }

            ```


            `org` is the org id, `utc_timestamp` is the UTC timestamp of the event in milliseconds, and

            `org_event` is a string identifying the type of event that has occurred. The rest of the

            fields provide additional information related to the type of the event.


            Endpoints can optionally include filters to customize the org events that they are notified

            about. Currently, the only supported filter type is `OneOf`, which expects a list of org

            event types to send to the endpoint. If no filter is configured, the system sends all org

            events to the endpoint.'
          example:
          - 'url:': https://example.com/endpoint1
          - filter:
              OneOf:
              - Eth2ConcurrentAttestationSigning
              - Eth2ConcurrentBlockSigning
            'url:': https://example.com/endpoint2
        passkey_configuration:
          allOf:
          - $ref: '#/components/schemas/PasskeyConfig'
        policy:
          type:
          - array
          - 'null'
          items:
            type: object
          description: If set, update this org's policies (old policies will be overwritten!).
          example:
          - MaxDailyUnstake: 5
          - OriginAllowlist:
            - https://example.com
          - SourceIpAllowlist:
            - 10.1.2.3/8
            - 169.254.17.1/16
        policy_engine_configuration:
          allOf:
          - $ref: '#/components/schemas/UpdateOrgPolicyEngineConfigs'
        require_scope_ceiling:
          type:
          - boolean
          - 'null'
          description: 'If set, all user logins will require the claim `cubesigner_scope_ceiling` to be present in

            the user''s token. This claim is an array of scopes (e.g. `[ "manage:keys:list", "sign:evm:tx" ]`),

            which define a maximum set of scopes the user may request. If the user''s token does not contain

            this claim, the login will be rejected.


            Owners of the org are exempt from this requirement.'
        sign_policy:
          type:
          - array
          - 'null'
          items: {}
          description: 'If set, update this org''s sign rule (old sign rules will be overwritten!).

            Only "deny"-style rules may be set.'
          example:
          - TxReceiver:
            - '0x0000000000000000000000000000000000000000'
        totp_failure_limit:
          type:
          - integer
          - 'null'
          format: int32
          description: 'If set, update this org''s TOTP failure limit. After this many failures,

            the user is rate limited until the next 30-second TOTP window.'
          maximum: 5
          minimum: 1
        user_export_delay:
          type:
          - integer
          - 'null'
          format: int64
          description: 'If set, update this org''s user-export delay, i.e., the amount of time

            (in seconds) between a user''s initiating an export and the time when

            export is allowed. For security, this delay cannot be set to less than

            172800, i.e., 2 days.'
          minimum: 0
        user_export_disabled:
          type:
          - boolean
          - 'null'
          description: If set, turn this org's user export off (by passing `true`) or on (by passing `false`).
        user_export_window:
          type:
          - integer
          - 'null'
          format: int64
          description: 'If set, update this org''s user-export window, i.e., the amount of time

            (in seconds) that export is allowed after the user-export delay. After

            this amount of time, the export is canceled and must be re-initiated.

            For security, this window cannot be set to greater than 259200, i.e.,

            3 days.'
          minimum: 0
    Receipt:
      type: object
      description: Receipt that an MFA request was approved.
      required:
      - confirmation
      - final_approver
      - timestamp
      properties:
        confirmation:
          type: string
          description: Confirmation code the user needs to present when resuming the original request.
          example: ba1d75dd-d999-4c1b-944d-25c25440c8af
        final_approver:
          type: string
          description: The ID of the logged-in user whose action created this approval.
        timestamp:
          $ref: '#/components/schemas/EpochDateTime'
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
    CustomChainsData:
      type: object
      description: Information about an org's custom chains.
      required:
      - evm
      properties:
        evm:
          type: array
          items:
            $ref: '#/components/schemas/EvmCustomChain'
          description: Custom EVM chains.
          uniqueItems: true
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
    UpdateOrgPolicyEngineConfigs:
      type: object
      description: Policy Engine configurations.
      required:
      - allowed_http_authorities
      properties:
        allowed_http_authorities:
          type: array
          items:
            type: string
          description: Allowed domains for HTTP requests
          example:
          - cubist.dev:443
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    OrgAlertsPrefs:
      type: object
      properties:
        alert_recipients:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/Id'
          description: Recipient users for org-level alerts
        subscribed_alerts:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/AlertKind'
          description: Org-level alerts to send emails for
    OrgEventDiscriminants:
      type: string
      description: Auto-generated discriminant enum variants
      enum:
      - Billing
      - Response
      - OidcAuth
      - Signed
      - BabylonEotsConcurrentSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2ConcurrentBlockSigning
      - Eth2InvalidBlockProposerSlotTooLow
      - Eth2InvalidAttestationSourceEpochTooLow
      - Eth2InvalidAttestationTargetEpochTooLow
      - Eth2Unstake
      - Eth2ExceededMaxUnstake
      - KeyCreated
      - MfaApproved
      - MfaRejected
      - PolicyChanged
      - TendermintConcurrentSigning
      - InvitationCreated
      - InvitationCanceled
      - UserExportInit
      - UserExportComplete
      - WasmPolicyExecuted
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    NotificationEndpoint:
      allOf:
      - $ref: '#/components/schemas/NotificationEndpointSubscription'
      - type: object
        required:
        - status
        properties:
          status:
            $ref: '#/components/schemas/SubscriptionStatus'
      description: The configuration and status of a notification endpoint
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    Approv

# --- truncated at 32 KB (86 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-orgs-api-openapi.yml