Cubist Orgs API

openapi: 3.0.3
info:
  title: CubeSigner Account Orgs API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Orgs
paths:
  /v0/email/orgs:
    get:
      tags:
      - Orgs
      summary: List accessible organizations.
      description: 'List accessible organizations.


        Unauthenticated endpoint for retrieving all organizations accessible to a user.

        This information is emailed to the provided email address.

        '
      operationId: email_my_orgs
      parameters:
      - name: email
        in: query
        description: The email of the user
        required: true
        schema:
          type: string
        style: form
        example: alice@example.com
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
  /v0/org/{org_id}:
    get:
      tags:
      - Orgs
      summary: Get Org
      description: 'Get Org


        Retrieves information about an organization.'
      operationId: getOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/OrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:get
    patch:
      tags:
      - Orgs
      summary: Update Org
      description: 'Update Org


        Update organization attributes (enabled flag, name, and policies).'
      operationId: updateOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrgRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/UpdateOrgResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:update:*
  /v0/org/{org_id}/info:
    get:
      tags:
      - Orgs
      summary: Public Org Info
      description: 'Public Org Info


        Unauthenticated endpoint that returns publicly-available information about an organization.

        '
      operationId: public_org_info
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/PublicOrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - {}
  /v0/org/{org_id}/orgs:
    post:
      tags:
      - Orgs
      summary: Create Org
      description: 'Create Org


        Creates a new organization. The new org is a child of the

        current org and inherits its key-export policy. The new org

        is created with one owner, the caller of this API.'
      operationId: createOrg
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrgRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/OrgInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:org:create
components:
  schemas:
    NotificationEndpointConfiguration:
      type: object
      description: The configuration for an org event endpoint
      required:
      - url
      properties:
        filter:
          $ref: '#/components/schemas/OrgEventFilter'
        url:
          type: string
          description: URL of the endpoint
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    EvmCustomChain:
      type: object
      description: A custom EVM chain.
      required:
      - chain_id
      - rpc_url
      - name
      - native_currency
      properties:
        chain_id:
          type: string
          description: The chain id. Enforced to be unique among all custom EVM chains in the organization. It must be a hex string (starting with "0x") with even length.
          example: '0x01'
        name:
          type: string
          description: The name of the chain.
          example: Ethereum Mainnet
        native_currency:
          $ref: '#/components/schemas/EvmCurrencyInfo'
        rpc_url:
          type: string
          description: The URL of the RPC provider for this chain.
          example: https://ethereum-rpc.publicnode.com
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    OrgEventDiscriminants:
      type: string
      description: Auto-generated discriminant enum variants
      enum:
      - Billing
      - Response
      - OidcAuth
      - Signed
      - BabylonEotsConcurrentSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2ConcurrentBlockSigning
      - Eth2InvalidBlockProposerSlotTooLow
      - Eth2InvalidAttestationSourceEpochTooLow
      - Eth2InvalidAttestationTargetEpochTooLow
      - Eth2Unstake
      - Eth2ExceededMaxUnstake
      - KeyCreated
      - MfaApproved
      - MfaRejected
      - PolicyChanged
      - TendermintConcurrentSigning
      - InvitationCreated
      - InvitationCanceled
      - UserExportInit
      - UserExportComplete
      - WasmPolicyExecuted
    EditPolicy:
      type: object
      description: 'A policy which governs when and who is allowed to update the entity this policy is

        attached to (e.g., a role or a key).


        When attached to a role, by default, this policy applies to role deletion and all

        role updates (including adding/removing keys and users); in terms of scopes,

        it applies to `manage:role:update:*` and `manage:role:delete`.


        When attached to a key, by default, this policy applies to key deletion, all

        key updates, and adding/removing that key to/from a role; in terms of scopes,

        it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`.


        This default can be changed by setting the `applies_to_scopes` property.'
      properties:
        applies_to_scopes:
          $ref: '#/components/schemas/ScopeSet'
        mfa:
          allOf:
          - $ref: '#/components/schemas/MfaPolicy'
          nullable: true
        time_lock_until:
          allOf:
          - $ref: '#/components/schemas/EpochDateTime'
          nullable: true
    ClientSessionInfo:
      type: object
      description: 'Session information sent to the client.

        This struct works in tandem with its server-side counterpart [`SessionData`].'
      required:
      - session_id
      - auth_token
      - refresh_token
      - epoch
      - epoch_token
      - auth_token_exp
      - refresh_token_exp
      properties:
        auth_token:
          type: string
          description: Token to use for authorization.
        auth_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        epoch:
          type: integer
          format: int32
          description: Epoch at which the token was last refreshed
          minimum: 0
        epoch_token:
          $ref: '#/components/schemas/B32'
        refresh_token:
          type: string
          description: Token to use for refreshing the `(auth, refresh)` token pair
        refresh_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        session_id:
          type: string
          description: Session ID
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    OrgEventFilter:
      oneOf:
      - type: string
        description: Do not filter any org events
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/OrgEventDiscriminants'
            description: Accepts all org events other than the ones listed
      - type: object
        required:
        - OneOf
        properties:
          OneOf:
            type: array
            items:
              $ref: '#/components/schemas/OrgEventDiscriminants'
            description: Only accepts org events that are one of the listed events
      description: Filter for org events
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    MfaPolicy:
      type: object
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. If empty at creation time, default to the current user.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        count:
          type: integer
          format: int32
          description: How many users to require to approve (defaults to 1).
          minimum: 0
        lifetime:
          $ref: '#/components/schemas/Seconds'
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user (defaults to 1).
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
        restricted_operations:
          type: array
          items:
            $ref: '#/components/schemas/OperationKind'
          description: 'CubeSigner operations to which this policy should apply.

            When omitted, applies to all operations.'
          nullable: true
        time_delay:
          $ref: '#/components/schemas/Seconds'
      example:
        allowed_approvers:
        - User#fabc3f88-04e0-471b-9657-0ae12a3cd73e
        - User#d796c369-9974-473b-ab9e-e4a2418d2d07
        count: 2
        lifetime: 900
    AlertKind:
      type: string
      enum:
      - PolicyChanges
      - Eth2ConcurrentBlockSigning
      - BabylonEotsConcurrentSigning
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    NotificationEndpoint:
      allOf:
      - $ref: '#/components/schemas/NotificationEndpointSubscription'
      - type: object
        required:
        - status
        properties:
          status:
            $ref: '#/components/schemas/SubscriptionStatus'
      description: The configuration and status of a notification endpoint
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    EvmTxDepositErrorCode:
      type: string
      enum:
      - EvmTxDepositReceiverMismatch
      - EvmTxDepositEmptyData
      - EvmTxDepositEmptyChainId
      - EvmTxDepositEmptyReceiver
      - EvmTxDepositUnexpectedValue
      - EvmTxDepositUnexpectedDataLength
      - EvmTxDepositNoAbi
      - EvmTxDepositNoDepositFunction
      - EvmTxDepositUnexpectedFunctionName
      - EvmTxDepositUnexpectedValidatorKey
      - EvmTxDepositInvalidValidatorKey
      - EvmTxDepositMissingDepositArg
      - EvmTxDepositWrongDepositArgType
      - EvmTxDepositValidatorKeyNotInRole
      - EvmTxDepositUnexpectedWithdrawalCredentials
      - EvmTxDepositUnresolvedRole
      - EvmTxDepositInvalidDepositEncoding
    PasskeyConfig:
      type: object
      description: Org-level passkey configuration
      properties:
        users:
          type: array
          items:
            $ref: '#/components/schemas/MemberRole'
          description: Enable passkey login for certain user roles (disabled for everyone by default)
          uniqueItems: true
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
          nullable: true
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        request_id:
          type: string
          description: Optional request identifier
    MfaRequirements:
      type: object
      description: Org-wide MFA requirements.
      properties:
        alien_login_requirement:
          $ref: '#/components/schemas/SecondFactorRequirement'
        allowed_mfa_types:
          $ref: '#/components/schemas/AllowedMfaMap'
        key_export_requirement:
          $ref: '#/components/schemas/SecondFactorRequirement'
        member_login_requirement:
          $ref: '#/components/schemas/SecondFactorRequirement'
    ThrottleConfig:
      type: object
      description: Configuration object for a throttle which limits the number of entities within a given time window
      required:
      - threshold
      - window
      properties:
        threshold:
          type: integer
          format: int32
          description: The number of entities allowed within the window
          minimum: 0
        window:
          $ref: '#/components/schemas/Seconds'
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    NotificationEndpointSubscription:
      type: object
      description: A notification endpoint subscription
      required:
      - arn
      - config
      properties:
        arn:
          type: string
          description: The ARN of the subscription
        config:
          $ref: '#/components/schemas/NotificationEndpointConfiguration'
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
          nullable: true
    CustomChainsData:
      type: object
      description: Information about an org's custom chains.
      required:
      - evm
      properties:
        evm:
          type: array
          items:
            $ref: '#/components/schemas/EvmCustomChain'
          description: Custom EVM chains.
          uniqueItems: true
    Seconds:
      type: integer
      format: int64
      description: 'Duration measured in seconds

        A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.'
      minimum: 0
    OrgAlertsPrefs:
      type: object
      properties:
        alert_recipients:
          type: array
          items:
            $ref: '#/components/schemas/Id'
          description: Recipient users for org-level alerts
          nullable: true
        subscribed_alerts:
          type: array
          items:
            $ref: '#/components/schemas/AlertKind'
          description: Org-level alerts to send emails for
          nullable: true
    SecondFactorRequirement:
      type: string
      description: 'Represents the number of MFA approvals required for a given operation

        (e.g. login). Can be used to produce a concrete policy for a given user'
      enum:
      - none
      - if_registered
      - required
    AcceptedResponse:
      allOf:
      - $ref: '#/components/schemas/ErrorResponse'
      - type: object
    UpdateOrgPolicyEngineConfigs:
      type: object
      description: Policy Engine configurations.
      required:
      - allowed_http_authorities
      properties:
        allowed_http_authorities:
          type: array
          items:
            type: string
          description: Allowed domains for HTTP requests
          example:
          - cubist.dev:443
    MemberRole:
      type: string
      description: Describes whether a user in an org is an Owner or just a regular member
      enum:
      - Alien
      - Member
      - Owner
    EvmTxCmp:
      type: object
      properties:
        grace:
          type: integer
          format: int64
          description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.


            In this case, however, because EVM transactions already have a replay prevention mechanism

            (namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to

            indicate how long an MFA receipt should remain valid after its first use.


            Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request

            enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to

            ensure that any subsequent requests that claim the same receipt must sign for the same

            nonce as the request we signed originally with that receipt.


            Also note that the grace period cannot extend the lifetime of an MFA request beyond its

            original expiration date.


            The grace period must not be greater than 30 days.'
          nullable: true
          minimum: 0
        ignore_gas:
          type: boolean
          description: Whether the 'gas' property of the EVM transaction is allowed to be different.
        ignore_nonce:
          type: boolean
          description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
    IdpConfig:
      type: object
      description: IDP configuration
      properties:
        throttle:
          allOf:
          - $ref: '#/components/schemas/ThrottleConfig'
          nullable: true
        users:
          type: array
          items:
            $ref: '#/components/schemas/MemberRole'
          description: Enable for certain user roles
          uniqueItems: true
          nullable: true
    ExplicitScope:
      type: string
      title: ExplicitScope
      description: Explicitly named scopes for accessing CubeSigner APIs
      enum:
      - sign:*
      - sign:ava
      - sign:binance:*
      - sign:binance:subToMaster
      - sign:binance:subToSub
      - sign:binance:universalTransfer
      - sign:binance:subAccountAssets
      - sign:binance:accountInfo
      - sign:binance:subAccountTransferHistory
      - sign:binance:universalTransferHistory
      - sign:binance:withdraw
      - sign:binance:withdrawHistory
      - sign:binance:deposit
      - sign:binance:depositHistory
      - sign:binance:listSubAccounts
      - sign:binance:coinInfo
      - sign:bybit:*
      - sign:bybit:queryUser
      - sign:bybit:querySubMembers
      - sign:bybit:queryCoinsBalance
      - sign:bybit:queryDepositAddress
      - sign:bybit:universalTransfer
      - sign:bybit:withdraw
      - sign:bybit:withdrawals
      - sign:coinbase:*
      - sign:coinbase:accounts:list
      - sign:coinbase:portfolios:list
      - sign:coinbase:funds:move
      - sign:blob
      - sign:diffieHellman
      - sign:btc:*
      - sign:btc:segwit
      - sign:btc:taproot
      - sign:btc:psbt:*
      - sign:btc:psbt:doge
      - sign:btc:psbt:legacy
      - sign:btc:psbt:segwit
      - sign:btc:psbt:taproot
      - sign:btc:psbt:ltcSegwit
      - sign:btc:message:*
      - sign:btc:message:segwit
      - sign:btc:message:legacy
      - sign:babylon:*
      - sign:babylon:eots:*
      - sign:babylon:eots:nonces
      - sign:babylon:eots:sign
      - sign:babylon:staking:*
      - sign:babylon:staking:deposit
      - sign:babylon:staking:unbond
      - sign:babylon:staking:withdraw
      - sign:babylon:staking:slash
      - sign:babylon:registration
      - sign:babylon:covenant
      - sign:evm:*
      - sign:evm:tx
      - sign:evm:eip191
      - sign:evm:eip712
      - sign:evm:eip7702
      - sign:eth2:*
      - sign:eth2:validate
      - sign:eth2:stake
      - sign:eth2:unstake
      - sign:solana
      - sign:sui
      - sign:tendermint
      - sign:mmi
      - manage:*
      - manage:readonly
      - manage:email:*
      - manage:email:get
      - manage:email:update
      - manage:email:delete
      - manage:mfa:*
      - manage:mfa:readonly
      - manage:mfa:list
      - manage:mfa:vote:*
      - manage:mfa:vote:cs
      - manage:mfa:vote:email
      - manage:mfa:vote:fido
      - manage:mfa:vote:totp
      - manage:mfa:register:*
      - manage:mfa:register:fido
      - manage:mfa:register:totp
      - manage:mfa:register:email
      - manage:mfa:unregister:*
      - manage:mfa:unregister:fido
      - manage:mfa:unregister:totp
      - manage:mfa:verify:*
      - manage:mfa:verify:totp
      - manage:key:*
      - manage:key:readonly
      - manage:key:get
      - manage:key:attest
      - manage:key:listRoles
      - manage:key:list
      - manage:key:history:tx:list
      - manage:key:create
      - manage:key:import
      - manage:key:update:*
      - manage:key:update:owner
      - manage:key:update:policy
      - manage:key:update:enabled
      - manage:key:update:region
      - manage:key:update:metadata
      - manage:key:update:properties
      - manage:key:update:editPolicy
      - manage:key:delete
      - manage:policy:*
      - manage:policy:reado

# --- truncated at 32 KB (87 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-orgs-api-openapi.yml