Cubist Policies API

openapi: 3.2.0
info:
  title: CubeSigner Account Policies API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Policies
paths:
  /v0/org/{org_id}/policies:
    get:
      tags:
      - Policies
      summary: List Policies
      description: 'List Policies


        Returns the list of all policies in the Org.'
      operationId: listPolicies
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type:
          - string
          - 'null'
        style: form
      - name: policy_type
        in: query
        description: The optional type of policies to return
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/PolicyType'
        style: form
        example: Key
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListPoliciesResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:list
    post:
      tags:
      - Policies
      summary: Create Policy
      description: 'Create Policy


        Creates a new named policy in the organization. The user making the request is the

        owner of the policy, giving them edit access to the policy along with the org owners.'
      operationId: createPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:create
  /v0/org/{org_id}/policies/{policy_id}:
    delete:
      tags:
      - Policies
      summary: Delete Policy
      description: 'Delete Policy


        Delete the named policy with the given name or id.'
      operationId: deletePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:delete
    patch:
      tags:
      - Policies
      summary: Update Policy
      description: 'Update Policy


        Updates the policy with the given name or id.'
      operationId: updatePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:update
        - manage:policy:update:rule
        - manage:policy:update:owner
        - manage:policy:update:name
        - manage:policy:update:editPolicy
  /v0/org/{org_id}/policies/{policy_id}/logs:
    post:
      tags:
      - Policies
      summary: Get Policy Logs
      description: 'Get Policy Logs


        Returns the logs for the given policy, within the given timeframe.'
      operationId: getPolicyLogs
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type:
          - string
          - 'null'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyLogsRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PaginatedPolicyLogsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:logs:get
  /v0/org/{org_id}/policies/{policy_id}/{version}:
    get:
      tags:
      - Policies
      summary: Get Policy
      description: 'Get Policy


        Returns the specified version or latest of a named policy with the given name or id.'
      operationId: getPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: version
        in: path
        description: The policy version, either 'latest' or 'v<number>'.
        required: true
        schema:
          type: string
        example: latest
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:get
  /v0/org/{org_id}/policies/{policy_id}/{version}/invoke:
    post:
      tags:
      - Policies
      summary: Invoke Policy
      description: 'Invoke Policy


        Invokes the [NamedPolicy] with the given ID with the given request information.

        It is only supported for Wasm policies.'
      operationId: invokePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: version
        in: path
        description: The policy version, either 'latest' or 'v<number>'.
        required: true
        schema:
          type: string
        example: latest
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InvokePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/InvokePolicyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:invoke
  /v0/org/{org_id}/policy/buckets:
    get:
      tags:
      - Policies
      summary: List Buckets
      description: 'List Buckets


        List available meta information about all policy KV store buckets in the org.'
      operationId: listPolicyBuckets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type:
          - string
          - 'null'
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListBucketsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:buckets:list
  /v0/org/{org_id}/policy/buckets/{bucket_name}:
    get:
      tags:
      - Policies
      summary: Get Bucket
      description: 'Get Bucket


        Returns the meta information of a policy KV store bucket.'
      operationId: getPolicyBucket
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: bucket_name
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/BucketInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:bucket:get
    patch:
      tags:
      - Policies
      summary: Update Bucket
      description: 'Update Bucket


        Updates meta information for an existing policy KV store bucket.'
      operationId: updatePolicyBucket
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: bucket_name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBucketRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/BucketInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:bucket:update:acl
        - manage:policy:bucket:update:metadata
  /v0/org/{org_id}/policy/import_key:
    get:
      tags:
      - Policies
      summary: Create Policy Import Key
      description: 'Create Policy Import Key


        Generate an ephemeral key that a client can use for encrypting data related to Wasm

        policies (e.g., policy secrets).'
      operationId: createPolicyImportKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/CreatePolicyImportKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:createImportKey
  /v0/org/{org_id}/policy/secrets:
    get:
      tags:
      - Policies
      summary: Get the org-wide policy secrets.
      description: 'Get the org-wide policy secrets.


        Note that this only returns the keys for the secrets, omitting the values.

        The values are secret and are not accessible outside Wasm policy execution.'
      operationId: getPolicySecrets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:get
    patch:
      tags:
      - Policies
      summary: Update org-level policy secrets
      description: 'Update org-level policy secrets


        The provided secrets will replace any existing org-level secrets.

        It fails if the secrets weren''t previously created.


        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: updatePolicySecrets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicySecretsRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update
        - manage:policy:secrets:update:values
        - manage:policy:secrets:update:editPolicy
  /v0/org/{org_id}/policy/secrets/{secret_name}:
    put:
      tags:
      - Policies
      summary: Create or overwrite an org-level policy secret.
      description: 'Create or overwrite an org-level policy secret.

        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: setPolicySecret
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: secret_name
        in: path
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetPolicySecretRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update:values
    delete:
      tags:
      - Policies
      summary: Delete an org-level policy secret.
      description: 'Delete an org-level policy secret.

        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: deletePolicySecret
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: secret_name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update:values
  /v0/org/{org_id}/policy/wasm:
    post:
      tags:
      - Policies
      summary: Upload Wasm Policy
      description: 'Upload Wasm Policy


        Returns a signed URL for uploading a wasm policy to CubeSigner. The policy will be

        deleted if not attached to a [NamedPolicy] soon after the upload has been completed.'
      operationId: uploadWasmPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UploadWasmPolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/UploadWasmPolicyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:wasm:upload
components:
  schemas:
    BucketInfo:
      allOf:
      - allOf:
        - type: object
          description: 'Versioning fields (e.g., version number, creation time, and last modified times)

            that are common to different types of resources.'
          properties:
            created:
              allOf:
              - $ref: '#/components/schemas/EpochDateTime'
            last_modified:
              allOf:
              - $ref: '#/components/schemas/EpochDateTime'
            version:
              type: integer
              format: int64
              description: Version of this object
              minimum: 0
        - type: object
          required:
          - owner
          - org_id
          properties:
            acl:
              type:
              - array
              - 'null'
              items: {}
              description: The access-control entries for the bucket.
            metadata:
              description: Arbitrary user-defined metadata.
            org_id:
              $ref: '#/components/schemas/Id'
            owner:
              $ref: '#/components/schemas/Id'
        description: 'Sub-entity of org where per-bucket metadata (like ACL) is stored.

          The [Id] of a [BucketMeta] must be the bucket name.'
      - type: object
        required:
        - name
        properties:
          name:
            type: string
            description: The name of the bucket.
      description: Information about a policy KV store bucket.
    Empty:
      default: null
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    WasmPolicyResponse:
      oneOf:
      - type: object
        required:
        - response
        properties:
          response:
            type: string
            enum:
            - Allow
      - type: object
        description: The policy denied signing the transaction.
        required:
        - reason
        - response
        properties:
          reason:
            type: string
            description: The reason for the denial.
          response:
            type: string
            enum:
            - Deny
      - type: object
        description: The policy failed to execute successfully, and exited with an error.
        required:
        - error
        - response
        properties:
          error:
            type: string
            description: The error from the Policy Engine.
          response:
            type: string
            enum:
            - Error
      description: The response from invoking a Wasm policy.
      discriminator:
        propertyName: response
    EditPolicy:
      type: object
      description: 'A policy which governs when and who is allowed to update the entity this policy is

        attached to (e.g., a role or a key).


        When attached to a role, by default, this policy applies to role deletion and all

        role updates (including adding/removing keys and users); in terms of scopes,

        it applies to `manage:role:update:*` and `manage:role:delete`.


        When attached to a key, by default, this policy applies to key deletion, all

        key updates, and adding/removing that key to/from a role; in terms of scopes,

        it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`.


        This default can be changed by setting the `applies_to_scopes` property.'
      properties:
        applies_to_scopes:
          $ref: '#/components/schemas/ScopeSet'
        mfa:
          allOf:
          - $ref: '#/components/schemas/MfaPolicy'
        time_lock_until:
          allOf:
          - $ref: '#/components/schemas/EpochDateTime'
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVers

# --- truncated at 32 KB (91 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-policies-api-openapi.yml