Cubist Policies API

openapi: 3.0.3
info:
  title: CubeSigner Account Policies API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Policies
paths:
  /v0/org/{org_id}/policies:
    get:
      tags:
      - Policies
      summary: List Policies
      description: 'List Policies


        Returns the list of all policies in the Org.'
      operationId: listPolicies
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      - name: policy_type
        in: query
        description: The optional type of policies to return
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/PolicyType'
          nullable: true
        style: form
        example: Key
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListPoliciesResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:list
    post:
      tags:
      - Policies
      summary: Create Policy
      description: 'Create Policy


        Creates a new named policy in the organization. The user making the request is the

        owner of the policy, giving them edit access to the policy along with the org owners.'
      operationId: createPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:create
  /v0/org/{org_id}/policies/{policy_id}:
    delete:
      tags:
      - Policies
      summary: Delete Policy
      description: 'Delete Policy


        Delete the named policy with the given name or id.'
      operationId: deletePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:delete
    patch:
      tags:
      - Policies
      summary: Update Policy
      description: 'Update Policy


        Updates the policy with the given name or id.'
      operationId: updatePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:update
        - manage:policy:update:rule
        - manage:policy:update:owner
        - manage:policy:update:name
        - manage:policy:update:editPolicy
  /v0/org/{org_id}/policies/{policy_id}/logs:
    post:
      tags:
      - Policies
      summary: Get Policy Logs
      description: 'Get Policy Logs


        Returns the logs for the given policy, within the given timeframe.'
      operationId: getPolicyLogs
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyLogsRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PaginatedPolicyLogsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:logs:get
  /v0/org/{org_id}/policies/{policy_id}/{version}:
    get:
      tags:
      - Policies
      summary: Get Policy
      description: 'Get Policy


        Returns the specified version or latest of a named policy with the given name or id.'
      operationId: getPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: version
        in: path
        description: The policy version, either 'latest' or 'v<number>'.
        required: true
        schema:
          type: string
        example: latest
      responses:
        '200':
          $ref: '#/components/responses/PolicyInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:get
  /v0/org/{org_id}/policies/{policy_id}/{version}/invoke:
    post:
      tags:
      - Policies
      summary: Invoke Policy
      description: 'Invoke Policy


        Invokes the [NamedPolicy] with the given ID with the given request information.

        It is only supported for Wasm policies.'
      operationId: invokePolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: policy_id
        in: path
        description: Name or ID of the desired NamedPolicy
        required: true
        schema:
          type: string
        example: NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: version
        in: path
        description: The policy version, either 'latest' or 'v<number>'.
        required: true
        schema:
          type: string
        example: latest
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InvokePolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/InvokePolicyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:invoke
  /v0/org/{org_id}/policy/buckets:
    get:
      tags:
      - Policies
      summary: List Buckets
      description: 'List Buckets


        List available meta information about all policy KV store buckets in the org.'
      operationId: listPolicyBuckets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListBucketsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:buckets:list
  /v0/org/{org_id}/policy/buckets/{bucket_name}:
    get:
      tags:
      - Policies
      summary: Get Bucket
      description: 'Get Bucket


        Returns the meta information of a policy KV store bucket.'
      operationId: getPolicyBucket
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: bucket_name
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/BucketInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:bucket:get
    patch:
      tags:
      - Policies
      summary: Update Bucket
      description: 'Update Bucket


        Updates meta information for an existing policy KV store bucket.'
      operationId: updatePolicyBucket
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: bucket_name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBucketRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/BucketInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:bucket:update:acl
        - manage:policy:bucket:update:metadata
  /v0/org/{org_id}/policy/import_key:
    get:
      tags:
      - Policies
      summary: Create Policy Import Key
      description: 'Create Policy Import Key


        Generate an ephemeral key that a client can use for encrypting data related to Wasm

        policies (e.g., policy secrets).'
      operationId: createPolicyImportKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/CreatePolicyImportKeyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:createImportKey
  /v0/org/{org_id}/policy/secrets:
    get:
      tags:
      - Policies
      summary: Get the org-wide policy secrets.
      description: 'Get the org-wide policy secrets.


        Note that this only returns the keys for the secrets, omitting the values.

        The values are secret and are not accessible outside Wasm policy execution.'
      operationId: getPolicySecrets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:get
    patch:
      tags:
      - Policies
      summary: Update org-level policy secrets
      description: 'Update org-level policy secrets


        The provided secrets will replace any existing org-level secrets.

        It fails if the secrets weren''t previously created.


        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: updatePolicySecrets
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicySecretsRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update
        - manage:policy:secrets:update:values
        - manage:policy:secrets:update:editPolicy
  /v0/org/{org_id}/policy/secrets/{secret_name}:
    put:
      tags:
      - Policies
      summary: Create or overwrite an org-level policy secret.
      description: 'Create or overwrite an org-level policy secret.

        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: setPolicySecret
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: secret_name
        in: path
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetPolicySecretRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update:values
    delete:
      tags:
      - Policies
      summary: Delete an org-level policy secret.
      description: 'Delete an org-level policy secret.

        Must be permitted by the policy secret''s edit policy if set, and the org''s edit policy otherwise.'
      operationId: deletePolicySecret
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: secret_name
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PolicySecretsInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:secrets:update:values
  /v0/org/{org_id}/policy/wasm:
    post:
      tags:
      - Policies
      summary: Upload Wasm Policy
      description: 'Upload Wasm Policy


        Returns a signed URL for uploading a wasm policy to CubeSigner. The policy will be

        deleted if not attached to a [NamedPolicy] soon after the upload has been completed.'
      operationId: uploadWasmPolicy
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UploadWasmPolicyRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/UploadWasmPolicyResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:policy:wasm:upload
components:
  schemas:
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    UpdateBucketRequest:
      type: object
      description: The information needed to update a bucket.
      properties:
        acl:
          description: Access-control entries defining how the bucket can be accessed.
          nullable: true
        expected_version:
          type: integer
          format: int64
          description: If set, updating only succeeds if the current version matches this value.
          nullable: true
          minimum: 0
        metadata:
          description: Optional metadata.
          nullable: true
        owner:
          type: string
          description: Update the owner of the bucket
          example: User#00000000-0000-0000-0000-000000000000
          nullable: true
    WasmPolicyResponse:
      oneOf:
      - type: object
        required:
        - response
        properties:
          response:
            type: string
            enum:
            - Allow
      - type: object
        description: The policy denied signing the transaction.
        required:
        - reason
        - response
        properties:
          reason:
            type: string
            description: The reason for the denial.
          response:
            type: string
            enum:
            - Deny
      - type: object
        description: The policy failed to execute successfully, and exited with an error.
        required:
        - error
        - response
        properties:
          error:
            type: string
            description: The error from the Policy Engine.
          response:
            type: string
            enum:
            - Error
      description: The response from invoking a Wasm policy.
      discriminator:
        propertyName: response
    Empty:
      default: null
      nullable: true
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    SecretValue:
      oneOf:
      - type: string
        description: 'A secret value.

          Config values are encrypted in transit and at rest.'
      - type: object
        description: 'A secret value encrypted to this organization''s Wasm policy.

          Each value is encrypted with its own ephemeral key.'
        required:
        - encrypted_value
        - salt
        - client_public_key
        properties:
          client_public_key:
            type: string
            description: 'The client''s ephemeral public key used to derive a shared key.

              This is a base64-encoded, SEC1-encoded P384 public key.'
          encrypted_value:
            type: string
            description: 'The encrypted secret value.

              This is a base64-encoded ciphertext.'
          salt:
            type: string
            description: 'A salt value used to derive a shared key for AES-GCM.

              This is a base64-encoded byte string.'
      description: The value of a policy secret.
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - In

# --- truncated at 32 KB (92 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-policies-api-openapi.yml