Cubist Roles API

openapi: 3.0.3
info:
  title: CubeSigner Account Roles API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Roles
paths:
  /v0/org/{org_id}/roles:
    get:
      tags:
      - Roles
      summary: List Roles
      description: 'List Roles


        Retrieves all roles in an organization that the current user is allowed to access.'
      operationId: listRoles
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      - name: summarize
        in: query
        description: Don't include keys and users for each role
        required: false
        schema:
          type: boolean
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListRolesResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:list
    post:
      tags:
      - Roles
      summary: Create Role
      description: 'Create Role


        Creates a new role in an organization. Unless the logged-in user

        is the owner, they are automatically added to the newly created role.'
      operationId: createRole
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        description: Optional request body to set the role name
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/CreateRoleRequest'
              nullable: true
        required: false
      responses:
        '200':
          $ref: '#/components/responses/CreateRoleResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:create
  /v0/org/{org_id}/roles/{role_id}:
    get:
      tags:
      - Roles
      summary: Get Role
      description: 'Get Role


        Retrieves information about a role in an organization'
      operationId: getRole
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: summarize
        in: query
        required: false
        schema:
          type: boolean
          nullable: true
      responses:
        '200':
          $ref: '#/components/responses/RoleInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:get
    delete:
      tags:
      - Roles
      summary: Delete Role
      description: 'Delete Role


        Deletes a role in an organization.


        Only users in the role can perform this action.

        Additionally, the role''s edit policy (if set) must permit the update.'
      operationId: deleteRole
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:delete
    patch:
      tags:
      - Roles
      summary: Update Role
      description: 'Update Role


        Enables or disables a role (this requires the `manage:role:update:enable` scope).

        Updates the role''s policies (this requires the `manage:role:update:policy` scope).

        Updates the role''s edit policies (this requires the `manage:role:update:editPolicy` scope).


        The user must be in the role or an owner of the organization.

        Additionally, the role''s edit policy (if set) must permit the update.'
      operationId: updateRole
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/RoleInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:update:enable
        - manage:role:update:policy
        - manage:role:update:editPolicy
  /v0/org/{org_id}/roles/{role_id}/attest:
    get:
      tags:
      - Roles
      summary: Attest to Role Properties
      description: 'Attest to Role Properties


        The response is a JWT whose claims are the requested role properties.'
      operationId: attestRole
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: verbosity
        in: query
        description: 'Role properties to include in an attestation. Defaults to basic role

          properties, including associated users, but excluding associated keys.'
        required: false
        schema:
          $ref: '#/components/schemas/RoleAttestationVerbosity'
      - name: key_filter
        in: query
        description: 'Associated keys filter, i.e., when specified, out all other associated

          keys are filtered out. Defaults to including all associated keys.'
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/Id'
          nullable: true
      responses:
        '200':
          $ref: '#/components/responses/RoleInfoJwt'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:attest
  /v0/org/{org_id}/roles/{role_id}/keys:
    get:
      tags:
      - Roles
      summary: List Role Keys
      description: 'List Role Keys


        Returns an array of all keys in a role.'
      operationId: listRoleKeys
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 100
          maximum: 1001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListRoleKeysResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:get:keys
  /v0/org/{org_id}/roles/{role_id}/keys/{key_id}:
    get:
      tags:
      - Roles
      summary: Get a Key in Role
      description: 'Get a Key in Role


        Returns the key-in-role information for a given key and role. If `details` is set to `true`,

        this endpoint returns detailed key information.'
      operationId: getRoleKey
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: key_id
        in: path
        description: ID of the desired Key
        required: true
        schema:
          type: string
        example: Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: details
        in: query
        description: Whether to include detailed key information
        required: false
        schema:
          type: boolean
          nullable: true
        style: form
        example: 'true'
      responses:
        '200':
          $ref: '#/components/responses/KeyInRoleInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:get:keys
  /v0/org/{org_id}/roles/{role_id}/tx:
    get:
      tags:
      - Roles
      summary: List Historical Transactions
      description: 'List Historical Transactions


        Returns a sorted, paginated list of transactions signed by the given role,

        ordered from most recent first.'
      operationId: listHistoricalRoleTx
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListHistoricalTxResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:history:tx:list
  /v0/org/{org_id}/roles/{role_id}/users:
    get:
      tags:
      - Roles
      summary: List Role Users.
      description: 'List Role Users.


        Returns an array of all users who have access to a role.'
      operationId: listRoleUsers
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: page.size
        in: query
        description: 'Max number of items to return per page.


          If the actual number of returned items may be less that this, even if there exist more

          data in the result set. To reliably determine if more data is left in the result set,

          inspect the [UnencryptedLastEvalKey] value in the response object.'
        required: false
        schema:
          type: integer
          format: int32
          default: 1000
          maximum: 10001
          minimum: 1
        style: form
      - name: page.start
        in: query
        description: 'The start of the page.  Omit to start from the beginning; otherwise, only specify a

          the exact value previously returned as ''last_evaluated_key'' from the same endpoint.'
        required: false
        schema:
          type: string
          nullable: true
        style: form
      responses:
        '200':
          $ref: '#/components/responses/PaginatedListRoleUsersResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:role:get:users
components:
  schemas:
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    Empty:
      default: null
      nullable: true
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    KeyDerivationInfo:
      type: object
      description: Derivation-related metadata for keys derived from a long-lived mnemonic
      required:
      - mnemonic_id
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: The derivation path used to derive this key
        mnemonic_id:
          type: string
          description: The mnemonic-id of the key's parent mnemonic
    CoinbaseApiPropertiesPatch:
      type: object
      description: 'Wire-format patch payload for [`KeyProperties::CoinbaseApi`].


        Every field follows the same per-field PATCH semantics: a missing field

        leaves the existing value alone, a JSON `null` clears it, and a value sets it.'
      properties:
        api_key_id:
          type: string
          description: 'Identifier of the Coinbase API key this key authenticates as. Plain

            (non-secret) value; appears in JWT `kid`/`sub` claims.'
          nullable: true
        portfolio_name:
          type: string
          description: Coinbase portfolio name.
          nullable: true
        portfolio_uuid:
          type: string
          description: Coinbase portfolio UUID.
          nullable: true
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
            nullable: true
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError
      - SplitSignerError
      - CreateImportKeyError
      - CreateEotsNoncesError
      - EotsSignError
      - BabylonCovSignError
      - CognitoDeleteUserError
      - CognitoListUsersError
      - CognitoGetUserError
      - MissingUserEmail
      - CognitoResendUserInvitation
      - CognitoSetUserPasswordError
      - GenericInternalError
      - AssumeRoleWithoutEvidence
      - OidcAuthWithoutOrg
      - MissingKeyMetadata
      - KmsEnableKeyError
      - KmsDisableKeyError
      - LambdaInvokeError
      - LambdaNoResponseError
      - LambdaFailure
      - LambdaUnparsableResponse
      - SerializeEncryptedExportKeyError
      - DeserializeEncryptedExportKeyError
      - ReEncryptUserExport
      - S3UploadError
      - S3DownloadError
      - S3CopyError
      - S3ListObjectsError
      - S3DeleteObjectsError
      - S3BuildError
      - S3PresignedUrlError
      - ManagedStateMissing
      - InternalHeaderMissing
      - InvalidInternalHeaderValue
      - RequestLocalStateAlreadySet
      - OidcOrgMismatch
      - OidcIssuerInvalidJwk
      - InvalidPkForMaterialId
      - SegwitTweakFailed
      - UncheckedOrg
      - SessionOrgIdMissing
      - AvaSignCredsMissing
      - AvaSignSignatureMissing
      - ExpectedRoleSession
      - InvalidThirdPartyIdentity
      - CognitoGetUser
      - SnsSubscribeError
      - SnsUnsubscribeError
      - SnsGetSubscriptionAttributesError
      - SnsSubscriptionAttributesMissing
      - SnsSetSubscriptionAttributesError
      - SnsPublishBatchError
      - InconsistentMultiValueTestAndSet
      - MaterialIdError
      - InvalidBtcAddress
      - HistoricalTxBodyMissing
      - InvalidOperation
      - ParentOrgNotFound
      - OrgParentLoop
      - ResolvedParentOrgWithNoScopeCeiling
      - InvalidUploadObjectId
      - PolicyEngineNotFound
      - PolicyEngineError
      - PolicySecretsEncryptionError
      - CreatePolicyImportKeyError
      - InvalidAlias
      - EmptyUpdateModifiedObject
      - EmptyUpdateModifiedActions
      - DbContactAddressesInvalid
      - InvalidEvmSigedRlp
      - InvalidErc20Data
      - InvalidRpcUrl
    RestrictedActionsMap:
      type: object
      description: A map of actions to sets of membership roles
      additionalProperties:
        type: array
        items:
          $ref: '#/components/schemas/MemberRole'
        uniqueItems: true
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    RoleAttestationVerbosity:
      type: string
      description: Specifies which role properties to include in an attestation
      enum:
      - Summary
      - WithKeys
      - Full
    EvmTxDepositErrorCode:
      type: string
      enum:
      - EvmTxDepositReceiverMismatch
      - EvmTxDepositEmptyData
      - EvmTxDepositEmptyChainId
      - EvmTxDepositEmptyReceiver
      - EvmTxDepositUnexpectedValue
      - EvmTxDepositUnexpectedDataLength
      - EvmTxDepositNoAbi
      - EvmTxDepositNoDepositFunction
      - EvmTxDepositUnexpectedFunctionName
      - EvmTxDepositUnexpectedValidatorKey
      - EvmTxDepositInvalidValidatorKey
      - EvmTxDepositMissingDepositArg
      - EvmTxDepositWrongDepositArgType
      - EvmTxDepositValidatorKeyNotInRole
      - EvmTxDepositUnexpectedWithdrawalCredentials
      - EvmTxDepositUnresolvedRole
      - EvmTxDepositInvalidDepositEncoding
    KeyInfo:
      allOf:
      - $ref: '#/components/schemas/CommonFields'
      - type: object
        required:
        - key_type
        - key_id
        - material_id
        - purpose
        - enabled
        - owner
        - public_key
        - policy
        properties:
          derivation_info:
            allOf:
            - $ref: '#/components/schemas/KeyDerivationInfo'
            nullable: true
          enabled:
            type: boolean
            description: Whether the key is enabled (only enabled keys may be used for signing)
          key_id:
            type: string
            description: 'The id of the key: "Key#" followed by a unique identifier specific to

              the type of key (such as a public key for BLS or an ethereum address for Secp)'
            example: Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
          key_type:
            $ref: '#/components/schemas/KeyType'
          material_id:
            type: string
            description: A unique identifier specific to the type of key, such as a public key or an ethereum address
            example: '0x8e3484687e66cdd26cf04c3647633ab4f3570148'
          owner:
            type: string
            description: Owner of the key
            example: User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
          policy:
            type: array
            items: {}
            description: Key policy
            example:
            - AllowRawBlobSigning
            - RequireMfa:
                count: 1
          properties:
            allOf:
            - $ref: '#/components/schemas/KeyPropertiesPatch'
            nullable: true
          provenance:
            type: string
            description: The key provenance.
            nullable: true
          public_key:
            type: string
            description: 'Hex-encoded, serialized public key. The format used depends on the key type:

              - Secp256k1 keys use 65-byte uncompressed SECG format;

              - Stark keys use 33-byte compressed SECG format;

              - BLS keys use 48-byte compressed BLS12-381 (ZCash) format;

              - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032.'
            example: '0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431'
          purpose:
            type: string
            description: The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages)
            example: Eth2Validator(1)
          region:
            type: string
            description: The region affinity for this key
    EditPolicy:
      type: object
      description: 'A policy which governs when and who is allowed to update the entity this policy is

        attached to (e.g., a role or a key).


        When attached to a role, by default, this policy applies to role deletion and all

        role updates (including adding/removing keys and users); in terms of scopes,

        it applies to `manage:role:update:*` and `manage:role:delete`.


        When attached to a key, by default, this policy applies to key deletion, all

        key updates, and adding/removing that key to/from a role; in terms of scopes,

        it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`.


        This default can be changed by setting the `applies_to_scopes` property.'
      properties:
        applies_to_scopes:
          $ref: '#/components/schemas/ScopeSet'
        mfa:
          allOf:
          - $ref: '#/components/schemas/MfaPolicy'
          nullable: true
        time_lock_until:
          allOf:
          - $ref: '#/components/schemas/EpochDateTime'
          nullable: true
    OperationKind:
      type: string
      description: All different kinds of sensitive operations
      enum:
      - AvaSign
      - AvaChainTxSign
      - BabylonCovSign
      - BabylonRegistration
      - BabylonStaking

# --- truncated at 32 KB (85 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-roles-api-openapi.yml