Cubist User API

openapi: 3.0.3
info:
  title: CubeSigner Account User API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: User
paths:
  /v0/about_me:
    get:
      tags:
      - User
      summary: User Info
      description: 'User Info


        Retrieves information about the current user.


        PREFER `GET /v0/orgs/{org_id}/user/me`'
      operationId: aboutMeLegacy
      responses:
        '200':
          $ref: '#/components/responses/UserInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - ''
  /v0/org/{org_id}/user/me:
    get:
      tags:
      - User
      summary: User Info
      description: 'User Info


        Retrieves information about the current user.'
      operationId: aboutMe
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/UserInfo'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth: []
  /v0/org/{org_id}/user/me/email:
    post:
      tags:
      - User
      summary: Initiate Reset Verified Email Flow
      description: 'Initiate Reset Verified Email Flow

        '
      operationId: userResetEmailInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailResetRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmailOtpResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:email
    patch:
      tags:
      - User
      summary: Finalize a Reset Verified Email Flow
      description: Finalize a Reset Verified Email Flow
      operationId: userResetEmailComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailOtpAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:email
  /v0/org/{org_id}/user/me/fido:
    post:
      tags:
      - User
      summary: Initiate registration of a FIDO key.
      description: 'Initiate registration of a FIDO key.


        If a discoverable key is requested, user verification (PIN) is required.


        Generates a challenge that must be answered to prove ownership of a key.'
      operationId: userRegisterFidoInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/FidoCreateChallengeResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:fido
    patch:
      tags:
      - User
      summary: Finalize registration of a FIDO key
      description: 'Finalize registration of a FIDO key


        Accepts the response to the challenge generated by the POST to this endpoint.'
      operationId: userRegisterFidoComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:fido
  /v0/org/{org_id}/user/me/fido/{fido_id}:
    delete:
      tags:
      - User
      summary: Delete FIDO key
      description: 'Delete FIDO key


        Deletes a FIDO key from the user''s account (if the key is not the sole MFA factor). MFA is always required.'
      operationId: userDeleteFido
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: fido_id
        in: path
        description: Name or ID of the desired FidoKey
        required: true
        schema:
          type: string
        example: FidoKey#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:unregister:fido
  /v0/org/{org_id}/user/me/totp:
    post:
      tags:
      - User
      summary: Initialize TOTP Reset
      description: 'Initialize TOTP Reset


        Creates a new TOTP challenge that must be answered to prove that the new TOTP

        was successfully imported into an authenticator app.


        This operation is allowed if EITHER

        - the user account is not yet initialized and no TOTP is already set, OR

        - the user has not configured any auth factors;

        otherwise, MFA is required.'
      operationId: userResetTotpInit
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/TotpResetRequest'
              nullable: true
        required: false
      responses:
        '200':
          $ref: '#/components/responses/TotpInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:totp
    delete:
      tags:
      - User
      summary: Delete TOTP
      description: 'Delete TOTP


        Deletes TOTP from the user''s account (if TOTP is not the sole MFA factor). MFA is always required.

        '
      operationId: userDeleteTotp
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:unregister:totp
    patch:
      tags:
      - User
      summary: Finalize resetting TOTP
      description: 'Finalize resetting TOTP


        Checks if the response contains the correct TOTP code corresponding to the

        challenge generated by the POST method of this endpoint.'
      operationId: userResetTotpComplete
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:register:totp
  /v0/org/{org_id}/user/me/totp/verify:
    post:
      tags:
      - User
      summary: Verify TOTP
      description: 'Verify TOTP


        Checks if a given code matches the current TOTP code for the current user.

        Errors with 403 if the current user has not set up TOTP or the code fails verification.'
      operationId: userVerifyTotp
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpApproveRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:mfa:verify:totp
  /v0/user/me/fido:
    post:
      tags:
      - User
      summary: Initiate registration of a FIDO key
      description: 'Initiate registration of a FIDO key


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/fido` instead.


        Generates a challenge that must be answered to prove ownership of a key'
      operationId: registerFidoInitLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/FidoCreateChallengeResponse'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:fido
    patch:
      tags:
      - User
      summary: Finalize registration of a FIDO key
      description: 'Finalize registration of a FIDO key


        DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/fido` instead.


        Accepts the response to the challenge generated by the POST to this endpoint.'
      operationId: registerFidoCompleteLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FidoCreateChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:fido
  /v0/user/me/totp:
    post:
      tags:
      - User
      summary: Initialize TOTP Reset
      description: 'Initialize TOTP Reset


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp` instead.


        Creates a new TOTP challenge that must be answered to prove that the new TOTP

        was successfully imported into an authenticator app.


        This operation is allowed if EITHER

        - the user account is not yet initialized and no TOTP is already set, OR

        - the user has not configured any auth factors;

        otherwise, MFA is required.'
      operationId: resetTotpInitLegacy
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/TotpResetRequest'
              nullable: true
        required: false
      responses:
        '200':
          $ref: '#/components/responses/TotpInfo'
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptedResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:totp
    patch:
      tags:
      - User
      summary: Finalize resetting TOTP
      description: 'Finalize resetting TOTP


        DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/totp` instead.


        Checks if the response contains the correct TOTP code corresponding to the

        challenge generated by the POST method of this endpoint.'
      operationId: resetTotpCompleteLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpChallengeAnswer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:register:totp
  /v0/user/me/totp/verify:
    post:
      tags:
      - User
      summary: Verify TOTP
      description: 'Verify TOTP


        DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp/verify` instead.


        Checks if a given code matches the current TOTP code for the current user.

        Errors with 403 if the current user has not set up TOTP or the code fails verification.'
      operationId: verifyTotpLegacy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpApproveRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/EmptyImpl'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: true
      security:
      - SignerAuth:
        - manage:mfa:verify:totp
  /v0/user/orgs:
    get:
      tags:
      - User
      summary: Retrieves all the orgs the user is a part of
      description: Retrieves all the orgs the user is a part of
      operationId: userOrgs
      responses:
        '200':
          $ref: '#/components/responses/UserOrgsResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - Oidc: []
components:
  schemas:
    Empty:
      default: null
      nullable: true
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    HttpRequestCmp:
      oneOf:
      - type: string
        description: The requests must match exactly. Any given MFA receipt can be used at most once.
        enum:
        - Eq
      - type: object
        required:
        - EvmTx
        properties:
          EvmTx:
            $ref: '#/components/schemas/EvmTxCmp'
      - type: object
        required:
        - SolanaTx
        properties:
          SolanaTx:
            $ref: '#/components/schemas/SolanaTxCmp'
      description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
    BadGatewayErrorCode:
      type: string
      enum:
      - Generic
      - CustomChainRpcError
      - EsploraApiError
      - SentryApiError
      - CallWebhookError
      - OAuthProviderError
      - OidcDisoveryFailed
      - OidcIssuerJwkEndpointUnavailable
      - SmtpServerUnavailable
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    ClientSessionInfo:
      type: object
      description: 'Session information sent to the client.

        This struct works in tandem with its server-side counterpart [`SessionData`].'
      required:
      - session_id
      - auth_token
      - refresh_token
      - epoch
      - epoch_token
      - auth_token_exp
      - refresh_token_exp
      properties:
        auth_token:
          type: string
          description: Token to use for authorization.
        auth_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        epoch:
          type: integer
          format: int32
          description: Epoch at which the token was last refreshed
          minimum: 0
        epoch_token:
          $ref: '#/components/schemas/B32'
        refresh_token:
          type: string
          description: Token to use for refreshing the `(auth, refresh)` token pair
        refresh_token_exp:
          $ref: '#/components/schemas/EpochDateTime'
        session_id:
          type: string
          description: Session ID
    PublicKeyCredentialParameters:
      type: object
      description: 'This dictionary is used to supply additional parameters when creating a new

        credential.


        https://www.w3.org/TR/webauthn-2/#dictionary-credential-params'
      required:
      - type
      - alg
      properties:
        alg:
          type: integer
          format: int64
          description: 'This member specifies the cryptographic signature algorithm with which

            the newly generated credential will be used, and thus also the type of

            asymmetric key pair to be generated, e.g., RSA or Elliptic Curve.'
        type:
          $ref: '#/components/schemas/PublicKeyCredentialType'
    BinanceDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Binance API method that would have been used
        url:
          type: string
          description: The Binance API url method that would have been called
    PublicKeyCredentialCreationOptions:
      type: object
      description: 'Defines the parameters for the creation of a new public key credential


        https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialcreationoptions'
      required:
      - rp
      - user
      - challenge
      - pubKeyCredParams
      properties:
        attestation:
          $ref: '#/components/schemas/AttestationConveyancePreference'
        authenticatorSelection:
          allOf:
          - $ref: '#/components/schemas/AuthenticatorSelectionCriteria'
          nullable: true
        challenge:
          type: string
          description: 'This member contains a challenge intended to be used for generating the

            newly created credential’s attestation object. See the § 13.4.3

            Cryptographic Challenges security consideration.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-challenge'
        excludeCredentials:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialDescriptor'
          description: 'This member is intended for use by Relying Parties that wish to limit

            the creation of multiple credentials for the same account on a single

            authenticator. The client is requested to return an error if the new

            credential would be created on an authenticator that also contains one

            of the credentials enumerated in this parameter.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-excludecredentials'
        extensions:
          type: object
          description: 'This member contains additional parameters requesting additional

            processing by the client and authenticator. For example, the caller may

            request that only authenticators with certain capabilities be used to

            create the credential, or that particular information be returned in the

            attestation object. Some extensions are defined in § 9 WebAuthn

            Extensions; consult the IANA "WebAuthn Extension Identifiers" registry

            [IANA-WebAuthn-Registries] established by [RFC8809] for an up-to-date

            list of registered WebAuthn Extensions.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-extensions'
          nullable: true
        pubKeyCredParams:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialParameters'
          description: 'This member contains information about the desired properties of the

            credential to be created. The sequence is ordered from most preferred to

            least preferred. The client makes a best-effort to create the most

            preferred credential that it can.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-pubkeycredparams'
        rp:
          $ref: '#/components/schemas/PublicKeyCredentialRpEntity'
        timeout:
          type: integer
          format: int32
          description: 'This member specifies a time, in milliseconds, that the caller is

            willing to wait for the call to complete. This is treated as a hint, and

            MAY be overridden by the client.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-timeout'
          nullable: true
          minimum: 0
        user:
          $ref: '#/components/schemas/PublicKeyCredentialUserEntity'
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    FidoCreateChallengeAnswer:
      type: object
      description: Sent from the client to the server to answer a fido challenge
      required:
      - challenge_id
      - credential
      properties:
        challenge_id:
          type: string
          description: The ID of the challenge that was returned from the POST endpoint
        credential:
          $ref: '#/components/schemas/PublicKeyCredential'
    MfaPolicy:
      type: object
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. If empty at creation time, default to the current user.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        count:
          type: integer
          format: int32
          description: How many users to require to approve (defaults to 1).
          minimum: 0
        lifetime:
          $ref: '#/components/schemas/Seconds'
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user (defaults to 1).
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
        restricted_operations:
          type: array
          items:
            $ref: '#/components/schemas/OperationKind'
          description: 'CubeSigner operations to which this policy should apply.

            When omitted, applies to all operations.'
          nullable: true
        time_delay:
          $ref: '#/components/schemas/Seconds'
      example:
        allowed_approvers:
        - User#fabc3f88-04e0-471b-9657-0ae12a3cd73e
        - User#d796c369-9974-473b-ab9e-e4a2418d2d07
        count: 2
        lifetime: 900
    PublicKeyCredentialRpEntity:
      type: object
      description: 'The PublicKeyCredentialRpEntity dictionary is used to supply additional

        Relying Party attributes when creating a new credential.


        https://www.w3.org/TR/webauthn-2/#dictionary-rp-credential-params'
      required:
      - name
      properties:
        id:
          type: string
          description: 'A unique identifier for the Relying Party entity, which sets the RP ID.


            https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrpentity-id'
          nullable: true
        name:
          type: string
          description: 'A human-palatable name for the entity. Its function depends on what the

            PublicKeyCredentialEntity represents: When inherited by

            PublicKeyCredentialRpEntity it is a human-palatable identifier for the

            Relying Party, intended only for display. For example, "ACME

            Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".


            Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3

            of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass

            [RFC8264], when setting name''s value, or displaying the value to the

            user.


            This string MAY contain language and direction metadata. Relying Parties

            SHOULD consider providing this information. See § 6.4.2 Language and

            Direction Encoding about how this metadata is encoded.'
    Status:
      type: object
      required:
      - count
      - num_auth_factors
      - allowed_approvers
      - approved_by
      properties:
        allowed_approvers:
          type: array
          items:
            type: string
          description: Users who are allowed to approve. Must be non-empty.
        allowed_mfa_types:
          type: array
          items:
            $ref: '#/components/schemas/MfaType'
          description: Allowed approval types. When omitted, defaults to any.
          nullable: true
        approved_by:
          type: object
          description: Users who have already approved
          additionalProperties:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/ApprovalInfo'
        count:
          type: integer
          format: int32
          description: How many users must approve
          minimum: 0
        num_auth_factors:
          type: integer
          format: int32
          description: How many auth factors to require per user
          minimum: 0
        request_comparer:
          $ref: '#/components/schemas/HttpRequestCmp'
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
          nullable: true
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
          nullable: true
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    ResidentKeyRequirement:
      type: string
      description: 'This enumeration’s values describe the Relying Party''s requirements for

        client-side discoverable credentials (formerly known as resident credentials

        or resident keys):


        https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement'
      enum:
      - discouraged
      - preferred
      - required
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    InternalErrorCode:
      type: string
      enum:
      - NoMaterialId
      - InvalidAuditLogEntry
      - UnexpectedCheckerRule
      - UnresolvedPolicyReference
      - UnexpectedAclAction
      - FidoKeyAssociatedWithMultipleUsers
      - ClaimsParseError
      - InvalidThrottleId
      - InvalidEmailAddress
      - EmailTemplateRender
      - OidcIdentityHeaderMissing
      - OidcIdentityParseError
      - SystemTimeError
      - PasswordHashParseError
      - SendMailError
      - ReqwestError
      - EmailConstructionError
      - TsWriteError
      - TsQueryError
      - DbQueryError
      - DbGetError
      - DbDeleteError
      - DbPutError
      - DbUpdateError
      - SerdeError
      - TestAndSetError
      - DbGetItemsError
      - DbWriteError
      - CubistSignerError
      - CwListMetricsError
      - CwPutMetricDataError
      - GetAwsSecretError
      - SecretNotFound
      - KmsGenerateRandomError
      - MalformedTotpBytes
      - KmsGenerateRandomNoResponseError
      - CreateKeyError
      - ParseDerivationPathError

# --- truncated at 32 KB (86 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-user-api-openapi.yml