Cubist Users In Role API
The Users In Role API from Cubist — 2 operation(s) for users in role.
OpenAPI Specification
openapi: 3.0.3
info:
title: CubeSigner Account Users In Role API
description: The CubeSigner management and signing service.
contact:
name: Cubist Inc.
email: hello@cubist.dev
version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
description: Testing and staging environment
- url: https://prod.signer.cubist.dev
description: Production environment
security:
- Cognito: []
tags:
- name: Users In Role
paths:
/v0/org/{org_id}/roles/{role_id}/add_user/{user_id}:
put:
tags:
- Users In Role
summary: Add User
description: 'Add User
Adds an existing user to an existing role.
Only users in the role or org owners can add users to a role.
Additionally, the role''s edit policy (if set) must permit the update.'
operationId: addUserToRole
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
- name: role_id
in: path
description: Name or ID of the desired Role
required: true
schema:
type: string
example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
- name: user_id
in: path
description: ID of the desired User
required: true
schema:
type: string
example: User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Empty'
required: true
responses:
'200':
$ref: '#/components/responses/EmptyImpl'
'202':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/AcceptedResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- SignerAuth:
- manage:role:update:user:add
/v0/org/{org_id}/roles/{role_id}/users/{user_id}:
delete:
tags:
- Users In Role
summary: Remove User
description: 'Remove User
Removes an existing user from an existing role.
Only users in the role or org owners can remove users from a role.
Additionally, the role''s edit policy (if set) must permit the update.'
operationId: removeUserFromRole
parameters:
- name: org_id
in: path
description: Name or ID of the desired Org
required: true
schema:
type: string
example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
- name: role_id
in: path
description: Name or ID of the desired Role
required: true
schema:
type: string
example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
- name: user_id
in: path
description: ID of the desired User
required: true
schema:
type: string
example: User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Empty'
required: true
responses:
'200':
$ref: '#/components/responses/EmptyImpl'
'202':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/AcceptedResponse'
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- SignerAuth:
- manage:role:update:user:remove
components:
schemas:
EpochDateTime:
type: integer
format: int64
description: 'DateTime measured in seconds since unix epoch.
A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]
representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
minimum: 0
Empty:
default: null
nullable: true
MfaRequiredArgs:
type: object
required:
- id
- ids
- org_id
properties:
id:
type: string
description: Always set to first MFA id from `Self::ids`
ids:
type: array
items:
type: string
minLength: 1
description: Non-empty MFA request IDs
org_id:
type: string
description: Organization id
policy_eval_tree:
description: Optional policy evaluation tree (included in signer responses, when requested)
nullable: true
session:
allOf:
- $ref: '#/components/schemas/NewSessionResponse'
nullable: true
B32:
type: string
description: Wrapper around a zeroizing 32-byte fixed-size array
AcceptedValue:
oneOf:
- type: object
required:
- SignDryRun
properties:
SignDryRun:
$ref: '#/components/schemas/SignDryRunArgs'
- type: object
required:
- BinanceDryRun
properties:
BinanceDryRun:
$ref: '#/components/schemas/BinanceDryRunArgs'
- type: object
required:
- BybitDryRun
properties:
BybitDryRun:
$ref: '#/components/schemas/BybitDryRunArgs'
- type: object
required:
- CoinbaseDryRun
properties:
CoinbaseDryRun:
$ref: '#/components/schemas/CoinbaseDryRunArgs'
- type: object
required:
- MfaRequired
properties:
MfaRequired:
$ref: '#/components/schemas/MfaRequiredArgs'
description: Different responses we return for success status codes.
NotFoundErrorCode:
type: string
enum:
- UriSegmentMissing
- UriSegmentInvalid
- TotpNotConfigured
- FidoKeyNotFound
- FidoChallengeNotFound
- TotpChallengeNotFound
- UserExportRequestNotFound
- UserExportCiphertextNotFound
- OrgExportCiphertextNotFound
- UploadObjectNotFound
- PolicySecretNotFound
- BucketMetaNotFound
- TimestreamDisabled
- CustomChainNotFound
- InvitationNotFound
- TransactionNotFound
- EmailConfigNotFound
HttpRequestCmp:
oneOf:
- type: string
description: The requests must match exactly. Any given MFA receipt can be used at most once.
enum:
- Eq
- type: object
required:
- EvmTx
properties:
EvmTx:
$ref: '#/components/schemas/EvmTxCmp'
- type: object
required:
- SolanaTx
properties:
SolanaTx:
$ref: '#/components/schemas/SolanaTxCmp'
description: How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request])
BadGatewayErrorCode:
type: string
enum:
- Generic
- CustomChainRpcError
- EsploraApiError
- SentryApiError
- CallWebhookError
- OAuthProviderError
- OidcDisoveryFailed
- OidcIssuerJwkEndpointUnavailable
- SmtpServerUnavailable
SolanaTxCmp:
type: object
properties:
ignore_blockhash:
type: boolean
description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
InternalErrorCode:
type: string
enum:
- NoMaterialId
- InvalidAuditLogEntry
- UnexpectedCheckerRule
- UnresolvedPolicyReference
- UnexpectedAclAction
- FidoKeyAssociatedWithMultipleUsers
- ClaimsParseError
- InvalidThrottleId
- InvalidEmailAddress
- EmailTemplateRender
- OidcIdentityHeaderMissing
- OidcIdentityParseError
- SystemTimeError
- PasswordHashParseError
- SendMailError
- ReqwestError
- EmailConstructionError
- TsWriteError
- TsQueryError
- DbQueryError
- DbGetError
- DbDeleteError
- DbPutError
- DbUpdateError
- SerdeError
- TestAndSetError
- DbGetItemsError
- DbWriteError
- CubistSignerError
- CwListMetricsError
- CwPutMetricDataError
- GetAwsSecretError
- SecretNotFound
- KmsGenerateRandomError
- MalformedTotpBytes
- KmsGenerateRandomNoResponseError
- CreateKeyError
- ParseDerivationPathError
- SplitSignerError
- CreateImportKeyError
- CreateEotsNoncesError
- EotsSignError
- BabylonCovSignError
- CognitoDeleteUserError
- CognitoListUsersError
- CognitoGetUserError
- MissingUserEmail
- CognitoResendUserInvitation
- CognitoSetUserPasswordError
- GenericInternalError
- AssumeRoleWithoutEvidence
- OidcAuthWithoutOrg
- MissingKeyMetadata
- KmsEnableKeyError
- KmsDisableKeyError
- LambdaInvokeError
- LambdaNoResponseError
- LambdaFailure
- LambdaUnparsableResponse
- SerializeEncryptedExportKeyError
- DeserializeEncryptedExportKeyError
- ReEncryptUserExport
- S3UploadError
- S3DownloadError
- S3CopyError
- S3ListObjectsError
- S3DeleteObjectsError
- S3BuildError
- S3PresignedUrlError
- ManagedStateMissing
- InternalHeaderMissing
- InvalidInternalHeaderValue
- RequestLocalStateAlreadySet
- OidcOrgMismatch
- OidcIssuerInvalidJwk
- InvalidPkForMaterialId
- SegwitTweakFailed
- UncheckedOrg
- SessionOrgIdMissing
- AvaSignCredsMissing
- AvaSignSignatureMissing
- ExpectedRoleSession
- InvalidThirdPartyIdentity
- CognitoGetUser
- SnsSubscribeError
- SnsUnsubscribeError
- SnsGetSubscriptionAttributesError
- SnsSubscriptionAttributesMissing
- SnsSetSubscriptionAttributesError
- SnsPublishBatchError
- InconsistentMultiValueTestAndSet
- MaterialIdError
- InvalidBtcAddress
- HistoricalTxBodyMissing
- InvalidOperation
- ParentOrgNotFound
- OrgParentLoop
- ResolvedParentOrgWithNoScopeCeiling
- InvalidUploadObjectId
- PolicyEngineNotFound
- PolicyEngineError
- PolicySecretsEncryptionError
- CreatePolicyImportKeyError
- InvalidAlias
- EmptyUpdateModifiedObject
- EmptyUpdateModifiedActions
- DbContactAddressesInvalid
- InvalidEvmSigedRlp
- InvalidErc20Data
- InvalidRpcUrl
SignerErrorCode:
oneOf:
- $ref: '#/components/schemas/SignerErrorOwnCodes'
- $ref: '#/components/schemas/AcceptedValueCode'
- $ref: '#/components/schemas/BadRequestErrorCode'
- $ref: '#/components/schemas/BadGatewayErrorCode'
- $ref: '#/components/schemas/NotFoundErrorCode'
- $ref: '#/components/schemas/ForbiddenErrorCode'
- $ref: '#/components/schemas/UnauthorizedErrorCode'
- $ref: '#/components/schemas/PreconditionErrorCode'
- $ref: '#/components/schemas/TimeoutErrorCode'
- $ref: '#/components/schemas/ConflictErrorCode'
- $ref: '#/components/schemas/InternalErrorCode'
EvmTxCmp:
type: object
properties:
grace:
type: integer
format: int64
description: 'To prevent replay attacks, any given MFA receipt is normally allowed to be used only once.
In this case, however, because EVM transactions already have a replay prevention mechanism
(namely the ''nonce'' property), we allow the user to specify a grace period (in seconds) to
indicate how long an MFA receipt should remain valid after its first use.
Note that we allow both ''grace'' and ''ignore_nonce'' to be set because once an MFA request
enters its grace period we unconditionally set its ''ignore_nonce'' property to ''false'' to
ensure that any subsequent requests that claim the same receipt must sign for the same
nonce as the request we signed originally with that receipt.
Also note that the grace period cannot extend the lifetime of an MFA request beyond its
original expiration date.
The grace period must not be greater than 30 days.'
nullable: true
minimum: 0
ignore_gas:
type: boolean
description: Whether the 'gas' property of the EVM transaction is allowed to be different.
ignore_nonce:
type: boolean
description: Whether the 'nonce' property of the EVM transaction is allowed to be different.
EvmTxDepositErrorCode:
type: string
enum:
- EvmTxDepositReceiverMismatch
- EvmTxDepositEmptyData
- EvmTxDepositEmptyChainId
- EvmTxDepositEmptyReceiver
- EvmTxDepositUnexpectedValue
- EvmTxDepositUnexpectedDataLength
- EvmTxDepositNoAbi
- EvmTxDepositNoDepositFunction
- EvmTxDepositUnexpectedFunctionName
- EvmTxDepositUnexpectedValidatorKey
- EvmTxDepositInvalidValidatorKey
- EvmTxDepositMissingDepositArg
- EvmTxDepositWrongDepositArgType
- EvmTxDepositValidatorKeyNotInRole
- EvmTxDepositUnexpectedWithdrawalCredentials
- EvmTxDepositUnresolvedRole
- EvmTxDepositInvalidDepositEncoding
ErrorResponse:
type: object
description: The structure of ErrorResponse must match the response template that AWS uses
required:
- message
- error_code
properties:
accepted:
allOf:
- $ref: '#/components/schemas/AcceptedValue'
nullable: true
error_code:
$ref: '#/components/schemas/SignerErrorCode'
message:
type: string
description: Error message
policy_eval_tree:
description: Optional policy evaluation tree (included in signer responses, when requested)
nullable: true
request_id:
type: string
description: Optional request identifier
PreconditionErrorOwnCodes:
type: string
enum:
- FailOnMfaRequired
- KeyRegionLocked
- KeyRegionChangedRecently
- MfaRegionLocked
- Eth2ProposerSlotTooLow
- Eth2AttestationSourceEpochTooLow
- Eth2AttestationTargetEpochTooLow
- Eth2ConcurrentBlockSigning
- Eth2ConcurrentAttestationSigning
- Eth2MultiDepositToNonGeneratedKey
- Eth2MultiDepositUnknownInitialDeposit
- Eth2MultiDepositWithdrawalAddressMismatch
- ConcurrentSigningWhenTimeLimitPolicyIsDefined
- BabylonEotsConcurrentSigning
- TendermintStateError
- TendermintConcurrentSigning
- MfaApprovalsNotYetValid
ClientSessionInfo:
type: object
description: 'Session information sent to the client.
This struct works in tandem with its server-side counterpart [`SessionData`].'
required:
- session_id
- auth_token
- refresh_token
- epoch
- epoch_token
- auth_token_exp
- refresh_token_exp
properties:
auth_token:
type: string
description: Token to use for authorization.
auth_token_exp:
$ref: '#/components/schemas/EpochDateTime'
epoch:
type: integer
format: int32
description: Epoch at which the token was last refreshed
minimum: 0
epoch_token:
$ref: '#/components/schemas/B32'
refresh_token:
type: string
description: Token to use for refreshing the `(auth, refresh)` token pair
refresh_token_exp:
$ref: '#/components/schemas/EpochDateTime'
session_id:
type: string
description: Session ID
PolicyErrorOwnCodes:
type: string
enum:
- Inapplicable
- SuiTxReceiversDisallowedTransactionKind
- SuiTxReceiversDisallowedTransferAddress
- SuiTxReceiversDisallowedCommand
- BtcTxDisallowedOutputs
- BtcSignatureExceededValue
- BtcValueOverflow
- BtcSighashTypeDisallowed
- Eip7702AddressMismatch
- EvmTxReceiverMismatch
- EvmTxChainIdMismatch
- EvmTxSenderMismatch
- EvmTxExceededValue
- EvmTxExceededGasCost
- EvmTxGasCostUndefined
- EvmDataDisallowed
- Erc20DataInvalid
- EvmContractAddressUndefined
- EvmContractChainIdUndefined
- EvmDataNotDefined
- EvmDataInvalid
- EvmContractNotInAllowlist
- Erc20ExceededTransferLimit
- Erc20ReceiverMismatch
- Erc20ExceededApproveLimit
- Erc20SpenderMismatch
- EvmFunctionNotInAllowlist
- EvmFunctionCallInvalid
- EvmFunctionCallDisallowedArg
- PolicyDisjunctionError
- PolicyNegationError
- Eth2ExceededMaxUnstake
- Eth2ConcurrentUnstaking
- NotInIpv4Allowlist
- NotInOriginAllowlist
- NotInOperationAllowlist
- InvalidSourceIp
- RawSigningNotAllowed
- DiffieHellmanExchangeNotAllowed
- Eip712SigningNotAllowed
- OidcSourceNotAllowed
- NoOidcAuthSourcesDefined
- AddKeyToRoleDisallowed
- KeysAlreadyInRole
- KeyInMultipleRoles
- KeyAccessError
- RequireRoleSessionKeyAccessError
- BtcMessageSigningNotAllowed
- Eip191SigningNotAllowed
- Eip7702SigningNotAllowed
- TaprootSigningDisallowed
- SegwitSigningDisallowed
- PsbtSigningDisallowed
- BabylonStakingDisallowed
- TimeLocked
- CelPolicyDenied
- BabylonStakingNetwork
- BabylonStakingParamsVersion
- BabylonStakingExplicitParams
- BabylonStakingStakerPk
- BabylonStakingFinalityProviderPk
- BabylonStakingLockTime
- BabylonStakingValue
- BabylonStakingChangeAddress
- BabylonStakingFee
- BabylonStakingWithdrawalAddress
- BabylonStakingBbnAddress
- SolanaInstructionCountLow
- SolanaInstructionCountHigh
- SolanaNotInInstructionAllowlist
- SolanaInstructionMismatch
- WasmPoliciesDisabled
- WasmPolicyDenied
- WasmPolicyFailed
- WebhookPoliciesDisabled
- DeniedByWebhook
- ExplicitlyDenied
AcceptedValueCode:
type: string
enum:
- SignDryRun
- BinanceDryRun
- BybitDryRun
- CoinbaseDryRun
- MfaRequired
BinanceDryRunArgs:
type: object
required:
- method
- url
properties:
method:
type: string
description: The Binance API method that would have been used
url:
type: string
description: The Binance API url method that would have been called
BybitDryRunArgs:
type: object
required:
- method
- url
- payload
properties:
method:
type: string
description: The Bybit API method that would have been used
payload:
type: string
description: The request body (for POST endpoints) or query string (for GET endpoints).
url:
type: string
description: The Bybit API url that would have been called
CoinbaseDryRunArgs:
type: object
required:
- method
- url
properties:
method:
type: string
description: The Coinbase API method that would have been used
url:
type: string
description: The Coinbase API url method that would have been called
SignDryRunArgs:
type: object
required:
- mfa_requests
properties:
mfa_requests:
type: array
items:
$ref: '#/components/schemas/MfaRequestInfo'
description: Whether MFA is required
policy_eval_tree:
description: Optional policy evaluation tree, if requested
nullable: true
Id:
type: string
MfaType:
type: string
format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
description: Different types that can be used to approve an MFA request
pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
PolicyErrorCode:
oneOf:
- $ref: '#/components/schemas/PolicyErrorOwnCodes'
- $ref: '#/components/schemas/EvmTxDepositErrorCode'
MfaRequestInfo:
type: object
description: Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp').
required:
- id
- expires_at
- request
- status
- created_by
- provenance
properties:
created_at:
$ref: '#/components/schemas/EpochDateTime'
created_by:
type: string
description: The session identity (user or role) that created this request.
expires_at:
$ref: '#/components/schemas/EpochDateTime'
id:
type: string
description: Approval request ID.
not_valid_until:
$ref: '#/components/schemas/EpochDateTime'
provenance:
type: string
description: MFA policy provenance
enum:
- Org
- Key
- KeyInRole
- Role
- User
- EditPolicy
receipt:
allOf:
- $ref: '#/components/schemas/Receipt'
nullable: true
region:
type: string
description: The region this MFA request was created in. It can only be redeemed from the same region.
related_ids:
type: array
items:
type: string
description: 'If set, contains the IDs of all MFA requests (including this one!) that
were generated at once for the same CubeSigner operation.
If not set, it means that this was the lone MFA request generated for `request`.
This is useful so that a client can discover all the MFAs whose receipts must
be submitted together to carry out the original CubeSigner operation.'
request:
$ref: '#/components/schemas/HttpRequest'
status:
$ref: '#/components/schemas/Status'
BadRequestErrorCode:
type: string
enum:
- GenericBadRequest
- DisallowedAllowRuleReference
- InvalidPaginationToken
- InvalidEmail
- InvalidEmailTemplate
- QueryMetricsError
- InvalidTelegramData
- ValidationError
- WebhookPolicyTimeoutOutOfBounds
- WebhookPolicyDisallowedUrlScheme
- WebhookPolicyDisallowedUrlHost
- WebhookPolicyDisallowedHeaders
- ReservedName
- UserEmailNotConfigured
- EmailPasswordNotFound
- PasswordAuthNotAllowedByInvitation
- OneTimeCodeExpired
- InvalidBody
- InvalidJwt
- InvitationNoLongerValid
- TokenRequestError
- InvalidMfaReceipt
- InvalidMfaPolicyCount
- InvalidMfaPolicyNumAuthFactors
- InvalidMfaPolicyNumAllowedApprovers
- InvalidMfaPolicyGracePeriodTooLong
- InvalidBabylonStakingPolicyParams
- InvalidSuiTxReceiversEmptyAllowlist
- InvalidBtcTxReceiversEmptyAllowlist
- InvalidRequireRoleSessionAllowlist
- InvalidCreateKeyCount
- InvalidDiffieHellmanCount
- OrgInviteExistingUser
- OrgUserAlreadyExists
- OrgNameTaken
- KwkNotFoundInRegion
- OrgIsNotOrgExport
- RoleNameTaken
- PolicyNameTaken
- NameTaken
- ContactNameInvalid
- ContactAddressesInvalid
- ContactLabelInvalid
- ContactModified
- PolicyNotFound
- PolicyVersionNotFound
- PolicyRuleDisallowedByType
- PolicyTypeDisallowed
- PolicyDuplicateError
- PolicyStillAttached
- PolicyModified
- PolicyNotAttached
- AddKeyToRoleCountTooHigh
- InvalidKeyId
- InvalidTimeLockAlreadyInThePast
- InvalidRestrictedScopes
- InvalidUpdate
- InvalidMetadataLength
- InvalidLength
- InvalidKeyMaterialId
- KeyNotFound
- SiweChallengeNotFound
- SiweInvalidRequest
- SiwsChallengeNotFound
- SiwsInvalidRequest
- UserExportDerivedKey
- UserExportPublicKeyInvalid
- NistP256PublicKeyInvalid
- UnableToAccessSmtpRelay
- UserExportInProgress
- RoleNotFound
- InvalidRoleNameOrId
- InvalidMfaReceiptOrgIdMissing
- InvalidMfaReceiptInvalidOrgId
- MfaRequestNotFound
- InvalidKeyType
- InvalidPropertiesForKeyType
- MismatchedKeyPropertiesPatch
- MissingBinanceApiKey
- MissingBybitApiKey
- MissingCoinbaseApiKey
- BinanceKeyMasterMismatch
- BybitAccountMismatch
- InvalidKeyMaterial
- InvalidHexValue
- InvalidBase32Value
- InvalidBase58Value
- InvalidBase64Value
- InvalidSs58Value
- InvalidForkVersionLength
- InvalidEthAddress
- InvalidStellarAddress
- InvalidOrgNameOrId
- InvalidUpdateOrgRequestDisallowedMfaType
- InvalidUpdateOrgRequestEmptyAllowedMfaTypes
- EmailOtpDelayTooShortForRegisterMfa
- InvalidStakeDeposit
- InvalidBlobSignRequest
- InvalidDiffieHellmanRequest
- InvalidSolanaSignRequest
- InvalidEip712SignRequest
- InvalidEip7702SignRequest
- OnlySpecifyOne
- IncompatibleParams
- NoOidcDataInProof
- InvalidEvmSignRequest
- InvalidEth2SignRequest
- InvalidDeriveKeyRequest
- InvalidStakingAmount
- CustomStakingAmountNotAllowedForWrapperContract
- InvalidUnstakeRequest
- InvalidCreateUserRequest
- UserAlreadyExists
- IdpUserAlreadyExists
- CognitoUserAlreadyOrgMember
- UserNotFound
- UserWithEmailNotFound
- PolicyKeyMismatch
- EmptyScopes
- InvalidScopesForRoleSession
- InvalidLifetime
- NoSingleKeyForUser
- InvalidOrgPolicyRule
- SourceIpAllowlistEmpty
- LimitWindowTooLong
- Erc20ContractDisallowed
- EmptyRuleError
- PolicyFieldValidationError
- OptionalListEmpty
- MultipleExclusiveFieldsProvided
- DuplicateFieldEntry
- InvalidRange
- InvalidOrgPolicyRepeatedRule
- InvalidSuiTransaction
- SuiSenderMismatch
- AvaSignHashError
- AvaSignError
- BtcSegwitHashError
- BtcTaprootHashError
- BtcSignError
- TaprootSignError
- Eip712SignError
- InvalidMemberRoleInUserAdd
- InvalidMemberRoleInRecipientAdd
- ThirdPartyUserAlreadyExists
- OidcIdentityAlreadyExists
- UserAlreadyHasIdentity
- ThirdPartyUserNotFound
- DeleteOidcUserError
- DeleteUserError
- SessionRoleMismatch
- InvalidOidcToken
- InvalidOidcIdentity
- OidcIssuerUnsupported
- OidcIssuerNotAllowed
- OidcIssuerNoApplicableJwk
- FidoKeyAlreadyRegistered
- FidoKeySignCountTooLow
- FidoVerificationFailed
- FidoChallengeMfaMismatch
- UnsupportedLegacyCognitoSession
- InvalidIdentityProof
- PaginationDataExpired
- ExistingKeysViolateExclusiveKeyAccess
- ExportDelayTooShort
- ExportWindowTooLong
- InvalidTotpFailureLimit
- InvalidEip191SignRequest
- CannotResendUserInvitation
- InvalidNotificationEndpointCount
- CannotDeletePendingSubscription
- InvalidNotificationUrlProtocol
- EmptyOneOfOrgEventFilter
- EmptyAllExceptOrgEventFilter
- InvalidTapNodeHash
- InvalidOneTimeCode
- MessageNotFound
- MessageAlreadySigned
- MessageRejected
- MessageReplaced
- InvalidMessageType
- EmptyAddress
- InvalidEth2SigningPolicySlotRange
- InvalidEth2SigningPolicyEpochRange
- InvalidEth2SigningPolicyTimestampRange
- InvalidEth2SigningPolicyOverlappingRule
- RpcUrlMissing
- MmiChainIdMissing
- EthersInvalidRpcUrl
- EthersGetTransactionCountError
- InvalidPassword
- BabylonStakingFeePlusDustOverflow
- BabylonStaking
- BabylonStakingIncorrectKey
- BabylonStakingSegwitNonDeposit
- BabylonStakingRegistrationRequiresTaproot
- PsbtSigning
- TooManyResets
- TooManyRequests
- TooManyFailedLogins
- BadBtcMessageSignP2shFlag
- InvalidTendermintRequest
- PolicyVersionMaxReached
- PolicyVersionInvalid
- PolicySecretLimitReached
- PolicySecretTooLarge
- InvalidImportKey
- AlienOwnerInvalid
- EmptyUpdateRequest
- InvalidPolicyReference
- PolicyEngineDisabled
- InvalidWasmPolicy
- CelProgramTooLarge
- InvalidPolicy
- RedundantDerivationPath
- ImportKeyMissing
- InvalidAbiMethods
- BabylonCovSign
- InvalidPolicyLogsRequest
- UserProfileMigrationMultipleEntries
- UserProfileMigrationTooManyItems
- InputTooShort
- InvalidTweakLength
- InvalidCustomChains
- InvalidRpcRequest
SignerErrorOwnCodes:
type: string
enum:
- PreComputed
- StatusCodeWithMessage
- JrpcError
- UnhandledError
- ProxyStartError
- EnclaveError
- PolicyErrorWithEvalTree
- RpcApi
PreconditionErrorCode:
oneOf:
- $ref: '#/components/schemas/PreconditionErrorOwnCodes'
- $ref: '#/components/schemas/PolicyErrorCode'
NewSessionResponse:
type: object
description: Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.).
required:
- org_id
- token
- refresh_token
- session_info
properties:
expiration:
type: integer
format: int64
description: Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed.
example: 1701879640
minimum: 0
org_id:
$ref: '#/components/schemas/Id'
refresh_token:
type: string
description: Token that can be used to refresh this session.
session_info:
$ref: '#/components/schemas/ClientSessionInfo'
token:
type: string
description: 'New token to be used for authentication. Requests to signing endpoints
should include this value in the `Authorization` header.'
HttpRequest:
type: object
description: 'Information about the request.
Captures all the relevant info (including the request body) about requests that require MFA.
We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)
it is exactly the same as it originally was.'
required:
- method
- path
properties:
body:
type: object
description: HTTP request body
nullable: true
method:
type: string
description: HTTP method of the request
path:
type: string
description: HTTP path of the request, excluding the host
ApprovalInfo:
type: object
required:
- timestamp
properties:
timestamp:
$ref: '#/components/schemas/EpochDateTime'
Receipt:
type: object
description: Receipt that an MFA request was approved.
required:
- confirmation
- final_approver
- timestamp
properties:
confirmation:
type: string
description: Confirmation code the user needs to present when resuming the original request.
example: ba1d75dd-d999-4c1b-944d-25c25440c8af
final_approver:
type: string
description: The ID of the logged-in user whose action created this approval.
timestamp:
$ref: '#/components/schemas/EpochDateTime'
UnauthorizedErrorCode:
type: string
enum:
- AuthorizationHeaderMissing
- EndpointRequiresUserSession
- RefreshTokenMissing
AcceptedResponse:
allOf:
- $ref: '#/components/schemas/ErrorResponse'
- type: object
TimeoutErrorCode:
type: string
enum:
- PolicyEngineTimeout
- WasmPolicyExecutionTimeout
ForbiddenErrorCode:
type: string
enum:
- AlienKeyCreate
- CannotAssumeIdentity
- SentryDisallowed
- PasskeyLogin
# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-users-in-role-api-openapi.yml