/** * This file was auto-generated by openapi-typescript. * Do not make direct changes to the file. */ /** OneOf type helpers */ type Without = { [P in Exclude]?: never; }; type XOR = T | U extends object ? (Without & U) | (Without & T) : T | U; type OneOf = T extends [infer Only] ? Only : T extends [infer A, infer B, ...infer Rest] ? OneOf<[XOR, ...Rest]> : never; export interface paths { "/v0/about_me": { /** * User Info * @description User Info * * Retrieves information about the current user. */ get: operations["aboutMeLegacy"]; }; "/v0/org/{org_id}": { /** * Get Org * @description Get Org * * Retrieves information about an organization. */ get: operations["getOrg"]; /** * Update Org * @description Update Org * * Update organization attributes (enabled flag, name, and policies). */ patch: operations["updateOrg"]; }; "/v0/org/{org_id}/ava/sign/{ava_chain}/{pubkey}": { /** * Sign a serialized Avalanche C/X/P-Chain Message * @description Sign a serialized Avalanche C/X/P-Chain Message * * Signs an Avalanche message with a given SecpEth (C-Chain messages) or * SecpAva (X- and P-Chain messages) key. Currently signing C-Chain messages * with SecpEth key must also be explicitly allowed via `AllowRawBlobSigning` * policy. * * This is a pre-release feature. */ post: operations["avaSerializedTxSign"]; }; "/v0/org/{org_id}/ava/sign/{pubkey}": { /** * Sign JSON-encoded Avalanche X- or P-Chain Message * @description Sign JSON-encoded Avalanche X- or P-Chain Message * * Signs an Avalanche message with a given SecpAva key. * This is a pre-release feature. */ post: operations["avaSign"]; }; "/v0/org/{org_id}/babylon/eots/nonces/{pubkey}": { /** * Create EOTS nonces * @description Create EOTS nonces * * Generates a set of Babylon EOTS nonces for a specified chain-id, starting at a * specified block height. */ post: operations["createEotsNonces"]; }; "/v0/org/{org_id}/babylon/eots/sign/{pubkey}": { /** * Create an EOTS signature * @description Create an EOTS signature * * Generates an EOTS signature for the specified chain-id, block height, and message. */ post: operations["eotsSign"]; }; "/v0/org/{org_id}/btc/sign/{pubkey}": { /** * Sign Bitcoin Segwit Transaction * @description Sign Bitcoin Segwit Transaction * * Signs a Bitcoin Segwit transaction with a given key. * This is a pre-release feature. */ post: operations["btcSign"]; }; "/v0/org/{org_id}/btc/taproot/sign/{pubkey}": { /** * Sign Bitcoin Taproot Transaction * @description Sign Bitcoin Taproot Transaction * * Signs a Bitcoin Taproot transaction with a given key. * This is a pre-release feature. */ post: operations["btcTaprootSign"]; }; "/v0/org/{org_id}/derive_key": { /** * Derive Key From Long-Lived Mnemonic * @description Derive Key From Long-Lived Mnemonic * * Derives a key of a specified type using a supplied derivation path and an * existing long-lived mnemonic. */ put: operations["deriveKey"]; }; "/v0/org/{org_id}/emails/otp": { put: operations["setEmailOtp"]; }; "/v0/org/{org_id}/evm/eip191/sign/{pubkey}": { /** * Sign EIP-191 Data * @description Sign EIP-191 Data * * Signs a message using EIP-191 personal_sign with a given Secp256k1 key. */ post: operations["eip191Sign"]; }; "/v0/org/{org_id}/evm/eip712/sign/{pubkey}": { /** * Sign EIP-712 Typed Data * @description Sign EIP-712 Typed Data * * Signs typed data according to EIP-712 with a given Secp256k1 key. */ post: operations["eip712Sign"]; }; "/v0/org/{org_id}/identity": { /** * List associated OIDC identities with the current user. * @description List associated OIDC identities with the current user. */ get: operations["listOidcIdentities"]; /** * Associate an OIDC identity with the current user in org . * @description Associate an OIDC identity with the current user in org . */ post: operations["addOidcIdentity"]; /** * Remove an OIDC identity from the current user's account in org . * @description Remove an OIDC identity from the current user's account in org . */ delete: operations["removeOidcIdentity"]; }; "/v0/org/{org_id}/identity/prove": { /** * Create [IdentityProof] from CubeSigner user session * @description Create [IdentityProof] from CubeSigner user session * * This route can be used to prove to another party that a user has a * valid CubeSigner session. * * Clients are intended to call this route and pass the returned evidence * to another service which will verify it by making a request to `/v0/org//identity/verify`. */ post: operations["createProofCubeSigner"]; }; "/v0/org/{org_id}/identity/prove/oidc": { /** * Create [IdentityProof] from OIDC token * @description Create [IdentityProof] from OIDC token * * Exchange an OIDC ID token (passed via the `Authorization` header) for a proof of authentication. * * This route can be used to prove to another party that a user has met the * authentication requirements (allowed issuers & audiences) for CubeSigner * without leaking their credentials. * * Clients are intended to call this route and pass the returned evidence to another service * which will verify it by making a request to `/v0/org//identity/verify`. */ post: operations["createProofOidc"]; }; "/v0/org/{org_id}/identity/verify": { /** * Verify identity proof * @description Verify identity proof * * Allows a third-party to validate proof of authentication. * * When a third-party is provided an [IdentityProof] object, they must check its * veracity by calling this endpoint */ post: operations["verifyProof"]; }; "/v0/org/{org_id}/import_key": { /** * Create Key-Import Key * @description Create Key-Import Key * * Generate an ephemeral key that a client can use for key-import encryption. */ get: operations["createKeyImportKey"]; /** * Import Key * @description Import Key * * Securely imports an existing key using a previously generated key-import key. */ put: operations["importKey"]; }; "/v0/org/{org_id}/invite": { /** * Invite User * @description Invite User * * Creates a new user in an existing org and sends that user an invite email. */ post: operations["invite"]; }; "/v0/org/{org_id}/keys": { /** * List Keys * @description List Keys * * Gets the list of owned keys in a given org. */ get: operations["listKeysInOrg"]; /** * Create Key * @description Create Key * * Creates one or more new keys of the specified type. */ post: operations["createKey"]; }; "/v0/org/{org_id}/keys/{key_id}": { /** * Get Key * @description Get Key * * Returns the properties of a key. */ get: operations["getKeyInOrg"]; /** * Delete Key * @description Delete Key * * Deletes a key specified by its ID. * * Only the key owner and org owners are allowed to delete keys. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["deleteKey"]; /** * Update Key * @description Update Key * * Enable or disable a key. The user must be the owner of the key or * organization to perform this action. * * For each requested update, the session must have the corresponding 'manage:key:update:_' scope; * if no updates are requested, the session must have 'manage:key:get'. */ patch: operations["updateKey"]; }; "/v0/org/{org_id}/keys/{key_id}/roles": { /** * List Key Roles * @description List Key Roles * * Get all roles the key is in */ get: operations["listKeyRoles"]; }; "/v0/org/{org_id}/mfa": { /** * List Pending MFA Requests * @description List Pending MFA Requests * * Retrieves and returns all pending MFA requests that are accessible to the current user, * i.e., those in which the current user is listed as an approver */ get: operations["mfaList"]; }; "/v0/org/{org_id}/mfa/{mfa_id}": { /** * Get Pending MFA Request * @description Get Pending MFA Request * * Retrieves and returns a pending MFA request by its id. */ get: operations["mfaGet"]; /** * Approve or Reject MFA Request * @description Approve or Reject MFA Request * * Approve or reject request after logging in with CubeSigner. * * If approving, adds the currently-logged user as an approver * of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of * approvers is reached, the MFA request is approved; the confirmation receipt can be used to * resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteCs"]; }; "/v0/org/{org_id}/mfa/{mfa_id}/fido": { /** * Initiate a FIDO MFA Approval/Rejection * @description Initiate a FIDO MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using FIDO. */ post: operations["mfaFidoInit"]; /** * Finalize a FIDO MFA Approval/Rejection * @description Finalize a FIDO MFA Approval/Rejection * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteFidoComplete"]; }; "/v0/org/{org_id}/mfa/{mfa_id}/totp": { /** * Approve/Reject a TOTP MFA Request * @description Approve/Reject a TOTP MFA Request * * If approving, adds the current user as approver to a pending MFA request by * providing TOTP code. If the required number of approvers is reached, the MFA request is * approved; the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteTotp"]; }; "/v0/org/{org_id}/oauth2/twitter": { /** * Mint an OIDC ID token for Twitter * @description Mint an OIDC ID token for Twitter * * This function acts identically to Twitter's [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint, * but extends the output with an `id_token`. * * This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token. * * > [!IMPORTANT] * > This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter. */ post: operations["oauth2Twitter"]; }; "/v0/org/{org_id}/oidc": { /** * Login with OIDC * @description Login with OIDC * * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session. * * MFA is required when: * - an MFA policy is explicitly attached to the user logging in * (e.g., an org owner can do that at user creation time to require certain kind of MFA) * - the user has at least 1 MFA factor configured */ post: operations["oidcAuth"]; }; "/v0/org/{org_id}/oidc/email-otp": { /** * Initiate login via email token * @description Initiate login via email token * * This endpoint sends an email to the provided address with an OIDC token encrypted with AES-GCM. * The decryption parameters are returned immediately in the response. * Once that token is decrypted, it can be used with the standard OIDC authentication flows * * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID * > 2. Have an email sender configured for OTPs */ post: operations["emailOtpAuth"]; }; "/v0/org/{org_id}/roles": { /** * List Roles * @description List Roles * * Retrieves all roles in an organization that the current user is allowed to access. */ get: operations["listRoles"]; /** * Create Role * @description Create Role * * Creates a new role in an organization. Unless the logged-in user * is the owner, they are automatically added to the newly created role. */ post: operations["createRole"]; }; "/v0/org/{org_id}/roles/{role_id}": { /** * Get Role * @description Get Role * * Retrieves information about a role in an organization */ get: operations["getRole"]; /** * Delete Role * @description Delete Role * * Deletes a role in an organization. * * Only users in the role can perform this action. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["deleteRole"]; /** * Update Role * @description Update Role * * Enables or disables a role (this requires the `manage:role:update:enable` scope). * Updates the role's policies (this requires the `manage:role:update:policy` scope). * * The user must be in the role or an owner of the organization. * Additionally, the role's edit policy (if set) must permit the update. */ patch: operations["updateRole"]; }; "/v0/org/{org_id}/roles/{role_id}/add_keys": { /** * Add Keys * @description Add Keys * * Adds a list of existing keys to an existing role. * * Only the key owner can their key to a role. * Additionally, the role's edit policy (if set) must permit the update. */ put: operations["addKeysToRole"]; }; "/v0/org/{org_id}/roles/{role_id}/add_user/{user_id}": { /** * Add User * @description Add User * * Adds an existing user to an existing role. * * Only users in the role or org owners can add users to a role. * Additionally, the role's edit policy (if set) must permit the update. */ put: operations["addUserToRole"]; }; "/v0/org/{org_id}/roles/{role_id}/keys": { /** * List Role Keys * @description List Role Keys * * Returns an array of all keys in a role. */ get: operations["listRoleKeys"]; }; "/v0/org/{org_id}/roles/{role_id}/keys/{key_id}": { /** * Remove Key * @description Remove Key * * Removes a given key from a role. * * Only users in the role or org owners can remove keys from a role. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["removeKeyFromRole"]; }; "/v0/org/{org_id}/roles/{role_id}/tokens": { /** * List a single page of Tokens (Deprecated) * @deprecated * @description List a single page of Tokens (Deprecated) * * **Deprecated**: Use `GET /org/{org_id}/session?role=` * * Returns all access tokens for a given role. * Only users in the role or owners can create a token for it. */ get: operations["listRoleTokens"]; /** * Create Token * @description Create Token * * Creates a new access token for a given role (to be used as "API Key" for all signing actions). * Only users in the role or owners can create a token for it. */ post: operations["createRoleToken"]; /** * Revoke All Tokens (Deprecated) * @deprecated * @description Revoke All Tokens (Deprecated) * * **Deprecated**: Use `DELETE /org/{org_id}/session?role=` instead * * Revokes all access tokens associated with a role. * Only users in the role or owners can perform this action. */ delete: operations["revokeAllRoleTokens"]; }; "/v0/org/{org_id}/roles/{role_id}/tokens/{session_id}": { /** * Revoke Token (Deprecated) * @deprecated * @description Revoke Token (Deprecated) * * **Deprecated**: Use `DELETE /org/{org_id}/session/{session_id}` * * Revokes an access token associated with a role. * Only users in the role or owners can perform this action. */ delete: operations["revokeRoleToken"]; }; "/v0/org/{org_id}/roles/{role_id}/users": { /** * List Role Users. * @description List Role Users. * * Returns an array of all users who have access to a role. */ get: operations["listRoleUsers"]; }; "/v0/org/{org_id}/roles/{role_id}/users/{user_id}": { /** * Remove User * @description Remove User * * Removes an existing user from an existing role. * * Only users in the role or org owners can remove users from a role. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["removeUserFromRole"]; }; "/v0/org/{org_id}/session": { /** * List sessions * @description List sessions * * If no query parameters are provided, information for the current session is returned */ get: operations["listSessions"]; /** * Create new user session (management and/or signing) * @description Create new user session (management and/or signing) * * Creates a new user session, silently truncating requested session and auth lifetimes * to be at most requestor's session and auth lifetime, respectively. */ post: operations["createSession"]; /** * Revoke existing session(s) * @description Revoke existing session(s) * * Immediately revokes existing sessions, preventing them from being used or refreshed. * If no query params are provided, the current session is revoked. */ delete: operations["revokeSessions"]; }; "/v0/org/{org_id}/session/self": { /** * Revoke current session * @description Revoke current session * * Immediately revokes the current session, preventing it from being used or refreshed */ delete: operations["revokeCurrentSession"]; }; "/v0/org/{org_id}/session/{session_id}": { /** * Get session information * @description Get session information */ get: operations["getSession"]; /** * Revoke a session * @description Revoke a session * * Immediately revokes an existing session, preventing it from being used or refreshed */ delete: operations["revokeSession"]; }; "/v0/org/{org_id}/solana/sign/{pubkey}": { /** * Sign Solana Message * @description Sign Solana Message * * Signs a Solana message with a given key. * This is a pre-release feature. */ post: operations["solanaSign"]; }; "/v0/org/{org_id}/token/keys": { /** * Get Token-Accessible Keys * @description Get Token-Accessible Keys * * Retrieves the keys that the role token can access. */ get: operations["listTokenKeys"]; }; "/v0/org/{org_id}/user/me": { /** * User Info * @description User Info * * Retrieves information about the current user. */ get: operations["aboutMe"]; }; "/v0/org/{org_id}/user/me/export": { /** * List outstanding user-export requests * @description List outstanding user-export requests */ get: operations["userExportList"]; /** * Initiate a user-export request * @description Initiate a user-export request * * This starts a delay (whose length is determined by Org-wide settings) * before export can be completed, and returns a ticket that can be used * to complete the export once the timer has expired. * * Only one user-export request can be active for a given key. If there * is already an active export, this endpoint will return an error. To * create a new request, first delete the existing one. */ post: operations["userExportInit"]; /** * Delete an existing user-export request * @description Delete an existing user-export request */ delete: operations["userExportDelete"]; /** * Complete a user-export request * @description Complete a user-export request * * This endpoint can be called only after initiating a user-export request via * the `user_export_init` API, and only within the subsequent export window * (i.e., after the export delay has passed and before the request has expired). * * To check on the status of an export request, see the `user_export_list` API. */ patch: operations["userExportComplete"]; }; "/v0/org/{org_id}/user/me/fido": { /** * Initiate registration of a FIDO key * @description Initiate registration of a FIDO key * * Generates a challenge that must be answered to prove ownership of a key */ post: operations["userRegisterFidoInit"]; /** * Finalize registration of a FIDO key * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ patch: operations["userRegisterFidoComplete"]; }; "/v0/org/{org_id}/user/me/fido/{fido_id}": { /** * Delete FIDO key * @description Delete FIDO key * * Deletes a FIDO key from the user's account (if the key is not the sole MFA factor). MFA is always required. */ delete: operations["userDeleteFido"]; }; "/v0/org/{org_id}/user/me/totp": { /** * Initialize TOTP Reset * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ post: operations["userResetTotpInit"]; /** * Delete TOTP * @description Delete TOTP * * Deletes TOTP from the user's account (if TOTP is not the sole MFA factor). MFA is always required. */ delete: operations["userDeleteTotp"]; /** * Finalize resetting TOTP * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ patch: operations["userResetTotpComplete"]; }; "/v0/org/{org_id}/user/me/totp/verify": { /** * Verify TOTP * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ post: operations["userVerifyTotp"]; }; "/v0/org/{org_id}/users": { /** * List users in organization * @description List users in organization */ get: operations["listUsersInOrg"]; /** * Add a third-party user to the org * @description Add a third-party user to the org */ post: operations["createOidcUser"]; }; "/v0/org/{org_id}/users/oidc": { /** * Remove a third-party user from the org * @description Remove a third-party user from the org */ delete: operations["deleteOidcUser"]; }; "/v0/org/{org_id}/users/{user_id}": { /** * Remove a user from the org * @description Remove a user from the org */ delete: operations["deleteUser"]; }; "/v0/org/{org_id}/users/{user_id}/membership": { /** * Update a user's membership in the org * @description Update a user's membership in the org * * Currently allows just enabling/disabling a user in the org. */ patch: operations["updateUserMembership"]; }; "/v0/user/me/fido": { /** * Initiate registration of a FIDO key * @deprecated * @description Initiate registration of a FIDO key * * Generates a challenge that must be answered to prove ownership of a key */ post: operations["registerFidoInitLegacy"]; /** * Finalize registration of a FIDO key * @deprecated * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ patch: operations["registerFidoCompleteLegacy"]; }; "/v0/user/me/totp": { /** * Initialize TOTP Reset * @deprecated * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ post: operations["resetTotpInitLegacy"]; /** * Finalize resetting TOTP * @deprecated * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ patch: operations["resetTotpCompleteLegacy"]; }; "/v0/user/me/totp/verify": { /** * Verify TOTP * @deprecated * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ post: operations["verifyTotpLegacy"]; }; "/v0/user/orgs": { /** * Retrieves all the orgs the user is a part of * @description Retrieves all the orgs the user is a part of */ get: operations["userOrgs"]; }; "/v1/org/{org_id}/blob/sign/{key_id}": { /** * Sign Raw Blob * @description Sign Raw Blob * * Signs an arbitrary blob with a given key. * * - ECDSA signatures are serialized as big-endian r and s plus recovery-id * byte v, which can in general take any of the values 0, 1, 2, or 3. * * - EdDSA signatures are serialized in the standard format. * * - BLS signatures are not supported on the blob-sign endpoint. */ post: operations["blobSign"]; }; "/v1/org/{org_id}/cube3signer/heartbeat": { /** * Record heartbeat * @description Record heartbeat * * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch. */ post: operations["cube3signerHeartbeat"]; }; "/v1/org/{org_id}/eth1/sign/{pubkey}": { /** * Sign EVM Transaction * @description Sign EVM Transaction * * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key. * Returns an RLP-encoded transaction with EIP-155 signature. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["eth1Sign"]; }; "/v1/org/{org_id}/eth2/sign/{pubkey}": { /** * Sign Validator Request * @description Sign Validator Request * * Signs an eth2 validator request with a given BLS key. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["eth2Sign"]; }; "/v1/org/{org_id}/eth2/stake": { /** * Sign Stake Deposit * @description Sign Stake Deposit * * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the * provided validator key. Otherwise, we generate a new BLS key. * * When using a pregenerated key, the key must be associated with the role and organization on whose * behalf this action is called. */ post: operations["stake"]; }; "/v1/org/{org_id}/eth2/unstake/{pubkey}": { /** * Sign Unstake Request * @description Sign Unstake Request * * Handle unstaking request, producing a signed voluntary exit message * that can be posted directly to the Beacon chain. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["unstake"]; }; "/v1/org/{org_id}/token/refresh": { /** * Refresh Signer Session * @description Refresh Signer Session */ patch: operations["signerSessionRefresh"]; }; } export type webhooks = Record; export interface components { schemas: { AcceptedResponse: components["schemas"]["ErrorResponse"] & Record; /** * @description Different responses we return for status code "202 Accepted". * * Even though "202 Accepted" is a successful response, we represent * it as a Rust error because that makes it easy to have route handlers * return `Result` where `T` is the type of the * response for the status code "200 Ok". */ AcceptedValue: { MfaRequired: { /** @description MFA request id */ id: string; /** @description Organization id */ org_id: string; session?: components["schemas"]["NewSessionResponse"] | null; }; }; /** @enum {string} */ AcceptedValueCode: "MfaRequired"; /** @description Request to add OIDC identity to an existing user account */ AddIdentityRequest: { oidc_token: string; }; AddKeysToRoleRequest: { /** * @description A list of keys to add to a role * @example [ * "Key#63023a27-1e70-430a-b293-ffbc9d6c4484" * ] */ key_ids: string[]; /** * @description Optional policies to apply for each key * @example [ * { * "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa" * }, * { * "TxDeposit": { * "kind": "Canonical" * } * }, * { * "RequireMfa": { * "kind": { * "RequiredApprovers": { * "count": 1 * } * }, * "restricted_operations": [ * "Eth1Sign", * "BlobSign" * ] * } * } * ] */ policy?: Record[] | null; }; AddThirdPartyUserRequest: { /** * @description Optional user email * @example alice@example.com */ email?: string | null; identity: components["schemas"]["OidcIdentity"]; /** @description Optional login MFA policy */ mfa_policy?: Record | null; /** * @description Optional user full name * @example Alice Wonderland */ name?: string | null; role: components["schemas"]["MemberRole"]; }; AddThirdPartyUserResponse: { /** @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; ApprovalInfo: { timestamp: components["schemas"]["EpochDateTime"]; }; /** * @description WebAuthn Relying Parties may use AttestationConveyancePreference to specify * their preference regarding attestation conveyance during credential * generation. * * https://www.w3.org/TR/webauthn-2/#enumdef-attestationconveyancepreference * @enum {string} */ AttestationConveyancePreference: "none" | "indirect" | "direct" | "enterprise"; /** @description Data required for both `authenticate` and `refresh`. */ AuthData: { /** Format: int32 */ epoch_num: number; epoch_token: components["schemas"]["B32"]; other_token: string; }; /** * @description Represents the assertion response used by clients when attempting to log in with a known credential * https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse */ AuthenticatorAssertionResponse: { /** * @description Contains the standard CTAP2 authenticator data. Must be a valid [`AuthenticatorData`]. * This contains information about how key was invoked. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-authenticatordata */ authenticatorData: string; /** * @description Contains UTF8 encoded JSON which must be a valid [`ClientData`] * This data is combined with `authenticator_data` to produce the signature * meaning the client attests to the correctness of this data. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorresponse-clientdatajson */ clientDataJSON: string; /** * @description The signature of the concatenated `authenticatorData || hash` where * `hash` is the SHA256 hash of the `clientDataJSON` buffer: * * Field Definition: https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-signature * Step 11 of `getAssertion` specifies the concatenation: https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion * Requirement for SHA-256: https://www.w3.org/TR/webauthn-2/#collectedclientdata-hash-of-the-serialized-client-data */ signature: string; /** * @description Allows the authenticator to optionally declare the credential identifier they used. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-userhandle */ userHandle?: string | null; }; /** * @description This enumeration’s values describe authenticators' attachment modalities. * Relying Parties use this to express a preferred authenticator attachment * modality when calling navigator.credentials.create() to create a credential. * * https://www.w3.org/TR/webauthn-2/#enumdef-authenticatorattachment * @enum {string} */ AuthenticatorAttachment: "platform" | "cross-platform"; /** * @description The AuthenticatorAttestationResponse interface represents the authenticator's * response to a client’s request for the creation of a new public key * credential. It contains information about the new credential that can be * used to identify it for later use, and metadata that can be used by the * WebAuthn Relying Party to assess the characteristics of the credential * during registration. * * https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse */ AuthenticatorAttestationResponse: { /** * @description This attribute contains an attestation object, which is opaque to, and * cryptographically protected against tampering by, the client. The * attestation object contains both authenticator data and an attestation * statement. The former contains the AAGUID, a unique credential ID, and * the credential public key. The contents of the attestation statement are * determined by the attestation statement format used by the * authenticator. It also contains any additional information that the * Relying Party's server requires to validate the attestation statement, * as well as to decode and validate the authenticator data along with the * JSON-compatible serialization of client data. For more details, see * § 6.5 Attestation, § 6.5.4 Generating an Attestation Object, and Figure * 6. */ attestationObject: string; /** * @description This attribute, inherited from AuthenticatorResponse, contains the * JSON-compatible serialization of client data (see § 6.5 Attestation) * passed to the authenticator by the client in order to generate this * credential. The exact JSON serialization MUST be preserved, as the hash * of the serialized client data has been computed over it. */ clientDataJSON: string; }; /** * @description WebAuthn Relying Parties may use the AuthenticatorSelectionCriteria * dictionary to specify their requirements regarding authenticator * attributes. * * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria */ AuthenticatorSelectionCriteria: { authenticatorAttachment?: components["schemas"]["AuthenticatorAttachment"] | null; /** * @description This member is retained for backwards compatibility with WebAuthn Level * 1 and, for historical reasons, its naming retains the deprecated * “resident” terminology for discoverable credentials. Relying Parties * SHOULD set it to true if, and only if, residentKey is set to required. * * https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-requireresidentkey */ requireResidentKey?: boolean; residentKey?: components["schemas"]["ResidentKeyRequirement"] | null; userVerification?: components["schemas"]["UserVerificationRequirement"]; }; /** * @description Authenticators may implement various transports for communicating with * clients. This enumeration defines hints as to how clients might communicate * with a particular authenticator in order to obtain an assertion for a * specific credential. Note that these hints represent the WebAuthn Relying * Party's best belief as to how an authenticator may be reached. A Relying * Party will typically learn of the supported transports for a public key * credential via getTransports(). * * https://www.w3.org/TR/webauthn-2/#enumdef-authenticatortransport * @enum {string} */ AuthenticatorTransport: "usb" | "nfc" | "ble" | "internal"; /** @description Request to sign a serialized Avalanche transaction */ AvaSerializedTxSignRequest: { /** @description Serialized transaction to sign */ tx: string; }; /** @description Request to sign an Avalanche transaction */ AvaSignRequest: { /** * @description Transaction to sign. * * Examples: * - {"P": { "AddPermissionlessValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_permissionless_validator.rs#L14) }} * - {"P": { "AddSubnetValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_subnet_validator.rs#L29) }} * - {"P": { "AddValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_validator.rs#L12) }} * - {"P": { "CreateChain": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/create_chain.rs#L8) }} * - {"P": { "CreateSubnet": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/create_subnet.rs#L8) }} * - {"P": { "Export": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/export.rs#L12) }} * - {"P": { "Import": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/import.rs#L12) }} * - {"X": { "Base": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/mod.rs#L21) }} * - {"X": { "Export": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/export.rs#L16) }} * - {"X": { "Import": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/import.rs#L14) }} */ tx: Record; }; AvaSignResponse: { /** @description The hex-encoded signature. */ signature: string; }; /** @description Wrapper around a zeroizing 32-byte fixed-size array */ B32: string; /** @enum {string} */ BadGatewayErrorCode: "OAuthProviderError" | "OidcDisoveryFailed" | "OidcIssuerJwkEndpointUnavailable" | "SmtpServerUnavailable"; /** @enum {string} */ BadRequestErrorCode: "GenericBadRequest" | "InvalidBody" | "TokenRequestError" | "InvalidMfaReceipt" | "InvalidMfaPolicyCount" | "InvalidMfaPolicyNumAuthFactors" | "InvalidMfaPolicyNumAllowedApprovers" | "InvalidMfaPolicyGracePeriodTooLong" | "InvalidMfaPolicyRedundantRule" | "InvalidCreateKeyCount" | "OrgInviteExistingUser" | "OrgUserAlreadyExists" | "OrgNameTaken" | "RoleNameTaken" | "AddKeyToRoleCountTooHigh" | "InvalidKeyId" | "InvalidTimeLockAlreadyInThePast" | "InvalidUpdate" | "InvalidMetadataLength" | "InvalidKeyMaterialId" | "KeyNotFound" | "UserExportDerivedKey" | "UserExportPublicKeyInvalid" | "UnableToAccessSmtpRelay" | "UserExportInProgress" | "RoleNotFound" | "InvalidMfaReceiptOrgIdMissing" | "InvalidMfaReceiptInvalidOrgId" | "MfaRequestNotFound" | "InvalidKeyType" | "InvalidKeyMaterial" | "InvalidHexValue" | "InvalidBase32Value" | "InvalidBase58Value" | "InvalidForkVersionLength" | "InvalidEthAddress" | "InvalidStellarAddress" | "InvalidOrgNameOrId" | "InvalidStakeDeposit" | "InvalidBlobSignRequest" | "InvalidSolanaSignRequest" | "InvalidEip712SignRequest" | "InvalidEvmSignRequest" | "InvalidEth2SignRequest" | "InvalidDeriveKeyRequest" | "InvalidStakingAmount" | "CustomStakingAmountNotAllowedForWrapperContract" | "InvalidUnstakeRequest" | "InvalidCreateUserRequest" | "UserAlreadyExists" | "CognitoUserAlreadyOrgMember" | "UserNotFound" | "PolicyRuleKeyMismatch" | "EmptyScopes" | "InvalidScopesForRoleSession" | "InvalidLifetime" | "NoSingleKeyForUser" | "InvalidOrgPolicyRule" | "SourceIpAllowlistEmpty" | "LimitWindowTooLong" | "Erc20ContractDisallowed" | "EmptyRuleError" | "OptionalListEmpty" | "InvalidOrgPolicyRepeatedRule" | "AvaSignHashError" | "AvaSignError" | "BtcSegwitHashError" | "BtcTaprootHashError" | "BtcSignError" | "TaprootSignError" | "Eip712SignError" | "InvalidMemberRoleInUserAdd" | "ThirdPartyUserAlreadyExists" | "OidcIdentityAlreadyExists" | "ThirdPartyUserNotFound" | "DeleteOidcUserError" | "DeleteUserError" | "SessionRoleMismatch" | "InvalidOidcToken" | "InvalidOidcIdentity" | "OidcIssuerUnsupported" | "OidcIssuerNotAllowed" | "OidcIssuerNoApplicableJwk" | "FidoKeyAlreadyRegistered" | "FidoKeySignCountTooLow" | "FidoVerificationFailed" | "FidoChallengeMfaMismatch" | "UnsupportedLegacyCognitoSession" | "InvalidIdentityProof" | "PaginationDataExpired" | "ExistingKeysViolateExclusiveKeyAccess" | "ExportDelayTooShort" | "ExportWindowTooLong" | "InvalidTotpFailureLimit" | "InvalidEip191SignRequest" | "CannotResendUserInvitation" | "InvalidNotificationEndpointCount" | "CannotDeletePendingSubscription" | "InvalidNotificationUrlProtocol" | "EmptyOneOfOrgEventFilter" | "EmptyAllExceptOrgEventFilter" | "InvalidTapNodeHash"; /** * @example { * "message_base64": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTYK" * } */ BlobSignRequest: { /** * @description The blob to sign, encoded as a base64 string. * * Note that certain signing keys impose additional requirements on the contents of * the message. For example, Secp256k1 keys require that the message is 32 bytes long. */ message_base64: string; /** * @description An optional tweak value for use *only* with Taproot keys. This field is ignored * for all other key types. * * If this field is not present or null, no tweak is applied. If the field is an * empty string, the key is tweaked with an unspendable script path per BIP0341. * Otherwise, this field must contain a 32-byte, base-64 encoded hex string * representing the Merkle root with which to tweak the key before signing. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ taproot_tweak?: string | null; }; BlobSignResponse: { /** @description The hex-encoded signature. */ signature: string; }; /** @description Leaf hash and code, as per BIP341 and https://github.com/rust-bitcoin/rust-bitcoin/blob/464202109d2b2c96e9b4867461bffe420dbd8177/bitcoin/src/crypto/sighash.rs#L691 */ BtcLeafHashCodeSeparator: { /** * Format: int32 * @description Code separator */ code_separator: number; /** @description Taproot-tagged hash with tag "TapLeaf". */ leaf_hash: string; }; /** @enum {string} */ BtcSighashType: "All" | "None" | "Single" | "AllPlusAnyoneCanPay" | "NonePlusAnyoneCanPay" | "SinglePlusAnyoneCanPay"; BtcSignRequest: { sig_kind: components["schemas"]["BtcSignatureKind"]; tx: components["schemas"]["BtcTx"]; }; BtcSignResponse: { /** * @description The hex-encoded signature in compact format. * @example 0x454aef27c21df7dd8f537dc869f4cd65286ce239a52d36470f4d85be85a891b02789e5ffd8560b32a98110e5d0096802e4c14145cf6c44f10a768c87755eaa4800 */ signature: string; }; BtcSignatureKind: { /** @description Segregated Witness */ Segwit: { /** * @description Transaction input index * @example 0 */ input_index: number; /** * @description Script * @example 0x76a91479091972186c449eb1ded22b78e40d009bdf008988ac */ script_code: string; sighash_type: components["schemas"]["BtcSighashType"]; /** * Format: int64 * @description Amount in satoshis * @example 1000000 */ value: number; }; }; BtcTx: Record; BtcTxOut: { /** @description The script which must be satisfied for the output to be spent. */ script_pubkey: string; /** * Format: int64 * @description The value of the output, in satoshis. */ value: number; }; /** @description Describes how to derive a WebAuthn challenge value. */ ChallengePieces: { /** * @description A base64url encoding of UTF8 JSON. The data in that JSON is endpoint specific, and describes what this FIDO challenge will be used for. * * Clients can use `preimage` along with `random_seed` to reconstruct the challenge like so: * * `challenge = HMAC-SHA256(key=random_seed, message=preimage)` */ preimage: string; /** @description A random seed that prevents replay attacks */ random_seed: string; }; /** * @description Session information sent to the client. * This struct works in tandem with its server-side counterpart [`SessionData`]. */ ClientSessionInfo: { /** @description Token to use for authorization. */ auth_token: string; auth_token_exp: components["schemas"]["EpochDateTime"]; /** * Format: int32 * @description Epoch at which the token was last refreshed */ epoch: number; epoch_token: components["schemas"]["B32"]; /** @description Token to use for refreshing the `(auth, refresh)` token pair */ refresh_token: string; refresh_token_exp: components["schemas"]["EpochDateTime"]; /** @description Session ID */ session_id: string; }; /** @description Fields that are common to different types of resources such as keys */ CommonFields: { created?: components["schemas"]["EpochDateTime"] | null; edit_policy?: components["schemas"]["EditPolicy"]; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * @description User-defined metadata. When rendering (e.g., in the browser) you should treat * it as untrusted user data (and avoid injecting metadata into HTML directly) if * untrusted users can create/update keys (or their metadata). */ metadata?: unknown; /** * Format: int64 * @description Version of this object */ version?: number; }; ConfigureEmailOtpRequest: { auth: { smtp: string; }; /** @description The email address that OTP requests will come from */ sender: string; }; ConfiguredMfa: { /** @enum {string} */ type: "totp"; } | { /** @description A unique credential id */ id: string; /** @description A human-readable name given to the key */ name: string; /** @enum {string} */ type: "fido"; }; CreateAndUpdateKeyProperties: { edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description Set this key's metadata. If this value is `null`, the metadata is erased. If the field is * missing, the metadata remains unchanged. */ metadata?: unknown; /** * @description Specify a user other than themselves to be the (potentially new) owner of the key. * The specified owner must be an existing user who is a member of the same org. * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner?: string | null; /** * @description Set this key's policies. For an existing key, this overwrites all its policies. * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: Record[] | null; }; CreateKeyImportKeyResponse: components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; CreateKeyRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * Format: int64 * @description Chain id for which the key is allowed to sign messages * @example 5 */ chain_id?: number | null; /** * Format: int32 * @description Number of keys to create * @example 1 */ count: number; key_type: components["schemas"]["KeyType"]; }; CreateKeyResponse: { /** @description The info about the created keys */ keys: components["schemas"]["KeyInfo"][]; }; /** @description Optional create role request body */ CreateRoleRequest: { /** * @description A human-readable name for the role. * @example my_role */ name: string; }; /** @description The newly created role information */ CreateRoleResponse: { /** * @description A human-readable name for the role. * @example my_role */ name?: string | null; /** * @description The id of the newly created role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }; CreateSessionRequest: components["schemas"]["RatchetConfig"] & { /** * @description A human readable description of the session's purpose * @example Manage keys on server foo.bar */ purpose: string; /** * @description Controls what capabilities this session will have. * @example [ * "manage:key:*" * ] */ scopes: string[]; }; CreateTokenRequest: components["schemas"]["RatchetConfig"] & { /** * @description A human readable description of the purpose of the key * @example Validator Signing */ purpose: string; /** * @description Controls what capabilities this session will have. By default, it has all * signing capabilities, i.e., just the 'sign:*' scope. * @example [ * "sign:*" * ] */ scopes?: string[] | null; }; /** * @description An extended form of `PublicKeyCredentialCreationOptions` that allows clients to derive the WebAuthn challenge * from a structured preimage. * * This ensures that the webuathn signature can only be used for a specific purpose */ CreationOptionsWithHash: components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }; CubeSignerUserInfo: { /** @description All multi-factor authentication methods configured for this user */ configured_mfa: components["schemas"]["ConfiguredMfa"][]; /** @description Set once the user successfully logs into CubeSigner */ initialized: boolean; /** @description Optional human name for the user */ name?: string | null; /** @description CubeSigner's user identifier */ user_id: string; }; /** * @description Information produced by a successful deposit * @example { * "chain_id": 5, * "deposit_txn": { * "data": "0x...", * "to": "0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b", * "value": "0x1bc16d674ec800000" * }, * "new_validator_pk": "9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da" * } */ DepositTxn: { /** * Format: int64 * @description Chain ID for which the deposit transaction was created */ chain_id: number; /** @description The deposit transaction. Includes only `to`, `value`, and `data` fields. */ deposit_txn: Record; /** @description The hex-encoded compressed form of the new validator BLS public key */ new_validator_pk: string; }; /** * @description The type of deposit to perform * @enum {string} */ DepositType: "Canonical" | "Wrapper"; DeriveKeyRequest: { /** * @description One or more derivation paths from which to derive keys. * @example [ * "m/44'/60'/0'/0/0", * "m/44'/9000'/0'/0/0" * ] */ derivation_path: string[]; key_type: components["schemas"]["KeyType"]; /** * @description Material-id of the mnemonic to use for derivation * @example 0x9f07be82d934fcb5d0f75dd24c2dfea8a85a4d0c289d58828b3537fae24d32b8 */ mnemonic_id: string; }; EditPolicy: { mfa?: components["schemas"]["MfaPolicy"] | null; time_lock_until?: components["schemas"]["EpochDateTime"] | null; }; Eip191Or712SignResponse: { /** * @description Hex-encoded signature comprising 65 bytes in the format required * by ecrecover: 32-byte r, 32-byte s, and one-byte recovery-id v * which is either 27 or 28. * @example 0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c */ signature: string; }; Eip191SignRequest: { /** * @description EIP-191 data to sign as hex-encoded bytes. * @example 0xdeadbeef13c0ffee */ data: string; }; /** * @example { * "chain_id": 1337, * "typed_data": { * "domain": { * "chainId": 1337, * "name": "Ether Mail", * "salt": "0x0000000000000000000000000000000000000000000000000000000000000000", * "verifyingContract": "0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC", * "version": "1" * }, * "message": { * "contents": "Hello, Bob!", * "from": { * "name": "Cow", * "wallets": [ * "0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826", * "0xDeaDbeefdEAdbeefdEadbEEFdeadbeEFdEaDbeeF" * ] * }, * "to": { * "name": "Bob", * "wallets": [ * "0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB", * "0xB0BdaBea57B0BDABeA57b0bdABEA57b0BDabEa57", * "0xB0B0b0b0b0b0B000000000000000000000000000" * ] * } * }, * "primaryType": "Mail", * "types": { * "EIP712Domain": [ * { * "name": "name", * "type": "string" * }, * { * "name": "version", * "type": "string" * }, * { * "name": "chainId", * "type": "uint256" * }, * { * "name": "verifyingContract", * "type": "address" * }, * { * "name": "salt", * "type": "bytes32" * } * ], * "Group": [ * { * "name": "name", * "type": "string" * }, * { * "name": "members", * "type": "Person[]" * } * ], * "Mail": [ * { * "name": "from", * "type": "Person" * }, * { * "name": "to", * "type": "Person" * }, * { * "name": "contents", * "type": "string" * } * ], * "Person": [ * { * "name": "name", * "type": "string" * }, * { * "name": "wallets", * "type": "address[]" * } * ] * } * } * } */ Eip712SignRequest: { /** * Format: int64 * @description The chain-id to which this typed data will be sent */ chain_id: number; /** @description EIP-712 typed data. Refer to the JSON schema defined in EIP-712. */ typed_data: Record; }; /** @description The request users send to initiate email OTP */ EmailOtpRequest: { /** @description The email which will receive the OTP */ email: string; }; /** * @description The HTTP response to an email OTP request. * * Users receive an encrypted OIDC token in their email inbox. * The values in this response can be used to decrypt that token * using AES-GCM. This ensures that clients need *both* the emailed token * and this response to complete OTP auth. */ EmailOtpResponse: { /** * Format: binary * @description Base64 URL encoded IV value for AES-GCM */ iv: string; /** * Format: binary * @description Base64 URL encoded key for AES-GCM */ key: string; }; /** @default null */ Empty: unknown; EmptyImpl: { status: string; }; /** * @description Request to create a set of EOTS nonces for a specified chain-id, starting * at a specified block height. */ EotsCreateNonceRequest: { /** * @description The chain id for which the nonces will be used, as a hex string * @example 0x11223344 */ chain_id: string; /** * Format: int32 * @description The number of nonces to generate * @example 16 */ num: number; /** * @description The starting block height of the generated nonces (quoted decimal u64) * @example 31337 */ start_height: string; }; /** @description Response generated when creating EOTS nonces */ EotsCreateNonceResponse: { /** * @description The generated nonces as an array of 0x-prefixed hex strings * @example [ * "0xb393bf39e71a16d784853d58255a296222a99fd3c87aa7ca206c5230c188f1c7", * "0xe01936584b4f0c0e97f0d3018c4f9db2bf7de41395c6403a48fd0dff0ef7b40d" * ] */ nonces: string[]; }; /** @description Request for an EOTS signature on a specified message, chain-id, block-height triple */ EotsSignRequest: { /** * @description The block height for the signature (quoted decimal u64) * @example 123456 */ block_height: string; /** * @description The chain id for the signature * @example 0x11223344 */ chain_id: string; /** * @description The message to sign * @example 0x5a2688faea09d42b9270fdb8de6fff6f192243a910ba66329073e12e0d0046a2 */ message: string; }; /** @description Response to an EOTS signing request */ EotsSignResponse: { /** * @description The resulting signature, a hex-encoded 32-byte value * @example 0xd9804c04a696b522472c53bd3a3c664c4c3085a017927e45ffaed711d1613700 */ signature: string; }; /** * @description Epoch is a quoted `uint64`. * @example 256 */ Epoch: string; /** * Format: int64 * @description DateTime measured in seconds since unix epoch. * A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`] * representing the number of seconds since [`SystemTime::UNIX_EPOCH`]. */ EpochDateTime: number; /** @description The structure of ErrorResponse must match the response template that AWS uses */ ErrorResponse: { accepted?: components["schemas"]["AcceptedValue"] | null; error_code: components["schemas"]["SignerErrorCode"]; /** @description Error message */ message: string; /** @description Optional request identifier */ request_id?: string; }; /** * @example { * "chain_id": 43113, * "tx": { * "chain_id": "0xa869", * "gas": "0x61a80", * "maxFeePerGas": "0x9502F900", * "maxPriorityFeePerGas": "0x50", * "nonce": "0xb", * "to": "0xf00ba12f00000000b4121200000f00c0ffeef00d", * "type": "0x02", * "value": "0x10000000000" * } * } */ Eth1SignRequest: { /** * Format: int64 * @description The chain id to set in the given transaction. */ chain_id: number; /** * @description EIP-2718 typed transaction (see the [ethers-rs * interface](https://docs.rs/ethers/latest/ethers/types/struct.Eip1559TransactionRequest.html)) types, including EIP-1559 transactions (`{ "type": "0x02" ... }`), and legacy * transactions (`{ "type": "0x00" ... }`). All values in the transaction are expected * to be (0x-prefixed or not) hex strings or byte arrays. */ tx: Record; }; Eth1SignResponse: { /** * @description Hex-encoded RLP encoding of the transaction and its signature * @example 0x22895118000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000001201d58656b0e22aaa68fdc692db41979098c3886ed33015d7467de9211609cdac000000000000000000000000000000000000000000000000000000000000000308b0c2900324d3ff9adfba7fdfe5af3f9b2cdbeef7b280437bbf1b1c59a093d615afe3e5dfed9622b540cdd9b49b3c5ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002001000000000000000000000049011adbcc3bc9c0307bb07f37dda1a1a9c69d2e0000000000000000000000000000000000000000000000000000000000000060903db8525674b8e7904f9b7d7d9ec55a0a42d33cf58be25469b0c21bbb6d06172bc5bb5fd1aed8e4f35936968958116b0619553c2cb1c52e7323074c6f8eb3d5a7074fc6580148df907837fa3b164ad7fbc2288dad1e8a5b021095b57c8a36d4 */ rlp_signed_tx: string; }; /** * @example { * "eth2_sign_request": { * "aggregation_slot": { * "slot": "36" * }, * "fork_info": { * "fork": { * "current_version": "0x42424242", * "epoch": "0", * "previous_version": "0x42424242" * }, * "genesis_validators_root": "0x9d13d61212c067e02ce8e608a7007e2c3b02571e9e6f27ff45dfa91bf27c870b" * }, * "signingRoot": "0x9c57e77c4965727542b9337df6756f948464bca3859bea6ed3c0ec6600d8982a", * "type": "AGGREGATION_SLOT" * }, * "network": "mainnet" * } */ Eth2SignRequest: { /** * @description Subset of the Web3Signer Eth2 BLS signing request whose schema is defined * [here](https://consensys.github.io/web3signer/web3signer-eth2.html#tag/Signing/operation/ETH2_SIGN). * We handle deposits and voluntary exits separately. */ eth2_sign_request: Record; network: components["schemas"]["Network"]; }; Eth2SignResponse: { /** * @description Hex encoded signature prefixed with 0x e.g. "0x0000..." * @example 0xb4f2ef9d12a54e1f569596c07c97d6d730535b6ffc0d287761dc78103a86326782471a04c75ce7a6faea08ca9a4a0830031cdcb893da8711d54aa22619f1a7e71b8185ddf4c6bfd9babbd735960e35e56bd6eeb89625b04850e7a9ef8846e549 */ signature: string; }; EvmTxCmp: { /** * Format: int64 * @description To prevent replay attacks, any given MFA receipt is normally allowed to be used only once. * * In this case, however, because EVM transactions already have a replay prevention mechanism * (namely the 'nonce' property), we allow the user to specify a grace period (in seconds) to * indicate how long an MFA receipt should remain valid after its first use. * * Note that we allow both 'grace' and 'ignore_nonce' to be set because once an MFA request * enters its grace period we unconditionally set its 'ignore_nonce' property to 'false' to * ensure that any subsequent requests that claim the same receipt must sign for the same * nonce as the request we signed originally with that receipt. * * Also note that the grace period cannot extend the lifetime of an MFA request beyond its * original expiration date. * * The grace period must not be greater than 30 days. */ grace?: number | null; /** @description Whether the 'gas' property of the EVM transaction is allowed to be different. */ ignore_gas?: boolean; /** @description Whether the 'nonce' property of the EVM transaction is allowed to be different. */ ignore_nonce?: boolean; }; /** @enum {string} */ EvmTxDepositErrorCode: "EvmTxDepositReceiverMismatch" | "EvmTxDepositEmptyData" | "EvmTxDepositEmptyChainId" | "EvmTxDepositEmptyReceiver" | "EvmTxDepositUnexpectedValue" | "EvmTxDepositUnexpectedDataLength" | "EvmTxDepositNoAbi" | "EvmTxDepositNoDepositFunction" | "EvmTxDepositUnexpectedFunctionName" | "EvmTxDepositUnexpectedValidatorKey" | "EvmTxDepositInvalidValidatorKey" | "EvmTxDepositMissingDepositArg" | "EvmTxDepositWrongDepositArgType" | "EvmTxDepositValidatorKeyNotInRole" | "EvmTxDepositUnexpectedWithdrawalCredentials" | "EvmTxDepositUnresolvedRole" | "EvmTxDepositInvalidDepositEncoding"; /** @description Sent from the client to the server to answer a fido challenge */ FidoAssertAnswer: { /** @description The ID of the challenge that was returned from the POST endpoint */ challenge_id: string; credential: components["schemas"]["PublicKeyCredential"]; }; FidoAssertChallenge: (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; /** @description Sent from the client to the server to answer a fido challenge */ FidoCreateChallengeAnswer: { /** @description The ID of the challenge that was returned from the POST endpoint */ challenge_id: string; credential: components["schemas"]["PublicKeyCredential"]; }; /** * @description Sent by the server to the client. Contains the challenge data that must be * used to generate a new credential */ FidoCreateChallengeResponse: (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; /** @description Declares intent to register a new FIDO key */ FidoCreateRequest: { /** * @description A human-readable name for the new fido credential * @example Work Yubikey */ name: string; }; /** @enum {string} */ ForbiddenErrorCode: "FidoRequiredToRemoveTotp" | "EmailOtpNotConfigured" | "MfaChallengeExpired" | "ChainIdNotAllowed" | "InvalidOrg" | "SessionForWrongOrg" | "SelfDelete" | "SelfDisable" | "UserMfaNotConfigured" | "UserDisabled" | "OrgDisabled" | "OrgNotFound" | "OrgWithoutOwner" | "OrphanedUser" | "OidcUserNotFound" | "UserNotInOrg" | "UserNotOrgOwner" | "UserNotKeyOwner" | "InvalidRole" | "DisabledRole" | "KeyDisabled" | "RoleNotInOrg" | "KeyNotInRole" | "KeyNotInOrg" | "UserExportRequestNotInOrg" | "UserExportRequestInvalid" | "UserNotOriginalKeyOwner" | "UserNotInRole" | "MustBeFullMember" | "SessionExpired" | "SessionChanged" | "SessionRevoked" | "ExpectedUserSession" | "SessionRoleChanged" | "ScopedNameNotFound" | "SessionInvalidEpochToken" | "SessionInvalidRefreshToken" | "SessionRefreshTokenExpired" | "InvalidAuthHeader" | "SessionNotFound" | "InvalidArn" | "SessionInvalidAuthToken" | "SessionAuthTokenExpired" | "SessionPossiblyStolenToken" | "MfaDisallowedIdentity" | "MfaDisallowedApprover" | "MfaTypeNotAllowed" | "MfaNotApprovedYet" | "MfaConfirmationCodeMismatch" | "MfaHttpRequestMismatch" | "MfaRemoveBelowMin" | "TotpAlreadyConfigured" | "TotpConfigurationChanged" | "MfaTotpBadConfiguration" | "MfaTotpBadCode" | "MfaTotpRateLimit" | "ImproperSessionScope" | "FullSessionRequired" | "SessionWithoutAnyScopeUnder" | "UserRoleUnprivileged" | "MfaNotConfigured" | "RemoveLastOidcIdentity"; /** * @description Specifies a fork of the `BeaconChain`, to prevent replay attacks. * The schema of `Fork` is defined in the [Beacon chain * spec](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#fork). * @example { * "current_version": "0x00001020", * "epoch": "0", * "previous_version": "0x00001020" * } */ Fork: { /** * @description Current fork version. * @example 0x43434343 */ current_version: string; epoch: components["schemas"]["Epoch"]; /** * @description Previous fork version. * @example 0x42424242 */ previous_version: string; }; /** * @description Genesis data as defined in the [Beacon API * spec](https://ethereum.github.io/beacon-APIs/#/Beacon/getGenesis). * You can get the genesis data from the Beacon node's `/eth/v1/beacon/genesis` end-point. * This struct definition is originally from lighthouse's eth2. */ GenesisData: { /** * @description Genesis fork version. * @example 0x42424242 */ genesis_fork_version: string; /** * @description Genesis time * @example 1679326449 */ genesis_time: string; /** * @description Genesis validators root. * @example 0x270d43e74ce340de4bca2b1936beca0f4f5408d9e78aec4850920baf659d5b69 */ genesis_validators_root: string; }; GetKeysInOrgRequest: { key_type?: components["schemas"]["KeyType"] | null; }; GetUsersInOrgResponse: { /** @description The list of users in the org */ users: components["schemas"]["UserInOrgInfo"][]; }; /** @description Stats pertaining the the sender `cube3signer` instance */ HeartbeatRequest: { /** * Format: int64 * @description Number of requests currently active (received but not necessarily being processed yet) */ current_num_requests_active: number; /** * Format: int64 * @description Number of requests currently being processed by cube3signer */ current_num_requests_processing: number; /** @description Do not record metric data from this heartbeat */ ignore?: boolean; /** * Format: int64 * @description Number of new requests during this heartbeat period */ num_requests: number; /** * Format: int64 * @description Number of requests that failed during this heartbeat period */ num_requests_failed: number; /** * Format: int64 * @description Number of requests were retried during this heartbeat period */ num_requests_retried: number; /** * Format: int64 * @description Number of retries during this heartbeat period */ num_retries: number; /** * Format: int64 * @description Number of times auth token was refreshed during this heartbeat period */ num_token_refreshes?: number; /** * Format: int64 * @description Number of times auth token refresh failed during this heartbeat period */ num_token_refreshes_failed?: number; /** * @description Version of the proxy sending the heart beat request * * TODO: Make non-optional once we do not support proxies without version information */ proxy_version?: string | null; }; /** * @description Information about the request. * * Captures all the relevant info (including the request body) about requests that require MFA. * We use this to verify that when a request is resumed (after obtaining necessary MFA approvals) * it is exactly the same as it originally was. */ HttpRequest: { /** @description HTTP request body */ body?: Record | null; /** @description HTTP method of the request */ method: string; /** @description HTTP path of the request (including host or not?) */ path: string; }; /** @description How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request]) */ HttpRequestCmp: OneOf<[ "Eq", { EvmTx: components["schemas"]["EvmTxCmp"]; } ]>; Id: string; /** * @description Information about a linked OIDC identity including unique identifiers and user info * (e.g., email) */ IdentityInfo: components["schemas"]["OidcIdentity"] & components["schemas"]["OidcUserInfo"] & Record; /** * @description Proof that an end-user provided CubeSigner with a valid auth token * (either an OIDC token or a CubeSigner session token) */ IdentityProof: { /** * @description OIDC audience; set only if the proof was obtained by using OIDC token. * * In other words, presence of this field testifies that authorization was obtained via OIDC. */ aud?: string | null; /** * @description The email associated with the user * @example user@email.com */ email?: string | null; exp_epoch: components["schemas"]["EpochDateTime"]; identity?: components["schemas"]["OidcIdentity"] | null; /** * @description The username (if any) associated with the user * @example cubistdev */ preferred_username?: string | null; user_info?: components["schemas"]["CubeSignerUserInfo"] | null; } & { /** @description An opaque identifier for the proof */ id: string; }; ImportKeyRequest: components["schemas"]["KeyImportKey"] & { /** @description A set of encrypted keys to be imported */ key_material: components["schemas"]["ImportKeyRequestMaterial"][]; key_type: components["schemas"]["KeyType"]; }; ImportKeyRequestMaterial: { /** * @description The client's ephemeral public key used to derive a shared key. * This is a base64-encoded, SEC1-encoded P384 public key. */ client_public_key: string; /** * @description The encrypted keying material to be imported. * This is a base64-encoded ciphertext. */ ikm_enc: string; /** * @description A salt value used to derive a shared key. * This is a base64-encoded byte string. */ salt: string; }; /** @enum {string} */ InternalErrorCode: "SystemTimeError" | "SendMailError" | "ReqwestError" | "EmailConstructionError" | "DbQueryError" | "DbGetError" | "DbDeleteError" | "DbPutError" | "DbUpdateError" | "SerdeError" | "TestAndSetError" | "ConcurrentLockCreation" | "DbGetItemsError" | "DbWriteError" | "CubistSignerError" | "CwPutMetricDataError" | "KmsGenerateRandomError" | "MalformedTotpBytes" | "KmsGenerateRandomNoResponseError" | "CreateKeyError" | "ParseDerivationPathError" | "SplitSignerError" | "CreateImportKeyError" | "CreateEotsNoncesError" | "EotsSignError" | "CognitoDeleteUserError" | "CognitoListUsersError" | "CognitoGetUserError" | "MissingUserEmail" | "CognitoResendUserInvitation" | "CognitoSetUserPasswordError" | "GenericInternalError" | "OidcAuthWithoutOrg" | "MissingKeyMetadata" | "KmsKeyWithoutId" | "KmsEnableKeyError" | "KmsDisableKeyError" | "SerializeEncryptedExportKeyError" | "DeserializeEncryptedExportKeyError" | "ReEncryptUserExport" | "S3UploadError" | "S3DownloadError" | "ManagedStateMissing" | "InternalHeaderMissing" | "InvalidInternalHeaderValue" | "RequestLocalStateAlreadySet" | "OidcOrgMismatch" | "OrphanedRoleKeyId" | "OidcIssuerInvalidJwk" | "InvalidPkForMaterialId" | "UncheckedOrg" | "AvaSignCredsMissing" | "AvaSignSignatureMissing" | "ExpectedRoleSession" | "InvalidThirdPartyIdentity" | "CognitoGetUser" | "SnsSubscribeError" | "SnsUnsubscribeError" | "SnsGetSubscriptionAttributesError" | "SnsSubscriptionAttributesMissing" | "SnsSetSubscriptionAttributesError" | "SnsPublishBatchError" | "InconsistentMultiValueTestAndSet"; /** * @description The kind of user that can be invited to an org: Cognito (login through first-party Cognito) * or SSO (log in via authorized OIDC providers) * @enum {string} */ InviteKind: "Cognito" | "Sso"; InviteRequest: { /** * @description The user's email address * @example alice@acme.com */ email: string; invite_kind?: components["schemas"]["InviteKind"] | null; /** @description Optional login MFA policy */ mfa_policy?: Record | null; /** * @description The user's full name * @example Alice Wonderland */ name: string; role?: components["schemas"]["MemberRole"] | null; /** * @description Skip sending an invitation email to this user if true. * * NOTE: this field is for internal testing use ONLY. If you do not * send an invitation email (and the invite kind is not SSO), the user will never be able to log in. * @example false */ skip_email: boolean; }; /** * @description A [`KeyPackage`] serialized into a format that gives a tidier JSON * representation suitable for encryption in the user-export flow. * * We construct values of this type rather than constructing `serde_json::Value`s * directly with `json!()` because this allows us to zeroize values on drop, which * doesn't work with `serde_json::Value`. * * Examples of serialized material: * * - `JsonKeyMaterial::EnglishMnemonic`: * * ``` * use cubist_signer_utils::{ * DerivationPath, KeyPackage, Mnemonic, MnemonicPackage, Secp256k1Pkg, * }; * use serde_json::json; * * const MNEMONIC: &str = "deposit fiscal brain swarm surround cousin horn glare fix love render believe guide shuffle stem cram broccoli resemble beach artefact language gift jar permit"; * const DER_PATH: &str = "m/44'/60'/0'/0/0"; * const KEY_TYPE: &str = "ecdsa:secp256k1"; * * let mne = Mnemonic::try_from(MNEMONIC).expect("good mnemonic"); * let derp = DerivationPath::try_from(DER_PATH).expect("good der path"); * let mne_pkg = MnemonicPackage::new(mne, "", derp); * let key_pkg = KeyPackage::::EnglishMnemonic(mne_pkg); * let json_pkg = key_pkg.into_json(KEY_TYPE); * * let json_expect = json!({ * "key_type": KEY_TYPE, * "material_type": "english_mnemonic", * "mnemonic": MNEMONIC, * "password": "", * "derivation_path": DER_PATH, * }); * * assert_eq!( * serde_json::to_value(&json_pkg).expect("json serialization"), * json_expect, * ); * ``` * * - `JsonKeyMaterial::RawSecret`: * * ``` * use cubist_signer_utils::{ * get_random_byte_array, hex_encode, KeyPackage, RngCore, Secp256k1Pkg, * }; * use serde_json::json; * * const KEY_TYPE: &str = "ecdsa:secp256k1"; * * // random 32-byte secret * let sk: [u8; 32] = *get_random_byte_array(); * * let key_pkg = KeyPackage::::Secret(sk); * let json_pkg = key_pkg.into_json(KEY_TYPE); * * let json_expect = json!({ * "key_type": KEY_TYPE, * "material_type": "raw_secret", * "secret": hex_encode(&sk), * }); * * assert_eq!( * serde_json::to_value(&json_pkg).expect("json serialization"), * json_expect, * ); * ``` */ JsonKeyPackage: ({ /** @enum {string} */ material_type: "raw_secret"; /** @description The value of the raw secret */ secret: string; } | { /** @description The derivation path */ derivation_path: string; /** @enum {string} */ material_type: "english_mnemonic"; /** @description The mnemonic */ mnemonic: string; /** @description The password (which may be empty) */ password: string; }) & { /** @description The type of key this package represents */ key_type: string; }; /** @description Derivation-related metadata for keys derived from a long-lived mnemonic */ KeyDerivationInfo: { /** @description The derivation path used to derive this key */ derivation_path: string; /** @description The mnemonic-id of the key's parent mnemonic */ mnemonic_id: string; }; /** @description A wrapped key-import key */ KeyImportKey: { /** @description Base64-encoded, encrypted data key. */ dk_enc: string; /** * Format: int64 * @description Expiration timestamp expressed as seconds since the UNIX epoch. */ expires: number; /** * @description The ephemeral public key to which an imported key should be encrypted. * This is a P384 public key in base64-encoded uncompressed SECG format. */ public_key: string; /** @description Base64-encoded, encrypted secret key. */ sk_enc: string; }; KeyInRoleInfo: { /** * @description Key ID * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; /** * @description Policies that are checked before this key is used on behalf of this role * @example [ * { * "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa" * }, * { * "TxDeposit": { * "kind": "Canonical" * } * } * ] */ policy?: Record[]; /** * @description Role ID * @example Role#e427c28a-9c5b-49cc-a257-878aea58a22c */ role_id: string; }; KeyInfo: components["schemas"]["CommonFields"] & { derivation_info?: components["schemas"]["KeyDerivationInfo"] | null; /** @description Whether the key is enabled (only enabled keys may be used for signing) */ enabled: boolean; /** * @description The id of the key: "Key#" followed by a unique identifier specific to * the type of key (such as a public key for BLS or an ethereum address for Secp) * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_type: components["schemas"]["KeyType"]; /** * @description A unique identifier specific to the type of key, such as a public key or an ethereum address * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ material_id: string; /** * @description Owner of the key * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner: string; /** * @description Key policy * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy: Record[]; /** * @description Hex-encoded, serialized public key. The format used depends on the key type: * - Secp256k1 keys use 65-byte uncompressed SECG format; * - Stark keys use 33-byte compressed SECG format; * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format; * - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032. * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431 */ public_key: string; /** * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages) * @example Eth2Validator(1) */ purpose: string; }; KeyInfos: { keys: components["schemas"]["KeyInfo"][]; }; /** @enum {string} */ KeyType: "SecpEthAddr" | "SecpBtc" | "SecpBtcTest" | "SecpAvaAddr" | "SecpAvaTestAddr" | "BlsPub" | "BlsInactive" | "Ed25519SolanaAddr" | "Ed25519SuiAddr" | "Ed25519AptosAddr" | "Ed25519CardanoAddrVk" | "Ed25519StellarAddr" | "Mnemonic" | "Stark" | "BabylonEots" | "TaprootBtc" | "TaprootBtcTest"; /** * @description Wrapper around encrypted [UnencryptedLastEvalKey] bytes. * * We serialize this into a base64url-encoded string and return to the user * so that they can pass this back to us as a url query parameter. */ LastEvalKey: string; /** @description Third-party identities associated with the user's account */ ListIdentitiesResponse: { identities: components["schemas"]["IdentityInfo"][]; }; ListMfaResponse: { /** @description All pending MFA requests */ mfa_requests: components["schemas"]["MfaRequestInfo"][]; }; ListTokensResponse: { tokens: components["schemas"]["TokenInfo"][]; }; /** * @description Describes whether a user in an org is an Owner or just a regular member * @enum {string} */ MemberRole: "Alien" | "Member" | "Owner"; /** @enum {string} */ MembershipStatus: "enabled" | "disabled"; /** * @example { * "allowed_approvers": [ * "User#fabc3f88-04e0-471b-9657-0ae12a3cd73e", * "User#d796c369-9974-473b-ab9e-e4a2418d2d07" * ], * "count": 2, * "lifetime": 900 * } */ MfaPolicy: { /** @description Users who are allowed to approve. If empty at creation time, default to the current user. */ allowed_approvers?: string[]; /** @description Allowed approval types. When omitted, defaults to any. */ allowed_mfa_types?: components["schemas"]["MfaType"][] | null; /** * Format: int32 * @description How many users to require to approve (defaults to 1). */ count?: number; lifetime?: components["schemas"]["Seconds"]; /** * Format: int32 * @description How many auth factors to require per user (defaults to 1). */ num_auth_factors?: number; request_comparer?: components["schemas"]["HttpRequestCmp"]; /** * @description CubeSigner operations to which this policy should apply. * When omitted, applies to all operations. */ restricted_operations?: components["schemas"]["OperationKind"][] | null; }; /** @description Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). */ MfaRequestInfo: { expires_at: components["schemas"]["EpochDateTime"]; /** @description Approval request ID. */ id: string; receipt?: components["schemas"]["Receipt"] | null; request: components["schemas"]["HttpRequest"]; status: components["schemas"]["Status"]; }; MfaType: OneOf<[ "CubeSigner", "Totp", "Fido", { /** @description Answer a FIDO challenge with a specific FIDO key */ FidoKey: { /** * @description The ID of the FIDO key that must be use to approve the request * @example FidoKey#EtDd...ZZc8= */ key_id: string; }; } ]>; /** @enum {string} */ MfaVote: "approve" | "reject"; /** * @description Network name ('mainnet', 'prater', 'goerli') * @example goerli * @enum {string} */ Network: "mainnet" | "prater" | "goerli" | "holesky"; /** @description Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). */ NewSessionResponse: { /** * Format: int64 * @description Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. * @example 1701879640 */ expiration?: number; session_info: components["schemas"]["ClientSessionInfo"]; /** * @description New token to be used for authentication. Requests to signing endpoints * should include this value in the `Authorization` header */ token: string; }; /** Format: binary */ NonceValue: string; /** @enum {string} */ NotFoundErrorCode: "UriSegmentMissing" | "UriSegmentInvalid" | "TotpNotConfigured" | "FidoKeyNotFound" | "FidoChallengeNotFound" | "TotpChallengeNotFound" | "UserExportRequestNotFound" | "UserExportCiphertextNotFound"; /** @description The configuration and status of a notification endpoint */ NotificationEndpoint: components["schemas"]["NotificationEndpointSubscription"] & { status: components["schemas"]["SubscriptionStatus"]; }; /** @description The configuration for an org event endpoint */ NotificationEndpointConfiguration: { filter?: components["schemas"]["OrgEventFilter"]; /** @description URL of the endpoint */ url: string; }; /** @description A notification endpoint subscription */ NotificationEndpointSubscription: { /** @description The ARN of the subscription */ arn: string; config: components["schemas"]["NotificationEndpointConfiguration"]; }; /** * @description Represents a globally unique OIDC-authorized user by expressing the full "path" to a user. That is: * * (iss) (sub) * Issuer -> Subresource */ OidcIdentity: { /** * @description The root-level issuer who administrates this user. From the OIDC spec: * Issuer Identifier for the Issuer of the response. The iss * value is a case sensitive URL using the https scheme that contains * scheme, host, and optionally, port number and path components and * no query or fragment components. * @example https://accounts.google.com */ iss: string; /** * @description From the OIDC spec: * * A locally unique and never reassigned identifier within the Issuer for * the End-User, which is intended to be consumed by the Client, e.g., * 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed * 255 ASCII characters in length. The sub value is a case sensitive * string. * @example 10769150350006150715113082367 */ sub: string; }; OidcLoginRequest: { /** @description A human readable description of the purpose of the session */ purpose?: string | null; /** * @description Controls what capabilities this session will have. * @example [ * "sign:*" * ] */ scopes: string[]; tokens?: components["schemas"]["RatchetConfig"]; }; OidcUserInfo: { /** * @description The email associated with the user * @example user@email.com */ email?: string | null; /** * @description The user name (if any) associated with the user * @example dril */ preferred_username?: string | null; }; /** * @description All different kinds of sensitive operations * @enum {string} */ OperationKind: "AvaSign" | "AvaChainTxSign" | "BlobSign" | "BtcSign" | "TaprootSign" | "Eip191Sign" | "Eip712Sign" | "EotsNonces" | "EotsSign" | "Eth1Sign" | "Eth2Sign" | "Eth2Stake" | "Eth2Unstake" | "SolanaSign"; OrgData: { /** * @description The id of the org * @example Org#123... */ org_id: string; /** * @description The human-readable name for the org * @example my_org_name */ org_name?: string | null; }; /** * @description Auto-generated discriminant enum variants * @enum {string} */ OrgEventDiscriminants: "Billing" | "OidcAuth" | "Eth2ConcurrentAttestationSigning" | "Eth2ConcurrentBlockSigning" | "Eth2InvalidBlockProposerSlotTooLow" | "Eth2InvalidAttestationSourceEpochTooLow" | "Eth2InvalidAttestationTargetEpochTooLow" | "Eth2Unstake" | "Eth2ExceededMaxUnstake" | "MfaRejected" | "BabylonEotsConcurrentSigning"; /** @description Filter for org events */ OrgEventFilter: OneOf<[ "All", { /** @description Accepts all org events other than the ones listed */ AllExcept: components["schemas"]["OrgEventDiscriminants"][]; }, { /** @description Only accepts org events that are one of the listed events */ OneOf: components["schemas"]["OrgEventDiscriminants"][]; } ]>; OrgInfo: { default_invite_kind?: components["schemas"]["InviteKind"]; /** @description When false, all cryptographic operations involving keys in this org are disabled. */ enabled: boolean; /** @description Deprecated: this field should be ignored. */ key_import_key?: string | null; /** * @description The organization's universally unique key-wrapping-key identifier. * This value is required when setting up key export. * @example mrk-fce09525e81587d23520f11e07e2e9d9 */ kwk_id: string; /** * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none. * @example TODO */ last_unstake: string; /** * Format: int32 * @description How many 'unstake' calls happened on the day when `last_unstake` was performed. */ last_unstake_day_count: number; /** * @description The human-readable name for the org * @example my_org_name */ name?: string | null; /** * @description The organization's notification endpoints, which are HTTPS URLs are notified about a * configurable set of events in an organization. For each event, CubeSigner sends a POST * request with a JSON-formatted body that contains the event details. * @example [ * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001", * "config": { * "url": "https://example.com/endpoint1" * }, * "status": "Confirmed" * }, * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002", * "config": { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url": "https://example.com/endpoint2" * }, * "status": "Pending" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpoint"][]; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Org-wide policies that are checked before a key is used for signing * @example [ * { * "MaxDailyUnstake": 5 * } * ] */ policy?: Record[]; /** * Format: int32 * @description The organization's currently configured TOTP failure limit, i.e., the number * of times a user can provide an incorrect TOTP code before being rate limited. * This value can be between 1 and 5 (inclusive). */ totp_failure_limit: number; /** * Format: int64 * @description The organization's currently configured user-export delay, i.e., the minimum * amount of time (in seconds) between when a user-export is initiated and when * it may be completed. (This value is meaningless for organizations that use * org-wide export.) */ user_export_delay: number; /** * Format: int64 * @description The organization's currently configured user-export window, i.e., the amount * of time (in seconds) between when the user-export delay is completed and when * the user export request has expired and can no longer be completed. (This value * is meaningless for organizations that use org-wide export.) */ user_export_window: number; /** @description If set, the official webapp origin is automatically allowed */ webapp_enabled?: boolean; }; /** * @description The rocket query parameter representing the page from which to start a paginated query. * * MUST be named `` in rocket url spec so that 'serde(rename = "page.*")' below continues to work */ Page: { /** * Format: int32 * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListKeyRolesResponse: { /** @description All roles the key is in */ roles: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListKeysResponse: { keys: components["schemas"]["KeyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRoleKeysResponse: { /** @description All keys in a role */ keys: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRoleUsersResponse: { /** @description All users in a role */ users: components["schemas"]["UserInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRolesResponse: { /** @description All roles in an organization. */ roles: components["schemas"]["RoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedSessionsResponse: { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedUserExportListResponse: { export_requests: components["schemas"]["UserExportInitResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; PolicyErrorCode: components["schemas"]["PolicyErrorOwnCodes"] | components["schemas"]["EvmTxDepositErrorCode"]; /** @enum {string} */ PolicyErrorOwnCodes: "EvmTxReceiverMismatch" | "EvmTxSenderMismatch" | "EvmTxExceededValue" | "EvmTxValueUndefined" | "EvmTxExceededGasCost" | "EvmTxGasCostUndefined" | "Erc20DataInvalid" | "Erc20ContractAddressUndefined" | "Erc20ContractChainIdUndefined" | "Erc20NotInContractAllowlist" | "Erc20ExceededTransferLimit" | "Erc20ReceiverMismatch" | "Erc20ExceededApproveLimit" | "Erc20SpenderMismatch" | "PolicyDisjunctionError" | "PolicyNegationError" | "Eth2ExceededMaxUnstake" | "Eth2ConcurrentUnstaking" | "NotInIpv4Allowlist" | "NotInOriginAllowlist" | "InvalidSourceIp" | "RawSigningNotAllowed" | "Eip712SigningNotAllowed" | "OidcSourceNotAllowed" | "NoOidcAuthSourcesDefined" | "AddKeyToRoleDisallowed" | "KeysAlreadyInRole" | "KeyInMultipleRoles" | "KeyAccessError" | "Eip191SigningNotAllowed" | "TimeLocked"; PreconditionErrorCode: components["schemas"]["PreconditionErrorOwnCodes"] | components["schemas"]["PolicyErrorCode"]; /** @enum {string} */ PreconditionErrorOwnCodes: "Eth2ProposerSlotTooLow" | "Eth2AttestationSourceEpochTooLow" | "Eth2AttestationTargetEpochTooLow" | "Eth2ConcurrentBlockSigning" | "Eth2ConcurrentAttestationSigning" | "Eth2MultiDepositToNonGeneratedKey" | "Eth2MultiDepositUnknownInitialDeposit" | "Eth2MultiDepositWithdrawalAddressMismatch" | "EvmConcurrentSigningWhenTimeLimitPolicyIsDefined" | "BabylonEotsConcurrentSigning"; /** @description Contains outputs of previous transactions. */ PrevOutputs: OneOf<[ { /** * @description `One` variant allows provision of the single previous output needed. It's useful, * for example, when modifier `SIGHASH_ANYONECANPAY` is provided, only previous output * of the current input is needed. The first `index` argument is the input index * this output is referring to. */ One: { index: number; tx_out: components["schemas"]["BtcTxOut"]; }; }, { /** * @description When `SIGHASH_ANYONECANPAY` is not provided, or when the caller is giving all * previous outputs so the same variable can be used for multiple inputs. */ All: components["schemas"]["BtcTxOut"][]; } ]>; /** * @description This type represents a wire-encodable form of the PublicKeyCredential interface * Clients may need to manually encode into this format to communicate with the server * * The PublicKeyCredential interface inherits from Credential * [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to * the caller when a new credential is created, or a new assertion is * requested. * * https://www.w3.org/TR/webauthn-2/#iface-pkcredential */ PublicKeyCredential: { /** * @description This internal slot contains the results of processing client extensions * requested by the Relying Party upon the Relying Party's invocation of * either navigator.credentials.create() or navigator.credentials.get(). * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot * * IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc: * * This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing. * https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults */ clientExtensionResults?: Record | null; /** * @description This internal slot contains the credential ID, chosen by the * authenticator. The credential ID is used to look up credentials for use, * and is therefore expected to be globally unique with high probability * across all credentials of the same type, across all authenticators. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot */ id: string; /** @description Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface */ response: components["schemas"]["AuthenticatorAttestationResponse"] | components["schemas"]["AuthenticatorAssertionResponse"]; }; /** * @description Defines the parameters for the creation of a new public key credential * * https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialcreationoptions */ PublicKeyCredentialCreationOptions: { attestation?: components["schemas"]["AttestationConveyancePreference"]; authenticatorSelection?: components["schemas"]["AuthenticatorSelectionCriteria"] | null; /** * @description This member contains a challenge intended to be used for generating the * newly created credential’s attestation object. See the § 13.4.3 * Cryptographic Challenges security consideration. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-challenge */ challenge: string; /** * @description This member is intended for use by Relying Parties that wish to limit * the creation of multiple credentials for the same account on a single * authenticator. The client is requested to return an error if the new * credential would be created on an authenticator that also contains one * of the credentials enumerated in this parameter. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-excludecredentials */ excludeCredentials?: components["schemas"]["PublicKeyCredentialDescriptor"][]; /** * @description This member contains additional parameters requesting additional * processing by the client and authenticator. For example, the caller may * request that only authenticators with certain capabilities be used to * create the credential, or that particular information be returned in the * attestation object. Some extensions are defined in § 9 WebAuthn * Extensions; consult the IANA "WebAuthn Extension Identifiers" registry * [IANA-WebAuthn-Registries] established by [RFC8809] for an up-to-date * list of registered WebAuthn Extensions. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-extensions */ extensions?: Record | null; /** * @description This member contains information about the desired properties of the * credential to be created. The sequence is ordered from most preferred to * least preferred. The client makes a best-effort to create the most * preferred credential that it can. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-pubkeycredparams */ pubKeyCredParams: components["schemas"]["PublicKeyCredentialParameters"][]; rp: components["schemas"]["PublicKeyCredentialRpEntity"]; /** * Format: int32 * @description This member specifies a time, in milliseconds, that the caller is * willing to wait for the call to complete. This is treated as a hint, and * MAY be overridden by the client. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-timeout */ timeout?: number | null; user: components["schemas"]["PublicKeyCredentialUserEntity"]; }; /** * @description This dictionary contains the attributes that are specified by a caller when * referring to a public key credential as an input parameter to the create() * or get() methods. It mirrors the fields of the PublicKeyCredential object * returned by the latter methods. * * https://www.w3.org/TR/webauthn-2/#dictionary-credential-descriptor */ PublicKeyCredentialDescriptor: { /** * @description This member contains the credential ID of the public key credential the caller is referring to. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialdescriptor-id */ id: string; /** * @description This OPTIONAL member contains a hint as to how the client might * communicate with the managing authenticator of the public key credential * the caller is referring to. The values SHOULD be members of * AuthenticatorTransport but client platforms MUST ignore unknown values. * * The getTransports() operation can provide suitable values for this * member. When registering a new credential, the Relying Party SHOULD * store the value returned from getTransports(). When creating a * PublicKeyCredentialDescriptor for that credential, the Relying Party * SHOULD retrieve that stored value and set it as the value of the * transports member. */ transports?: components["schemas"]["AuthenticatorTransport"][] | null; type: components["schemas"]["PublicKeyCredentialType"]; }; /** * @description This dictionary is used to supply additional parameters when creating a new * credential. * * https://www.w3.org/TR/webauthn-2/#dictionary-credential-params */ PublicKeyCredentialParameters: { /** * Format: int64 * @description This member specifies the cryptographic signature algorithm with which * the newly generated credential will be used, and thus also the type of * asymmetric key pair to be generated, e.g., RSA or Elliptic Curve. */ alg: number; type: components["schemas"]["PublicKeyCredentialType"]; }; /** * @description The `PublicKeyCredentialRequestOptions` dictionary supplies get() with the * data it needs to generate an assertion. Its challenge member MUST be * present, while its other members are OPTIONAL. * * This struct is also used as part of the verification procedure for assertions */ PublicKeyCredentialRequestOptions: { /** * @description This OPTIONAL member contains a list of PublicKeyCredentialDescriptor * objects representing public key credentials acceptable to the caller, in * descending order of the caller’s preference (the first item in the list * is the most preferred credential, and so on down the list). * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-allowcredentials */ allowCredentials?: components["schemas"]["PublicKeyCredentialDescriptor"][]; /** * @description This member represents a challenge that the selected authenticator * signs, along with other data, when producing an authentication * assertion. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-challenge */ challenge: string; extensions?: Record | null; /** * @description This OPTIONAL member specifies the relying party identifier claimed by * the caller. If omitted, its value will be the CredentialsContainer * object’s relevant settings object's origin's effective domain. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-rpid */ rpId?: string | null; /** * Format: int32 * @description This OPTIONAL member specifies a time, in milliseconds, that the caller * is willing to wait for the call to complete. The value is treated as a * hint, and MAY be overridden by the client. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-timeout */ timeout?: number | null; userVerification?: components["schemas"]["UserVerificationRequirement"]; }; /** * @description The PublicKeyCredentialRpEntity dictionary is used to supply additional * Relying Party attributes when creating a new credential. * * https://www.w3.org/TR/webauthn-2/#dictionary-rp-credential-params */ PublicKeyCredentialRpEntity: { /** * @description A unique identifier for the Relying Party entity, which sets the RP ID. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrpentity-id */ id?: string | null; /** * @description A human-palatable name for the entity. Its function depends on what the * PublicKeyCredentialEntity represents: When inherited by * PublicKeyCredentialRpEntity it is a human-palatable identifier for the * Relying Party, intended only for display. For example, "ACME * Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех". * * Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3 * of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], when setting name's value, or displaying the value to the * user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. */ name: string; }; /** * @description This enumeration defines the valid credential types. It is an extension * point; values can be added to it in the future, as more credential types are * defined. The values of this enumeration are used for versioning the * Authentication Assertion and attestation structures according to the type of * the authenticator. Currently one credential type is defined, namely * "public-key". * * https://www.w3.org/TR/webauthn-2/#enumdef-publickeycredentialtype * @enum {string} */ PublicKeyCredentialType: "public-key"; /** * @description The PublicKeyCredentialUserEntity dictionary is used to supply additional * user account attributes when creating a new credential. */ PublicKeyCredentialUserEntity: { /** * @description A human-palatable name for the user account, intended only for display. * For example, "Alex Müller" or "田中倫". The Relying Party SHOULD let the * user choose this, and SHOULD NOT restrict the choice more than * necessary. * * Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3 * of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], when setting displayName's value, or displaying the value to * the user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. * * Clients SHOULD perform enforcement, as prescribed in Section 2.3 of * [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], on displayName's value prior to displaying the value to the * user or including the value as a parameter of the * authenticatorMakeCredential operation. * * When clients, client platforms, or authenticators display a * displayName's value, they should always use UI elements to provide a * clear boundary around the displayed value, and not allow overflow into * other elements [css-overflow-3]. * * Authenticators MUST accept and store a 64-byte minimum length for a * displayName member’s value. Authenticators MAY truncate a displayName * member’s value so that it fits within 64 bytes. See § 6.4.1 String * Truncation about truncation and other considerations. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-displayname */ displayName: string; /** * @description The user handle of the user account entity. A user handle is an opaque * byte sequence with a maximum size of 64 bytes, and is not meant to be * displayed to the user. * * To ensure secure operation, authentication and authorization decisions * MUST be made on the basis of this id member, not the displayName nor * name members. See Section 6.1 of [RFC8266]. * * The user handle MUST NOT contain personally identifying information * about the user, such as a username or e-mail address; see § 14.6.1 User * Handle Contents for details. The user handle MUST NOT be empty, though * it MAY be null. * * Note: the user handle ought not be a constant value across different * accounts, even for non-discoverable credentials, because some * authenticators always create discoverable credentials. Thus a constant * user handle would prevent a user from using such an authenticator with * more than one account at the Relying Party. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-id */ id: string; /** * @description When inherited by PublicKeyCredentialUserEntity, it is a human-palatable * identifier for a user account. It is intended only for display, i.e., * aiding the user in determining the difference between user accounts with * similar displayNames. For example, "alexm", "alex.mueller@example.com" * or "+14255551234". * * The Relying Party MAY let the user choose this value. The Relying Party * SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265] * for the UsernameCasePreserved Profile of the PRECIS IdentifierClass * [RFC8264], when setting name's value, or displaying the value to the * user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. * * Clients SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265] for the UsernameCasePreserved Profile of the PRECIS IdentifierClass [RFC8264], on name's value prior to displaying the value to the user or including the value as a parameter of the authenticatorMakeCredential operation. */ name: string; }; RatchetConfig: { /** @default default_auth_lifetime */ auth_lifetime?: components["schemas"]["Seconds"]; /** @default default_grace_lifetime */ grace_lifetime?: components["schemas"]["Seconds"]; /** @default default_refresh_lifetime */ refresh_lifetime?: components["schemas"]["Seconds"]; /** @default default_session_lifetime */ session_lifetime?: components["schemas"]["Seconds"]; }; /** @description Receipt that an MFA request was approved. */ Receipt: { /** * @description Confirmation code the user needs to present when resuming the original request. * @example ba1d75dd-d999-4c1b-944d-25c25440c8af */ confirmation: string; /** @description The ID of the logged-in user whose action created this approval. */ final_approver: string; timestamp: components["schemas"]["EpochDateTime"]; }; /** * @description An extended form of `PublicKeyCredentialRequestOptions` that allows clients to derive the WebAuthn challenge * from a structured preimage. * * This ensures that the webuathn signature can only be used for a specific purpose */ RequestOptionsWithHash: components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }; /** * @description This enumeration’s values describe the Relying Party's requirements for * client-side discoverable credentials (formerly known as resident credentials * or resident keys): * * https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement * @enum {string} */ ResidentKeyRequirement: "discouraged" | "preferred" | "required"; RevokeTokenResponse: { token?: components["schemas"]["TokenInfo"] | null; }; RevokeTokensResponse: { /** @description Tokens that were revoked. */ revoked: components["schemas"]["TokenInfo"][]; }; RoleInfo: components["schemas"]["CommonFields"] & { /** * @description Whether the role is enabled * @example true */ enabled: boolean; /** @description Deprecated The CubeSigner IDs of at most 100 keys associated with this role */ keys?: components["schemas"]["KeyInRoleInfo"][] | null; /** * @description The human-readable name for the role (must be alphanumeric) * @example my_role */ name?: string | null; /** * @description Policy that is checked whenever a key is accessed for signing via this role. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * }, * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: Record[]; /** * @description The ID of the role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; /** @description Deprecated. The list of at most 100 users with access to the role. */ users?: string[] | null; }; /** * Format: int64 * @description Duration measured in seconds * A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds. */ Seconds: number; SessionInfo: { /** * @description A human-readable description for the session * @example OIDC login session */ purpose: string; /** * @description Session ID. Uniquely identifies the session, but cannot be used for auth. * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; /** @description The response from any operation operating on multiple sessions */ SessionsResponse: { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; }; SignerErrorCode: components["schemas"]["SignerErrorOwnCodes"] | components["schemas"]["AcceptedValueCode"] | components["schemas"]["BadRequestErrorCode"] | components["schemas"]["BadGatewayErrorCode"] | components["schemas"]["NotFoundErrorCode"] | components["schemas"]["ForbiddenErrorCode"] | components["schemas"]["UnauthorizedErrorCode"] | components["schemas"]["PreconditionErrorCode"] | components["schemas"]["InternalErrorCode"]; /** @enum {string} */ SignerErrorOwnCodes: "UnhandledError" | "ProxyStartError" | "EnclaveError"; /** * @example { * "message_base64": "AQABA8OKVzLEjststN4xXr39kLKHT8d58eQY1QEs6MeXwEFBrxTAlULX1troLbWxuAXQqgbQofGi6z8fJi7KAAIf7YMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJK0tn39k28s+X86W47EvbRRKnYBVQ8Q/l2m1EbfT7+vAQICAAEMAgAAAGQAAAAAAAAA" * } */ SolanaSignRequest: { /** @description Solana base64-encoded serialized Message */ message_base64: string; }; SolanaSignResponse: { /** @description The hex-encoded signature. */ signature: string; }; StakeRequest: { /** * Format: int64 * @description The chain on which we will deposit * @example 5 */ chain_id: number; deposit_type: components["schemas"]["DepositType"]; /** * Format: int64 * @description Optional staking amount in GWEI. * If not specified, defaults to 32_000_000_000 (32 ETH). * Must be between 1 ETH and 32 ETH. * Must not be different from the default value when 'deposit_type' is "Wrapper". */ staking_amount_gwei?: number; unsafe_conf?: components["schemas"]["UnsafeConf"] | null; /** * @description The validator BLS public key to use, or `None` to generate a fresh one. * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c */ validator_key?: string | null; /** * @description The ethereum address to which withdrawn funds go * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ withdrawal_addr: string; }; StakeResponse: { /** * @description The validator key id ("Key#...") * @example Key#db1731f8-3659-45c0-885b-e11e1f5b7be2 */ created_validator_key_id: string; deposit_tx: components["schemas"]["DepositTxn"]; }; Status: { /** @description Users who are allowed to approve. Must be non-empty. */ allowed_approvers: string[]; /** @description Allowed approval types. When omitted, defaults to any. */ allowed_mfa_types?: components["schemas"]["MfaType"][] | null; /** @description Users who have already approved */ approved_by: { [key: string]: { [key: string]: components["schemas"]["ApprovalInfo"]; }; }; /** * Format: int32 * @description How many users must approve */ count: number; /** * Format: int32 * @description How many auth factors to require per user */ num_auth_factors: number; request_comparer?: components["schemas"]["HttpRequestCmp"]; }; /** * @description The status of a subscription * @enum {string} */ SubscriptionStatus: "Confirmed" | "Pending"; TaprootSignRequest: { sig_kind: components["schemas"]["TaprootSignatureKind"]; tx: components["schemas"]["BtcTx"]; }; TaprootSignResponse: { /** * @description The 64-byte signature, encoded as defined in BIP0340. * @example 0x14110b79e65f90f70cd3ff5adf29bed9c9fcc035772240990fb51d25a10c9667669bba0c3b335163f65d1b9d8569cf22dd8210084cd24d83cc4bb396d979e10d */ signature: string; }; TaprootSignatureKind: { /** @description Optional annex, as per BIP341 */ annex?: string | null; /** * @description Transaction input index * @example 0 */ input_index: number; leaf_hash_code_separator?: components["schemas"]["BtcLeafHashCodeSeparator"] | null; /** * @description If this field is not present or null, no tweak is applied. If the field is an * empty string, the key is tweaked with an unspendable script path per BIP0341. * Otherwise, this field must contain a 32-byte, base-64 encoded hex string * representing the Merkle root with which to tweak the key before signing. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ merkle_root?: string | null; prevouts: components["schemas"]["PrevOutputs"]; /** * @description Hash type of an input's signature, encoded in the last byte of the signature. * Possible values: * - SIGHASH_ALL * - SIGHASH_ALL|SIGHASH_ANYONECANPAY * - SIGHASH_DEFAULT * - SIGHASH_NONE * - SIGHASH_NONE|SIGHASH_ANYONECANPAY * - SIGHASH_SINGLE * - SIGHASH_SINGLE|SIGHASH_ANYONECANPAY * @example SIGHASH_ALL */ sighash_type: string; }; TokenInfo: { /** @description Session ID. Use it to revoke a session. Cannot be used for auth. */ hash: string; /** @description Tokens purpose */ purpose: string; }; /** * @description OAuth2 standard Token Response. * * https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2 */ TokenResponse: { /** @description The access token issued by the authorization server. */ access_token: string; expires_in: components["schemas"]["Seconds"]; /** @description An OIDC token issued by Cubist, containing user information */ id_token?: string; /** @description The type of the token issued. Value is case insensitive. */ token_type: string; [key: string]: unknown; }; TotpApproveRequest: { /** @description TOTP verification code */ code: string; }; /** @description Sent from the client to the server to answer a TOTP challenge */ TotpChallengeAnswer: { /** @description The current TOTP code */ code: string; /** @description The ID of the challenge that was returned from the POST endpoint */ totp_id: string; }; TotpInfo: { /** * @description The ID of the TOTP challenge. * @example TotpChallenge#7892ebba-563e-485b-bb7d-e26267363286 */ totp_id: string; /** * @description Standard TOTP url which includes everything needed to initialize TOTP. * @example otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist */ totp_url: string; }; /** @description Request to reset TOTP. */ TotpResetRequest: { /** @description The name of the issuer; defaults to "Cubist". */ issuer?: string | null; }; /** @enum {string} */ UnauthorizedErrorCode: "ClaimsHeaderMissing" | "ClaimsParseError" | "OidcIdentityHeaderMissing" | "OidcIdentityParseError"; /** @description Options that should be set only for local devnet testing. */ UnsafeConf: { /** * @description The hex-encoded address of the deposit contract. If omitted, inferred from `chain_id` * @example 0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b */ deposit_contract_addr?: string | null; /** * @description The hex-encoded 4-byte fork version * @example 0x00001020 */ genesis_fork_version?: string | null; }; /** * @description Unstake message request. * @example { * "epoch": "256", * "fork": { * "current_version": "0x00001020", * "epoch": "0", * "previous_version": "0x00001020" * }, * "genesis_data": { * "genesis_fork_version": "0x00001020", * "genesis_time": "1679541642", * "genesis_validators_root": "0x270d43e74ce340de4bca2b1936beca0f4f5408d9e78aec4850920baf659d5b69" * }, * "network": "goerli", * "validator_index": "0" * } */ UnstakeRequest: { epoch?: components["schemas"]["Epoch"] | null; fork: components["schemas"]["Fork"]; genesis_data: components["schemas"]["GenesisData"]; network: components["schemas"]["Network"]; /** * @description Validator index (`uint64`) to exit. You can get the validator index from the Beacon node's * `/eth/v1/beacon/states/head/validators/{pubkey}` end-point. This end point returns an * object that contains information about the validator (whose public key is `{pubkey}`), * including the validator index. The schema of this end-point is defined * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/getStateValidator). * @example 31337 */ validator_index: string; }; /** * @description Unstake responses are signed voluntary exit messages. * The schema for this message is defined * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit). * This message can be directly POSTed to the Beacon node's * `/eth/v1/beacon/pool/voluntary_exits` end-point (see expected schema * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/submitPoolVoluntaryExit)). */ UnstakeResponse: { message: components["schemas"]["VoluntaryExit"]; /** * @description BLS signature. * @example 0x910c7cd537ed91cc8c4a82f3cbd832e9be8c24a22e9c86df479f7ce42025ea6a09619b418b666a060e260d2aae31b8e50e9d05ca3442c7eed3b507e5207e14674275f68c2ba84c4bf6b8dd364a304acac8cfab3681e2514b4400f9242bc61164 */ signature: string; }; UpdateKeyRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * @description If set, updates the keys's `enabled` property to this value. * Once disabled, a key cannot be used for signing. */ enabled?: boolean | null; /** * Format: int64 * @description If set, updating the metadata only succeeds if the version matches this value. */ version?: number | null; }; UpdateOrgRequest: { default_invite_kind?: components["schemas"]["InviteKind"] | null; /** @description If set, update this org's `enabled` field to this value. */ enabled?: boolean | null; /** * @description If set, update this org's alias. Org aliases are globally unique. * @example my_org */ name?: string | null; /** * @description If set, update this org's notification endpoints. Notification endpoints are expected to be * HTTPS URLs, which accept POST requests. The body of the requests sent to these endpoints are * are formatted in JSON and have the following format: * * ```json * { * "org": "...", * "utc_timestamp": "...", * "org_event": "...", * ... * } * ``` * * `org` is the org id, `utc_timestamp` is the UTC timestamp of the event in milliseconds, and * `org_event` is a string identifying the type of event that has occurred. The rest of the * fields provide additional information related to the type of the event. * * Endpoints can optionally include filters to customize the org events that they are notified * about. Currently, the only supported filter type is `OneOf`, which expects a list of org * event types to send to the endpoint. If no filter is configured, the system sends all org * events to the endpoint. * @example [ * { * "url:": "https://example.com/endpoint1" * }, * { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url:": "https://example.com/endpoint2" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null; /** * @description If set, update this org's policies (old policies will be overwritten!). * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * }, * { * "SourceIpAllowlist": [ * "10.1.2.3/8", * "169.254.17.1/16" * ] * } * ] */ policy?: Record[] | null; /** * Format: int32 * @description If set, update this org's TOTP failure limit. After this many failures, * the user is rate limited until the next 30-second TOTP window. */ totp_failure_limit?: number | null; /** * Format: int64 * @description If set, update this org's user-export delay, i.e., the amount of time * (in seconds) between a user's initiating an export and the time when * export is allowed. For security, this delay cannot be set to less than * 172800, i.e., 2 days. */ user_export_delay?: number | null; /** * Format: int64 * @description If set, update this org's user-export window, i.e., the amount of time * (in seconds) that export is allowed after the user-export delay. After * this amount of time, the export is canceled and must be re-initiated. * For security, this window cannot be set to greater than 259200, i.e., * 3 days. */ user_export_window?: number | null; }; UpdateOrgResponse: { default_invite_kind?: components["schemas"]["InviteKind"] | null; /** @description The new value of the 'enabled' property */ enabled?: boolean | null; /** * @description The new human-readable name for the org (must be alphanumeric) * @example my_org_name */ name?: string | null; /** * @description The new notification endpoint configurations * @example [ * { * "url": "https://example.com/endpoint" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The new value of org-wide policies * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * } * ] */ policy?: Record[] | null; /** * Format: int32 * @description The new value of the TOTP failure limit */ totp_failure_limit?: number | null; /** * Format: int64 * @description The new value of user-export delay */ user_export_delay?: number | null; /** * Format: int64 * @description The new value of user-export window */ user_export_window?: number | null; }; UpdateRoleRequest: { edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description If set, updates the role's `enabled` property to this value. * Once disabled, a role cannot be used; and it's tokens cannot be used for signing. */ enabled?: boolean | null; /** * @description If set, update this role's key policies (old policies will be overwritten!). * Only "deny" style policies may be set. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * } * ] */ policy?: Record[] | null; }; /** @description Request to update an existing user */ UpdateUserMembershipRequest: { /** @description Enable or disable user */ disabled?: boolean | null; }; /** @description A request to complete a user export */ UserExportCompleteRequest: { /** * @description The id of the key to be exported. The key-id must correspond to the one in * the specified export request, and the caller must own this key. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description The NIST P-256 public key (base64-encoded SEC1 with or without compression) * to which the export will be encrypted. If a public key was provided when * `user_export_init` was called, this key must match that one. * @example AkpLT/3dXApJzXSduaPQ7apyT0ADBwqkt1es/aT0iWWf */ public_key: string; }; /** @description An encrypted user-export */ UserExportCompleteResponse: { /** * @description The exported key material, encrypted with AES-256-GCM under a key * derived from the public key supplied in the request via HPKE (RFC9180) * with DHKEM(P-256, HKDF-SHA256) and base64 encoded. */ encrypted_key_material: string; /** * @description The ephemeral public key used for HPKE key derivation as base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @description The user-id to which this key belongs. */ user_id: string; }; /** @description A request to initiate a user export */ UserExportInitRequest: { /** * @description The id of the key to be exported. This key must be owned by the caller. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description An optional NIST P-256 public key (base64-encoded SEC1 with or without * compression) to which the export will be encrypted. If provided, this * public key MUST be the one used to encrypt the export once the delay has * expired. Otherwise, the user can provide any public key when completing * the export request post delay. * * This option may provide extra security when the user has a secure hardware * device (e.g., a phone's secure element or a YubiKey) in which a NIST P-256 * secret key can be generated. Providing the corresponding public key here * ensures that only that specific device will be capable of decrypting * the export ciphertext. * * If no secure hardware device is available to store the secret key, this * option SHOULD NOT be used because of the risk of secret key theft during * the export delay period. * @example AkpLT/3dXApJzXSduaPQ7apyT0ADBwqkt1es/aT0iWWf */ public_key?: string | null; }; /** @description The response to a successful user-export init request */ UserExportInitResponse: components["schemas"]["UserExportRequest"] & { /** * @description The key-id being requested. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; }; /** @description Pending user-export request as stored in the database. */ UserExportRequest: { exp_epoch: components["schemas"]["EpochDateTime"]; /** * @description The org-id in which the key is housed. * @example Org#f361ed6b-5d19-4ccf-a4d5-eba935dc0b90 */ org_id: string; /** * @description The SHA-256 hash of the public key provided at export initiation, * if any. If a key was provided, only that key can be used to complete * the export procedure. Otherwise, any key can be used. * * IMPORTANT: if a public key is supplied at export initiation, it is * STRONGLY RECOMMENDED that the corresponding secret key be stored in * a secure hardware device, e.g., a YubiKey or a phone's secure element. * If no such hardware is available, supplying a public key at export * initiation is STRONGLY DISCOURAGED because of the risk of theft during * the export delay period. * * (See also the comment in the `public_key` field of `UserInitRequest`.) * @example df457a98d5538540f54d1316b597a0f39b8d96f488f10a2e31a955c146fdf1d3 */ public_key_hash?: string | null; valid_epoch: components["schemas"]["EpochDateTime"]; }; UserInOrgInfo: { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; }; /** * @description Information about a user's membership in an organization * (without including any info about the user) */ UserInOrgMembership: { membership: components["schemas"]["MemberRole"]; /** * @description Organization id * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; status: components["schemas"]["MembershipStatus"]; }; UserInRoleInfo: { user_id: string; }; UserInfo: { /** * @description Optional email * @example alice@example.com */ email?: string | null; /** @description All multi-factor authentication methods configured for this user */ mfa: components["schemas"]["ConfiguredMfa"][]; /** @description MFA policy, applies before logging in and other sensitive operations */ mfa_policy?: Record | null; /** * @description Optional name * @example Alice */ name?: string | null; /** * @deprecated * @description All organizations the user belongs to. Deprecated in favor of 'orgs'. * @example [ * "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a" * ] */ org_ids: string[]; /** @description All organizations the user belongs to, including the membership role in each. */ orgs: components["schemas"]["UserInOrgMembership"][]; /** * @description The id of the currently logged in user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; /** @description The response to the user/orgs endpoint */ UserOrgsResponse: { /** @description The list of orgs this user is a member of */ orgs: components["schemas"]["OrgData"][]; }; /** * @description A WebAuthn Relying Party may require user verification for some of its * operations but not for others, and may use this type to express its needs. * * https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement * @enum {string} */ UserVerificationRequirement: "required" | "discouraged" | "preferred"; /** * @description An exit voluntarily submitted a validator who wishes to withdraw. * The schema for this message is defined * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit). */ VoluntaryExit: { epoch: components["schemas"]["Epoch"]; /** * @description Index of the exiting validator. * @example 256 */ validator_index: string; }; }; responses: { AddThirdPartyUserResponse: { content: { "application/json": { /** @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; }; }; AvaSignResponse: { content: { "application/json": { /** @description The hex-encoded signature. */ signature: string; }; }; }; BlobSignResponse: { content: { "application/json": { /** @description The hex-encoded signature. */ signature: string; }; }; }; BtcSignResponse: { content: { "application/json": { /** * @description The hex-encoded signature in compact format. * @example 0x454aef27c21df7dd8f537dc869f4cd65286ce239a52d36470f4d85be85a891b02789e5ffd8560b32a98110e5d0096802e4c14145cf6c44f10a768c87755eaa4800 */ signature: string; }; }; }; CreateKeyImportKeyResponse: { content: { "application/json": components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; }; }; CreateKeyResponse: { content: { "application/json": { /** @description The info about the created keys */ keys: components["schemas"]["KeyInfo"][]; }; }; }; /** @description The newly created role information */ CreateRoleResponse: { content: { "application/json": { /** * @description A human-readable name for the role. * @example my_role */ name?: string | null; /** * @description The id of the newly created role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }; }; }; Eip191Or712SignResponse: { content: { "application/json": { /** * @description Hex-encoded signature comprising 65 bytes in the format required * by ecrecover: 32-byte r, 32-byte s, and one-byte recovery-id v * which is either 27 or 28. * @example 0x4355c47d63924e8a72e509b65029052eb6c299d53a04e167c5775fd466751c9d07299936d304c153f6443dfa05f40ff007d72911b6f72307f996231605b915621c */ signature: string; }; }; }; /** * @description The HTTP response to an email OTP request. * * Users receive an encrypted OIDC token in their email inbox. * The values in this response can be used to decrypt that token * using AES-GCM. This ensures that clients need *both* the emailed token * and this response to complete OTP auth. */ EmailOtpResponse: { content: { "application/json": { /** * Format: binary * @description Base64 URL encoded IV value for AES-GCM */ iv: string; /** * Format: binary * @description Base64 URL encoded key for AES-GCM */ key: string; }; }; }; EmptyImpl: { content: { "application/json": { status: string; }; }; }; /** @description Response generated when creating EOTS nonces */ EotsCreateNonceResponse: { content: { "application/json": { /** * @description The generated nonces as an array of 0x-prefixed hex strings * @example [ * "0xb393bf39e71a16d784853d58255a296222a99fd3c87aa7ca206c5230c188f1c7", * "0xe01936584b4f0c0e97f0d3018c4f9db2bf7de41395c6403a48fd0dff0ef7b40d" * ] */ nonces: string[]; }; }; }; /** @description Response to an EOTS signing request */ EotsSignResponse: { content: { "application/json": { /** * @description The resulting signature, a hex-encoded 32-byte value * @example 0xd9804c04a696b522472c53bd3a3c664c4c3085a017927e45ffaed711d1613700 */ signature: string; }; }; }; Eth1SignResponse: { content: { "application/json": { /** * @description Hex-encoded RLP encoding of the transaction and its signature * @example 0x22895118000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000001201d58656b0e22aaa68fdc692db41979098c3886ed33015d7467de9211609cdac000000000000000000000000000000000000000000000000000000000000000308b0c2900324d3ff9adfba7fdfe5af3f9b2cdbeef7b280437bbf1b1c59a093d615afe3e5dfed9622b540cdd9b49b3c5ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002001000000000000000000000049011adbcc3bc9c0307bb07f37dda1a1a9c69d2e0000000000000000000000000000000000000000000000000000000000000060903db8525674b8e7904f9b7d7d9ec55a0a42d33cf58be25469b0c21bbb6d06172bc5bb5fd1aed8e4f35936968958116b0619553c2cb1c52e7323074c6f8eb3d5a7074fc6580148df907837fa3b164ad7fbc2288dad1e8a5b021095b57c8a36d4 */ rlp_signed_tx: string; }; }; }; Eth2SignResponse: { content: { "application/json": { /** * @description Hex encoded signature prefixed with 0x e.g. "0x0000..." * @example 0xb4f2ef9d12a54e1f569596c07c97d6d730535b6ffc0d287761dc78103a86326782471a04c75ce7a6faea08ca9a4a0830031cdcb893da8711d54aa22619f1a7e71b8185ddf4c6bfd9babbd735960e35e56bd6eeb89625b04850e7a9ef8846e549 */ signature: string; }; }; }; FidoAssertChallenge: { content: { "application/json": (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; }; }; /** * @description Sent by the server to the client. Contains the challenge data that must be * used to generate a new credential */ FidoCreateChallengeResponse: { content: { "application/json": (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; }; }; GetUsersInOrgResponse: { content: { "application/json": { /** @description The list of users in the org */ users: components["schemas"]["UserInOrgInfo"][]; }; }; }; /** * @description Proof that an end-user provided CubeSigner with a valid auth token * (either an OIDC token or a CubeSigner session token) */ IdentityProof: { content: { "application/json": { /** * @description OIDC audience; set only if the proof was obtained by using OIDC token. * * In other words, presence of this field testifies that authorization was obtained via OIDC. */ aud?: string | null; /** * @description The email associated with the user * @example user@email.com */ email?: string | null; exp_epoch: components["schemas"]["EpochDateTime"]; identity?: components["schemas"]["OidcIdentity"] | null; /** * @description The username (if any) associated with the user * @example cubistdev */ preferred_username?: string | null; user_info?: components["schemas"]["CubeSignerUserInfo"] | null; } & { /** @description An opaque identifier for the proof */ id: string; }; }; }; /** @description Derivation-related metadata for keys derived from a long-lived mnemonic */ KeyDerivationInfo: { content: { "application/json": { /** @description The derivation path used to derive this key */ derivation_path: string; /** @description The mnemonic-id of the key's parent mnemonic */ mnemonic_id: string; }; }; }; /** @description A wrapped key-import key */ KeyImportKey: { content: { "application/json": { /** @description Base64-encoded, encrypted data key. */ dk_enc: string; /** * Format: int64 * @description Expiration timestamp expressed as seconds since the UNIX epoch. */ expires: number; /** * @description The ephemeral public key to which an imported key should be encrypted. * This is a P384 public key in base64-encoded uncompressed SECG format. */ public_key: string; /** @description Base64-encoded, encrypted secret key. */ sk_enc: string; }; }; }; KeyInfo: { content: { "application/json": components["schemas"]["CommonFields"] & { derivation_info?: components["schemas"]["KeyDerivationInfo"] | null; /** @description Whether the key is enabled (only enabled keys may be used for signing) */ enabled: boolean; /** * @description The id of the key: "Key#" followed by a unique identifier specific to * the type of key (such as a public key for BLS or an ethereum address for Secp) * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_type: components["schemas"]["KeyType"]; /** * @description A unique identifier specific to the type of key, such as a public key or an ethereum address * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ material_id: string; /** * @description Owner of the key * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner: string; /** * @description Key policy * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy: Record[]; /** * @description Hex-encoded, serialized public key. The format used depends on the key type: * - Secp256k1 keys use 65-byte uncompressed SECG format; * - Stark keys use 33-byte compressed SECG format; * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format; * - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032. * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431 */ public_key: string; /** * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages) * @example Eth2Validator(1) */ purpose: string; }; }; }; KeyInfos: { content: { "application/json": { keys: components["schemas"]["KeyInfo"][]; }; }; }; /** @description Third-party identities associated with the user's account */ ListIdentitiesResponse: { content: { "application/json": { identities: components["schemas"]["IdentityInfo"][]; }; }; }; ListMfaResponse: { content: { "application/json": { /** @description All pending MFA requests */ mfa_requests: components["schemas"]["MfaRequestInfo"][]; }; }; }; ListTokensResponse: { content: { "application/json": { tokens: components["schemas"]["TokenInfo"][]; }; }; }; /** @description Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). */ MfaRequestInfo: { content: { "application/json": { expires_at: components["schemas"]["EpochDateTime"]; /** @description Approval request ID. */ id: string; receipt?: components["schemas"]["Receipt"] | null; request: components["schemas"]["HttpRequest"]; status: components["schemas"]["Status"]; }; }; }; /** @description Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). */ NewSessionResponse: { content: { "application/json": { /** * Format: int64 * @description Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. * @example 1701879640 */ expiration?: number; session_info: components["schemas"]["ClientSessionInfo"]; /** * @description New token to be used for authentication. Requests to signing endpoints * should include this value in the `Authorization` header */ token: string; }; }; }; OrgInfo: { content: { "application/json": { default_invite_kind?: components["schemas"]["InviteKind"]; /** @description When false, all cryptographic operations involving keys in this org are disabled. */ enabled: boolean; /** @description Deprecated: this field should be ignored. */ key_import_key?: string | null; /** * @description The organization's universally unique key-wrapping-key identifier. * This value is required when setting up key export. * @example mrk-fce09525e81587d23520f11e07e2e9d9 */ kwk_id: string; /** * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none. * @example TODO */ last_unstake: string; /** * Format: int32 * @description How many 'unstake' calls happened on the day when `last_unstake` was performed. */ last_unstake_day_count: number; /** * @description The human-readable name for the org * @example my_org_name */ name?: string | null; /** * @description The organization's notification endpoints, which are HTTPS URLs are notified about a * configurable set of events in an organization. For each event, CubeSigner sends a POST * request with a JSON-formatted body that contains the event details. * @example [ * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001", * "config": { * "url": "https://example.com/endpoint1" * }, * "status": "Confirmed" * }, * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002", * "config": { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url": "https://example.com/endpoint2" * }, * "status": "Pending" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpoint"][]; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Org-wide policies that are checked before a key is used for signing * @example [ * { * "MaxDailyUnstake": 5 * } * ] */ policy?: Record[]; /** * Format: int32 * @description The organization's currently configured TOTP failure limit, i.e., the number * of times a user can provide an incorrect TOTP code before being rate limited. * This value can be between 1 and 5 (inclusive). */ totp_failure_limit: number; /** * Format: int64 * @description The organization's currently configured user-export delay, i.e., the minimum * amount of time (in seconds) between when a user-export is initiated and when * it may be completed. (This value is meaningless for organizations that use * org-wide export.) */ user_export_delay: number; /** * Format: int64 * @description The organization's currently configured user-export window, i.e., the amount * of time (in seconds) between when the user-export delay is completed and when * the user export request has expired and can no longer be completed. (This value * is meaningless for organizations that use org-wide export.) */ user_export_window: number; /** @description If set, the official webapp origin is automatically allowed */ webapp_enabled?: boolean; }; }; }; PaginatedListKeyRolesResponse: { content: { "application/json": { /** @description All roles the key is in */ roles: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListKeysResponse: { content: { "application/json": { keys: components["schemas"]["KeyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRoleKeysResponse: { content: { "application/json": { /** @description All keys in a role */ keys: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRoleUsersResponse: { content: { "application/json": { /** @description All users in a role */ users: components["schemas"]["UserInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRolesResponse: { content: { "application/json": { /** @description All roles in an organization. */ roles: components["schemas"]["RoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedSessionsResponse: { content: { "application/json": { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedUserExportListResponse: { content: { "application/json": { export_requests: components["schemas"]["UserExportInitResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; RevokeTokenResponse: { content: { "application/json": { token?: components["schemas"]["TokenInfo"] | null; }; }; }; RevokeTokensResponse: { content: { "application/json": { /** @description Tokens that were revoked. */ revoked: components["schemas"]["TokenInfo"][]; }; }; }; RoleInfo: { content: { "application/json": components["schemas"]["CommonFields"] & { /** * @description Whether the role is enabled * @example true */ enabled: boolean; /** @description Deprecated The CubeSigner IDs of at most 100 keys associated with this role */ keys?: components["schemas"]["KeyInRoleInfo"][] | null; /** * @description The human-readable name for the role (must be alphanumeric) * @example my_role */ name?: string | null; /** * @description Policy that is checked whenever a key is accessed for signing via this role. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * }, * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: Record[]; /** * @description The ID of the role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; /** @description Deprecated. The list of at most 100 users with access to the role. */ users?: string[] | null; }; }; }; SessionInfo: { content: { "application/json": { /** * @description A human-readable description for the session * @example OIDC login session */ purpose: string; /** * @description Session ID. Uniquely identifies the session, but cannot be used for auth. * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; }; /** @description The response from any operation operating on multiple sessions */ SessionsResponse: { content: { "application/json": { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; }; }; }; SolanaSignResponse: { content: { "application/json": { /** @description The hex-encoded signature. */ signature: string; }; }; }; StakeResponse: { content: { "application/json": { /** * @description The validator key id ("Key#...") * @example Key#db1731f8-3659-45c0-885b-e11e1f5b7be2 */ created_validator_key_id: string; deposit_tx: components["schemas"]["DepositTxn"]; }; }; }; TaprootSignResponse: { content: { "application/json": { /** * @description The 64-byte signature, encoded as defined in BIP0340. * @example 0x14110b79e65f90f70cd3ff5adf29bed9c9fcc035772240990fb51d25a10c9667669bba0c3b335163f65d1b9d8569cf22dd8210084cd24d83cc4bb396d979e10d */ signature: string; }; }; }; TokenInfo: { content: { "application/json": { /** @description Session ID. Use it to revoke a session. Cannot be used for auth. */ hash: string; /** @description Tokens purpose */ purpose: string; }; }; }; /** * @description OAuth2 standard Token Response. * * https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2 */ TokenResponse: { content: { "application/json": { /** @description The access token issued by the authorization server. */ access_token: string; expires_in: components["schemas"]["Seconds"]; /** @description An OIDC token issued by Cubist, containing user information */ id_token?: string; /** @description The type of the token issued. Value is case insensitive. */ token_type: string; [key: string]: unknown; }; }; }; TotpInfo: { content: { "application/json": { /** * @description The ID of the TOTP challenge. * @example TotpChallenge#7892ebba-563e-485b-bb7d-e26267363286 */ totp_id: string; /** * @description Standard TOTP url which includes everything needed to initialize TOTP. * @example otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist */ totp_url: string; }; }; }; /** * @description Unstake responses are signed voluntary exit messages. * The schema for this message is defined * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit). * This message can be directly POSTed to the Beacon node's * `/eth/v1/beacon/pool/voluntary_exits` end-point (see expected schema * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/submitPoolVoluntaryExit)). */ UnstakeResponse: { content: { "application/json": { message: components["schemas"]["VoluntaryExit"]; /** * @description BLS signature. * @example 0x910c7cd537ed91cc8c4a82f3cbd832e9be8c24a22e9c86df479f7ce42025ea6a09619b418b666a060e260d2aae31b8e50e9d05ca3442c7eed3b507e5207e14674275f68c2ba84c4bf6b8dd364a304acac8cfab3681e2514b4400f9242bc61164 */ signature: string; }; }; }; UpdateOrgResponse: { content: { "application/json": { default_invite_kind?: components["schemas"]["InviteKind"] | null; /** @description The new value of the 'enabled' property */ enabled?: boolean | null; /** * @description The new human-readable name for the org (must be alphanumeric) * @example my_org_name */ name?: string | null; /** * @description The new notification endpoint configurations * @example [ * { * "url": "https://example.com/endpoint" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The new value of org-wide policies * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * } * ] */ policy?: Record[] | null; /** * Format: int32 * @description The new value of the TOTP failure limit */ totp_failure_limit?: number | null; /** * Format: int64 * @description The new value of user-export delay */ user_export_delay?: number | null; /** * Format: int64 * @description The new value of user-export window */ user_export_window?: number | null; }; }; }; /** @description An encrypted user-export */ UserExportCompleteResponse: { content: { "application/json": { /** * @description The exported key material, encrypted with AES-256-GCM under a key * derived from the public key supplied in the request via HPKE (RFC9180) * with DHKEM(P-256, HKDF-SHA256) and base64 encoded. */ encrypted_key_material: string; /** * @description The ephemeral public key used for HPKE key derivation as base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @description The user-id to which this key belongs. */ user_id: string; }; }; }; /** @description The response to a successful user-export init request */ UserExportInitResponse: { content: { "application/json": components["schemas"]["UserExportRequest"] & { /** * @description The key-id being requested. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; }; }; }; UserInOrgInfo: { content: { "application/json": { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; }; }; }; UserInfo: { content: { "application/json": { /** * @description Optional email * @example alice@example.com */ email?: string | null; /** @description All multi-factor authentication methods configured for this user */ mfa: components["schemas"]["ConfiguredMfa"][]; /** @description MFA policy, applies before logging in and other sensitive operations */ mfa_policy?: Record | null; /** * @description Optional name * @example Alice */ name?: string | null; /** * @deprecated * @description All organizations the user belongs to. Deprecated in favor of 'orgs'. * @example [ * "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a" * ] */ org_ids: string[]; /** @description All organizations the user belongs to, including the membership role in each. */ orgs: components["schemas"]["UserInOrgMembership"][]; /** * @description The id of the currently logged in user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; }; }; /** @description The response to the user/orgs endpoint */ UserOrgsResponse: { content: { "application/json": { /** @description The list of orgs this user is a member of */ orgs: components["schemas"]["OrgData"][]; }; }; }; }; parameters: never; requestBodies: never; headers: never; pathItems: never; } export type $defs = Record; export type external = Record; export interface operations { /** * User Info * @description User Info * * Retrieves information about the current user. */ aboutMeLegacy: { responses: { 200: components["responses"]["UserInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Org * @description Get Org * * Retrieves information about an organization. */ getOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["OrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Org * @description Update Org * * Update organization attributes (enabled flag, name, and policies). */ updateOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateOrgRequest"]; }; }; responses: { 200: components["responses"]["UpdateOrgResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a serialized Avalanche C/X/P-Chain Message * @description Sign a serialized Avalanche C/X/P-Chain Message * * Signs an Avalanche message with a given SecpEth (C-Chain messages) or * SecpAva (X- and P-Chain messages) key. Currently signing C-Chain messages * with SecpEth key must also be explicitly allowed via `AllowRawBlobSigning` * policy. * * This is a pre-release feature. */ avaSerializedTxSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Avalanche chain * @example P */ ava_chain: string; /** * @description Avalanche address in bech32 or ETH format * @example 0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AvaSerializedTxSignRequest"]; }; }; responses: { 200: components["responses"]["AvaSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign JSON-encoded Avalanche X- or P-Chain Message * @description Sign JSON-encoded Avalanche X- or P-Chain Message * * Signs an Avalanche message with a given SecpAva key. * This is a pre-release feature. */ avaSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Avalanche bech32 address format without the chain prefix * @example avax1am4w6hfrvmh3akduzkjthrtgtqafalce6an8cr */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AvaSignRequest"]; }; }; responses: { 200: components["responses"]["AvaSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create EOTS nonces * @description Create EOTS nonces * * Generates a set of Babylon EOTS nonces for a specified chain-id, starting at a * specified block height. */ createEotsNonces: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded public key of the EOTS key * @example 0x457f0f24cfb06c3c35874bbd1f59b57180a5a9d7e1f6929280839c830f5c147f */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EotsCreateNonceRequest"]; }; }; responses: { 200: components["responses"]["EotsCreateNonceResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create an EOTS signature * @description Create an EOTS signature * * Generates an EOTS signature for the specified chain-id, block height, and message. */ eotsSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded public key of the EOTS key * @example 0x457f0f24cfb06c3c35874bbd1f59b57180a5a9d7e1f6929280839c830f5c147f */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EotsSignRequest"]; }; }; responses: { 200: components["responses"]["EotsSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Bitcoin Segwit Transaction * @description Sign Bitcoin Segwit Transaction * * Signs a Bitcoin Segwit transaction with a given key. * This is a pre-release feature. */ btcSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32 encoding of the public key * @example bc1q5p5qkae77ly80kr4pyfytdqm7rf08ddhdejl9g */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BtcSignRequest"]; }; }; responses: { 200: components["responses"]["BtcSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Bitcoin Taproot Transaction * @description Sign Bitcoin Taproot Transaction * * Signs a Bitcoin Taproot transaction with a given key. * This is a pre-release feature. */ btcTaprootSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32 encoding of the public key * @example bc1p2wsldez5mud2yam29q22wgfh9439spgduvct83k3pm50fcxa5dps59h4z5 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TaprootSignRequest"]; }; }; responses: { 200: components["responses"]["TaprootSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Derive Key From Long-Lived Mnemonic * @description Derive Key From Long-Lived Mnemonic * * Derives a key of a specified type using a supplied derivation path and an * existing long-lived mnemonic. */ deriveKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["DeriveKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; setEmailOtp: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["ConfigureEmailOtpRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EIP-191 Data * @description Sign EIP-191 Data * * Signs a message using EIP-191 personal_sign with a given Secp256k1 key. */ eip191Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded EVM address of the Secp256k1 key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eip191SignRequest"]; }; }; responses: { 200: components["responses"]["Eip191Or712SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EIP-712 Typed Data * @description Sign EIP-712 Typed Data * * Signs typed data according to EIP-712 with a given Secp256k1 key. */ eip712Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded EVM address of the Secp256k1 key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eip712SignRequest"]; }; }; responses: { 200: components["responses"]["Eip191Or712SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List associated OIDC identities with the current user. * @description List associated OIDC identities with the current user. */ listOidcIdentities: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["ListIdentitiesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Associate an OIDC identity with the current user in org . * @description Associate an OIDC identity with the current user in org . */ addOidcIdentity: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddIdentityRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove an OIDC identity from the current user's account in org . * @description Remove an OIDC identity from the current user's account in org . */ removeOidcIdentity: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcIdentity"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create [IdentityProof] from CubeSigner user session * @description Create [IdentityProof] from CubeSigner user session * * This route can be used to prove to another party that a user has a * valid CubeSigner session. * * Clients are intended to call this route and pass the returned evidence * to another service which will verify it by making a request to `/v0/org//identity/verify`. */ createProofCubeSigner: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["IdentityProof"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create [IdentityProof] from OIDC token * @description Create [IdentityProof] from OIDC token * * Exchange an OIDC ID token (passed via the `Authorization` header) for a proof of authentication. * * This route can be used to prove to another party that a user has met the * authentication requirements (allowed issuers & audiences) for CubeSigner * without leaking their credentials. * * Clients are intended to call this route and pass the returned evidence to another service * which will verify it by making a request to `/v0/org//identity/verify`. */ createProofOidc: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["IdentityProof"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify identity proof * @description Verify identity proof * * Allows a third-party to validate proof of authentication. * * When a third-party is provided an [IdentityProof] object, they must check its * veracity by calling this endpoint */ verifyProof: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["IdentityProof"]; }; }; responses: {}; }; /** * Create Key-Import Key * @description Create Key-Import Key * * Generate an ephemeral key that a client can use for key-import encryption. */ createKeyImportKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["CreateKeyImportKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Import Key * @description Import Key * * Securely imports an existing key using a previously generated key-import key. */ importKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["ImportKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Invite User * @description Invite User * * Creates a new user in an existing org and sends that user an invite email. */ invite: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["InviteRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Keys * @description List Keys * * Gets the list of owned keys in a given org. */ listKeysInOrg: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; /** * @description Filter by key type * @example SecpEthAddr */ key_type?: components["schemas"]["KeyType"] | null; /** * @description Filter by key owner * @example User#5269c579-b4f9-4620-9e90-e46a5a0ffb4d */ key_owner?: components["schemas"]["Id"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListKeysResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Key * @description Create Key * * Creates one or more new keys of the specified type. */ createKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Key * @description Get Key * * Returns the properties of a key. */ getKeyInOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["KeyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Key * @description Delete Key * * Deletes a key specified by its ID. * * Only the key owner and org owners are allowed to delete keys. * Additionally, the role's edit policy (if set) must permit the update. */ deleteKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Key * @description Update Key * * Enable or disable a key. The user must be the owner of the key or * organization to perform this action. * * For each requested update, the session must have the corresponding 'manage:key:update:_' scope; * if no updates are requested, the session must have 'manage:key:get'. */ updateKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateKeyRequest"]; }; }; responses: { 200: components["responses"]["KeyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Key Roles * @description List Key Roles * * Get all roles the key is in */ listKeyRoles: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["PaginatedListKeyRolesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Pending MFA Requests * @description List Pending MFA Requests * * Retrieves and returns all pending MFA requests that are accessible to the current user, * i.e., those in which the current user is listed as an approver */ mfaList: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["ListMfaResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Pending MFA Request * @description Get Pending MFA Request * * Retrieves and returns a pending MFA request by its id. */ mfaGet: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Approve or Reject MFA Request * @description Approve or Reject MFA Request * * Approve or reject request after logging in with CubeSigner. * * If approving, adds the currently-logged user as an approver * of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of * approvers is reached, the MFA request is approved; the confirmation receipt can be used to * resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteCs: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate a FIDO MFA Approval/Rejection * @description Initiate a FIDO MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using FIDO. */ mfaFidoInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["FidoAssertChallenge"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize a FIDO MFA Approval/Rejection * @description Finalize a FIDO MFA Approval/Rejection * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteFidoComplete: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoAssertAnswer"]; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Approve/Reject a TOTP MFA Request * @description Approve/Reject a TOTP MFA Request * * If approving, adds the current user as approver to a pending MFA request by * providing TOTP code. If the required number of approvers is reached, the MFA request is * approved; the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteTotp: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Mint an OIDC ID token for Twitter * @description Mint an OIDC ID token for Twitter * * This function acts identically to Twitter's [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint, * but extends the output with an `id_token`. * * This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token. * * > [!IMPORTANT] * > This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter. */ oauth2Twitter: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": { [key: string]: string; }; }; }; responses: { 200: components["responses"]["TokenResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Login with OIDC * @description Login with OIDC * * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session. * * MFA is required when: * - an MFA policy is explicitly attached to the user logging in * (e.g., an org owner can do that at user creation time to require certain kind of MFA) * - the user has at least 1 MFA factor configured */ oidcAuth: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcLoginRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate login via email token * @description Initiate login via email token * * This endpoint sends an email to the provided address with an OIDC token encrypted with AES-GCM. * The decryption parameters are returned immediately in the response. * Once that token is decrypted, it can be used with the standard OIDC authentication flows * * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID * > 2. Have an email sender configured for OTPs */ emailOtpAuth: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EmailOtpRequest"]; }; }; responses: { 200: components["responses"]["EmailOtpResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Roles * @description List Roles * * Retrieves all roles in an organization that the current user is allowed to access. */ listRoles: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; /** @description Don't include keys and users for each role */ summarize?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRolesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Role * @description Create Role * * Creates a new role in an organization. Unless the logged-in user * is the owner, they are automatically added to the newly created role. */ createRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; /** @description Optional request body to set the role name */ requestBody?: { content: { "application/json": components["schemas"]["CreateRoleRequest"] | null; }; }; responses: { 200: components["responses"]["CreateRoleResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Role * @description Get Role * * Retrieves information about a role in an organization */ getRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["RoleInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Role * @description Delete Role * * Deletes a role in an organization. * * Only users in the role can perform this action. * Additionally, the role's edit policy (if set) must permit the update. */ deleteRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Role * @description Update Role * * Enables or disables a role (this requires the `manage:role:update:enable` scope). * Updates the role's policies (this requires the `manage:role:update:policy` scope). * * The user must be in the role or an owner of the organization. * Additionally, the role's edit policy (if set) must permit the update. */ updateRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateRoleRequest"]; }; }; responses: { 200: components["responses"]["RoleInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Add Keys * @description Add Keys * * Adds a list of existing keys to an existing role. * * Only the key owner can their key to a role. * Additionally, the role's edit policy (if set) must permit the update. */ addKeysToRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddKeysToRoleRequest"]; }; }; responses: {}; }; /** * Add User * @description Add User * * Adds an existing user to an existing role. * * Only users in the role or org owners can add users to a role. * Additionally, the role's edit policy (if set) must permit the update. */ addUserToRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: {}; }; /** * List Role Keys * @description List Role Keys * * Returns an array of all keys in a role. */ listRoleKeys: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRoleKeysResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove Key * @description Remove Key * * Removes a given key from a role. * * Only users in the role or org owners can remove keys from a role. * Additionally, the role's edit policy (if set) must permit the update. */ removeKeyFromRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: {}; }; /** * List a single page of Tokens (Deprecated) * @deprecated * @description List a single page of Tokens (Deprecated) * * **Deprecated**: Use `GET /org/{org_id}/session?role=` * * Returns all access tokens for a given role. * Only users in the role or owners can create a token for it. */ listRoleTokens: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["ListTokensResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Token * @description Create Token * * Creates a new access token for a given role (to be used as "API Key" for all signing actions). * Only users in the role or owners can create a token for it. */ createRoleToken: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateTokenRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke All Tokens (Deprecated) * @deprecated * @description Revoke All Tokens (Deprecated) * * **Deprecated**: Use `DELETE /org/{org_id}/session?role=` instead * * Revokes all access tokens associated with a role. * Only users in the role or owners can perform this action. */ revokeAllRoleTokens: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["RevokeTokensResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke Token (Deprecated) * @deprecated * @description Revoke Token (Deprecated) * * **Deprecated**: Use `DELETE /org/{org_id}/session/{session_id}` * * Revokes an access token associated with a role. * Only users in the role or owners can perform this action. */ revokeRoleToken: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description The ID of the session to revoke * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; responses: { 200: components["responses"]["RevokeTokenResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Role Users. * @description List Role Users. * * Returns an array of all users who have access to a role. */ listRoleUsers: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRoleUsersResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove User * @description Remove User * * Removes an existing user from an existing role. * * Only users in the role or org owners can remove users from a role. * Additionally, the role's edit policy (if set) must permit the update. */ removeUserFromRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: {}; }; /** * List sessions * @description List sessions * * If no query parameters are provided, information for the current session is returned */ listSessions: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; /** * @description If provided, the name or ID of a role to operate on * @example my-role */ role?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedSessionsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create new user session (management and/or signing) * @description Create new user session (management and/or signing) * * Creates a new user session, silently truncating requested session and auth lifetimes * to be at most requestor's session and auth lifetime, respectively. */ createSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateSessionRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke existing session(s) * @description Revoke existing session(s) * * Immediately revokes existing sessions, preventing them from being used or refreshed. * If no query params are provided, the current session is revoked. */ revokeSessions: { parameters: { query?: { /** * @description If provided, the name or ID of a role to operate on * @example my-role */ role?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["SessionsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke current session * @description Revoke current session * * Immediately revokes the current session, preventing it from being used or refreshed */ revokeCurrentSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get session information * @description Get session information */ getSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The ID of the session to get * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; responses: { 200: components["responses"]["SessionInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke a session * @description Revoke a session * * Immediately revokes an existing session, preventing it from being used or refreshed */ revokeSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The ID of the session to revoke * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; responses: { 200: components["responses"]["SessionInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Solana Message * @description Sign Solana Message * * Signs a Solana message with a given key. * This is a pre-release feature. */ solanaSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The base58-encoded public key * @example 86ZRPszBp5EoPj7wR3bHn7wnAZ5iYfpasRc7DKFPTUaZ */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SolanaSignRequest"]; }; }; responses: { 200: components["responses"]["SolanaSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Token-Accessible Keys * @description Get Token-Accessible Keys * * Retrieves the keys that the role token can access. */ listTokenKeys: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["KeyInfos"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * User Info * @description User Info * * Retrieves information about the current user. */ aboutMe: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["UserInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List outstanding user-export requests * @description List outstanding user-export requests */ userExportList: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: components["schemas"]["LastEvalKey"] | null; /** * @description If provided, the user-id whose user-export requests to list. Defaults to the * current user. Only the org owner may list requests for another user. * @example User#806c9544-f1fa-4bad-8d4d-1097a1844726 */ user_id?: string | null; /** * @description If provided, the key-id for which to list an existing user-export request. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedUserExportListResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate a user-export request * @description Initiate a user-export request * * This starts a delay (whose length is determined by Org-wide settings) * before export can be completed, and returns a ticket that can be used * to complete the export once the timer has expired. * * Only one user-export request can be active for a given key. If there * is already an active export, this endpoint will return an error. To * create a new request, first delete the existing one. */ userExportInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UserExportInitRequest"]; }; }; responses: { 200: components["responses"]["UserExportInitResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete an existing user-export request * @description Delete an existing user-export request */ userExportDelete: { parameters: { query: { /** * @description The key-id whose export request should be deleted * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description The user-id who owns this request. If omitted, defaults to the current user. * Only the org owner may delete user-export requests for another user. * @example User#806c9544-f1fa-4bad-8d4d-1097a1844726 */ user_id?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete a user-export request * @description Complete a user-export request * * This endpoint can be called only after initiating a user-export request via * the `user_export_init` API, and only within the subsequent export window * (i.e., after the export delay has passed and before the request has expired). * * To check on the status of an export request, see the `user_export_list` API. */ userExportComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UserExportCompleteRequest"]; }; }; responses: { 200: components["responses"]["UserExportCompleteResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate registration of a FIDO key * @description Initiate registration of a FIDO key * * Generates a challenge that must be answered to prove ownership of a key */ userRegisterFidoInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoCreateRequest"]; }; }; responses: { 200: components["responses"]["FidoCreateChallengeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize registration of a FIDO key * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ userRegisterFidoComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoCreateChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete FIDO key * @description Delete FIDO key * * Deletes a FIDO key from the user's account (if the key is not the sole MFA factor). MFA is always required. */ userDeleteFido: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired FidoKey * @example FidoKey#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ fido_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initialize TOTP Reset * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ userResetTotpInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody?: { content: { "application/json": components["schemas"]["TotpResetRequest"] | null; }; }; responses: { 200: components["responses"]["TotpInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete TOTP * @description Delete TOTP * * Deletes TOTP from the user's account (if TOTP is not the sole MFA factor). MFA is always required. */ userDeleteTotp: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize resetting TOTP * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ userResetTotpComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify TOTP * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ userVerifyTotp: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List users in organization * @description List users in organization */ listUsersInOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["GetUsersInOrgResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Add a third-party user to the org * @description Add a third-party user to the org */ createOidcUser: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddThirdPartyUserRequest"]; }; }; responses: { 200: components["responses"]["AddThirdPartyUserResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove a third-party user from the org * @description Remove a third-party user from the org */ deleteOidcUser: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcIdentity"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove a user from the org * @description Remove a user from the org */ deleteUser: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update a user's membership in the org * @description Update a user's membership in the org * * Currently allows just enabling/disabling a user in the org. */ updateUserMembership: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateUserMembershipRequest"]; }; }; responses: { 200: components["responses"]["UserInOrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate registration of a FIDO key * @deprecated * @description Initiate registration of a FIDO key * * Generates a challenge that must be answered to prove ownership of a key */ registerFidoInitLegacy: { requestBody: { content: { "application/json": components["schemas"]["FidoCreateRequest"]; }; }; responses: { 200: components["responses"]["FidoCreateChallengeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize registration of a FIDO key * @deprecated * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ registerFidoCompleteLegacy: { requestBody: { content: { "application/json": components["schemas"]["FidoCreateChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initialize TOTP Reset * @deprecated * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ resetTotpInitLegacy: { requestBody?: { content: { "application/json": components["schemas"]["TotpResetRequest"] | null; }; }; responses: { 200: components["responses"]["TotpInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize resetting TOTP * @deprecated * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ resetTotpCompleteLegacy: { requestBody: { content: { "application/json": components["schemas"]["TotpChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify TOTP * @deprecated * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ verifyTotpLegacy: { requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Retrieves all the orgs the user is a part of * @description Retrieves all the orgs the user is a part of */ userOrgs: { responses: { 200: components["responses"]["UserOrgsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Raw Blob * @description Sign Raw Blob * * Signs an arbitrary blob with a given key. * * - ECDSA signatures are serialized as big-endian r and s plus recovery-id * byte v, which can in general take any of the values 0, 1, 2, or 3. * * - EdDSA signatures are serialized in the standard format. * * - BLS signatures are not supported on the blob-sign endpoint. */ blobSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BlobSignRequest"]; }; }; responses: { 200: components["responses"]["BlobSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Record heartbeat * @description Record heartbeat * * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch. */ cube3signerHeartbeat: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody?: { content: { "application/json": components["schemas"]["HeartbeatRequest"] | null; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EVM Transaction * @description Sign EVM Transaction * * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key. * Returns an RLP-encoded transaction with EIP-155 signature. * * The key must be associated with the role and organization on whose behalf this action is called. */ eth1Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded ethereum address of the secp key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eth1SignRequest"]; }; }; responses: { 200: components["responses"]["Eth1SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Validator Request * @description Sign Validator Request * * Signs an eth2 validator request with a given BLS key. * * The key must be associated with the role and organization on whose behalf this action is called. */ eth2Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded validator (BLS) public key with 0x prefix * @example 0x9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eth2SignRequest"]; }; }; responses: { 200: components["responses"]["Eth2SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Stake Deposit * @description Sign Stake Deposit * * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the * provided validator key. Otherwise, we generate a new BLS key. * * When using a pregenerated key, the key must be associated with the role and organization on whose * behalf this action is called. */ stake: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["StakeRequest"]; }; }; responses: { 200: components["responses"]["StakeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Unstake Request * @description Sign Unstake Request * * Handle unstaking request, producing a signed voluntary exit message * that can be posted directly to the Beacon chain. * * The key must be associated with the role and organization on whose behalf this action is called. */ unstake: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded validator (BLS) public key * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UnstakeRequest"]; }; }; responses: { 200: components["responses"]["UnstakeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Refresh Signer Session * @description Refresh Signer Session */ signerSessionRefresh: { parameters: { path: { /** * @description ID of the organization owning the key * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AuthData"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; } export {};