/** * This file was auto-generated by openapi-typescript. * Do not make direct changes to the file. */ /** OneOf type helpers */ type Without = { [P in Exclude]?: never }; type XOR = T | U extends object ? (Without & U) | (Without & T) : T | U; type OneOf = T extends [infer Only] ? Only : T extends [infer A, infer B, ...infer Rest] ? OneOf<[XOR, ...Rest]> : never; export interface paths { "/v0/about_me": { /** * User Info * @description User Info * * Retrieves information about the current user. * * PREFER `GET /v0/orgs/{org_id}/user/me` */ get: operations["aboutMeLegacy"]; }; "/v0/attestation/.well-known/jwks.json": { /** * JWKS endpoint for the attestation key * @description JWKS endpoint for the attestation key * * Returns the public key used to sign Key info attestations. */ get: operations["attestationJwkSet"]; }; "/v0/email/orgs": { /** * List accessible organizations. * @description List accessible organizations. * * Unauthenticated endpoint for retrieving all organizations accessible to a user. * This information is emailed to the provided email address. */ get: operations["email_my_orgs"]; }; "/v0/internal/sentry": { /** * (INTERNAL) Sentry API Proxy * @description (INTERNAL) Sentry API Proxy */ post: operations["sentryApiCallPublic"]; }; "/v0/mmi/v3/.well-known/jwks.json": { /** * JWKS endpoint for MMI * @description JWKS endpoint for MMI * * Returns the public key used to sign JSON Web Tokens for MMI. */ get: operations["mmiJwkSet"]; }; "/v0/mmi/v3/json-rpc": { /** * MMI JSON-RPC endpoint * @description MMI JSON-RPC endpoint * * Handler for all [MMI JSON-RPC](https://docs.metamask-institutional.io/custodian-integration/integration-docs/api/methods) * requests. */ post: operations["mmi"]; }; "/v0/oauth/token": { /** * Token refresh endpoint, compliant with OAuth. * @description Token refresh endpoint, compliant with OAuth. * * The body content type can be either 'application/json' or 'application/x-www-form-urlencoded'. */ post: operations["oauth2TokenRefresh"]; }; "/v0/org/{org_id}": { /** * Get Org * @description Get Org * * Retrieves information about an organization. */ get: operations["getOrg"]; /** * Update Org * @description Update Org * * Update organization attributes (enabled flag, name, and policies). */ patch: operations["updateOrg"]; }; "/v0/org/{org_id}/audit": { /** * Query the audit log. * @description Query the audit log. */ post: operations["queryAuditLog"]; }; "/v0/org/{org_id}/auth_migration/add_identity": { /** * Associate an OIDC identity with an arbitrary user in org . * @description Associate an OIDC identity with an arbitrary user in org . */ post: operations["authMigrationIdentityAdd"]; }; "/v0/org/{org_id}/auth_migration/remove_identity": { /** * Dissociate an OIDC identity from an arbitrary user in org . * @description Dissociate an OIDC identity from an arbitrary user in org . */ post: operations["authMigrationIdentityRemove"]; }; "/v0/org/{org_id}/auth_migration/update_users": { /** * Update existing users' profiles. Currently supports only (re)setting emails. * @description Update existing users' profiles. Currently supports only (re)setting emails. */ post: operations["authMigrationUserUpdate"]; }; "/v0/org/{org_id}/ava/sign/{ava_chain}/{pubkey}": { /** * Sign a serialized Avalanche C/X/P-Chain Message * @description Sign a serialized Avalanche C/X/P-Chain Message * * Signs an Avalanche message with a given SecpEth (C-Chain messages) or * SecpAva (X- and P-Chain messages) key. Currently signing C-Chain messages * with SecpEth key must also be explicitly allowed via `AllowRawBlobSigning` * policy. * * This is a pre-release feature. */ post: operations["avaSerializedTxSign"]; }; "/v0/org/{org_id}/ava/sign/{pubkey}": { /** * Sign JSON-encoded Avalanche X- or P-Chain Message * @description Sign JSON-encoded Avalanche X- or P-Chain Message * * Signs an Avalanche message with a given SecpAva key. * This is a pre-release feature. */ post: operations["avaSign"]; }; "/v0/org/{org_id}/babylon/cov/sign/{pubkey}": { /** * Sign Babylon Covenant Committee Request * @description Sign Babylon Covenant Committee Request * * Signs transactions relevant to a Babylon covenant committee signer, * i.e., Schnorr and adaptor signatures for the unbonding, slashing, and * slash-unbonding outputs of a Babylon staking transaction. */ post: operations["babylonCovSign"]; }; "/v0/org/{org_id}/babylon/eots/nonces/{pubkey}": { /** * Create EOTS nonces * @description Create EOTS nonces * * Generates a set of Babylon EOTS nonces for a specified chain-id, starting at a * specified block height. */ post: operations["createEotsNonces"]; }; "/v0/org/{org_id}/babylon/eots/sign/{pubkey}": { /** * Create an EOTS signature * @description Create an EOTS signature * * Generates an EOTS signature for the specified chain-id, block height, and message. */ post: operations["eotsSign"]; }; "/v0/org/{org_id}/babylon/registration/{pubkey}": { /** * Sign Babylon Staking Registration * @description Sign Babylon Staking Registration * * Creates and signs the data needed to register a Phase-2 or Phase-3 * Babylon stake. This includes the deposit and unbonding transactions, * two slashing transactions, the slashing signatures, and the proof of * possession. * * Note that it is also possible to generate this registration data by * making four calls to the Babylon staking API, plus one call to the * PSBT signing API to generate the BIP-322 proof of possession. The * registration API generates the same data but is easier to use. * * Note that this action can only be called with a Taproot key. If your * deposit transaction spends UTXOs that are controlled by other keys, * you can submit the 'deposit' PSBT to the PSBT signing API one or more * times to generate the required signatures. * * For more information, consult the * [Babylon documentation](https://github.com/babylonlabs-io/babylon/blob/release/v1.x/docs/register-bitcoin-stake.md). * * This is a pre-release feature. */ post: operations["babylonRegistration"]; }; "/v0/org/{org_id}/babylon/staking/{pubkey}": { /** * Sign Babylon Staking Transaction * @description Sign Babylon Staking Transaction * * Creates and signs transactions related to Babylon staking (i.e., * deposit, early unbond, withdrawal). The return value is a Pre-Signed * Bitcoin Transaction (PSBT), as defined in BIP-174, which matches the * format used in most Babylon tooling. * * The 'deposit' action can be used with either Segwit (i.e., SecpBtc/SecpBtcTest) * or Taproot (i.e., TaprootBtc/TaprootBtcTest) keys. The remaining actions can be * used only with Taproot keys. * * This is a pre-release feature. */ post: operations["babylonStaking"]; }; "/v0/org/{org_id}/btc/message/sign/{pubkey}": { /** * Sign a Bitcoin message. * @description Sign a Bitcoin message. * * Signs a message using BIP137 message signing with a given Secp256k1 key. */ post: operations["btcMessageSign"]; }; "/v0/org/{org_id}/btc/psbt/sign/{pubkey}": { /** * Sign a Partially Signed Bitcoin Transaction (PSBT) * @description Sign a Partially Signed Bitcoin Transaction (PSBT) * * Signs all inputs of the supplied PSBT v0 (BIP-174) that pertain to the * 'pubkey' specified in the request, which can be either a Taproot or a * Segwit key. For Segwit keys, CubeSigner-specific deterministic tweaking * can be applied to 'pubkey' before signing, on a per-input basis. (See the * CubeSigner documentation for more information on Segwit tweaking.) * * When calling with a segwit key the required scope is 'sign:btc:psbt:segwit'. * For a taproot key, the scope is 'sign:btc:psbt:taproot'. Either type of key * can be used with the 'sign:btc:psbt' scope. * * This is a pre-release feature. */ post: operations["psbtSign"]; }; "/v0/org/{org_id}/btc/sign/{pubkey}": { /** * Sign Bitcoin Segwit Transaction * @description Sign Bitcoin Segwit Transaction * * Signs a Bitcoin Segwit transaction with a given key. * This is a pre-release feature. */ post: operations["btcSign"]; }; "/v0/org/{org_id}/btc/taproot/sign/{pubkey}": { /** * Sign Bitcoin Taproot Transaction * @description Sign Bitcoin Taproot Transaction * * Signs a Bitcoin Taproot transaction with a given key. * This is a pre-release feature. */ post: operations["btcTaprootSign"]; }; "/v0/org/{org_id}/contacts": { /** * List Contacts * @description List Contacts * * List all contacts in the org. * Any org member is allowed to list all contacts in the org. * * ## Search Condition * The search condition is optional. * * - If the search condition starts with "label:...", this list will only hold contacts with * the label provided after the ":". For example, "label:cubist:erc20_token" would return contacts that * hold the label "cubist:erc20_token". * * - Otherwise, the result will contain only the contacts who have an address starting with, or * equaling, the given search string. For example, "0xee" would return all contacts holding an * address starting with "0xee". The search is case-insensitive. * * If a search term is defined, we do not guarantee * the number of results in a page. The behavior of this parameter may change * in the future (for example, making results more strictly paginated or * performing a fuzzy search rather than a prefix search). */ get: operations["listContacts"]; /** * Create Contact * @description Create Contact * * Creates a new contact in the organization-wide address book. The * user making the request is the owner of the contact, giving them edit access * to the contact along with the org owners. */ post: operations["createContact"]; }; "/v0/org/{org_id}/contacts/by-address": { /** * Lookup Contacts by Address * @description Lookup Contacts by Address * * Returns all contacts in the org that have the given address. * * When querying with an EVM address without a chain, this endpoint returns * contacts with that address on *any* chain, including those without a chain * defined. */ post: operations["lookupContactsByAddress"]; }; "/v0/org/{org_id}/contacts/{contact_id}": { /** * Get Contact * @description Get Contact * * Returns the properties of a Contact. */ get: operations["getContact"]; /** * Delete Contact * @description Delete Contact * * Delete a contact, specified by its ID. * * Only the contact owner and org owners are allowed to delete contacts. * Additionally, the contact's edit policy (if set) must permit the deletion. */ delete: operations["deleteContact"]; /** * Update Contact * @description Update Contact * * Updates an existing contact in the organization-wide address book. Only * the contact owner or an org owner can update contacts. * * *Updates will overwrite the existing value of the field.* */ patch: operations["updateContact"]; }; "/v0/org/{org_id}/counts": { /** * Get current counts of users and keys within an org. * @description Get current counts of users and keys within an org. */ get: operations["counts"]; }; "/v0/org/{org_id}/derive_key": { /** * Derive Key From Long-Lived Mnemonic * @deprecated * @description Derive Key From Long-Lived Mnemonic * * Derives a key of a specified type using a supplied derivation path and an * existing long-lived mnemonic. */ put: operations["deriveKeyLegacy"]; }; "/v0/org/{org_id}/derive_keys": { /** * Derive Key From New Or Existing Long-Lived Mnemonic * @description Derive Key From New Or Existing Long-Lived Mnemonic * * Uses either a new or existing long-lived mnemonic to derive keys of * one or more specified types via specified derivation paths. */ put: operations["deriveKey"]; }; "/v0/org/{org_id}/diffie_hellman/{key_id}": { /** * Compute Diffie Hellman shared secret * @description Compute Diffie Hellman shared secret * * For a set of elliptic curve points (P_1, ..., P_i), computes the Diffie Hellman * shared secret (Q_1, ..., Qi) = (sk * P_1, ... sk * P_i), for sk the secret key. * Points are specified in a curve-dependent format. See CubeSigner documentation * for more details. * * The user can optionally specify a NIST P-256 public key, in which case the result * will be encrypted to the public key using RFC9180 HPKE(P-256, HKDF-SHA256) with * AES-256-GCM as the symmetric cipher. In this case, the resulting ciphertext will * contain a serialized JSON blob containing the vector of shared secrets in the same * order they were specified in the request. * * If the user does not specify a public key, the resulting shared secrets will be * returned unencrypted. In this case, the caller should sample a random value r * modulo the group order and mask the requested points as (r * P_1, ..., r * P_i). * The result will be (r * sk * P_1, ..., r * sk * P_i), which can be unmasked by * first computing r^-1, the multiplicative inverse of r modulo the group order, * then computing a scalar multiplication of each returned point with r^-1. * * There is little practical security difference between these two approaches. The * client is free to choose the one that is easier from an implementation perspective. */ post: operations["diffieHellmanExchange"]; }; "/v0/org/{org_id}/emails/{purpose}": { /** * Get Email Template * @description Get Email Template * * Returns the email template for a given purpose. */ get: operations["getEmailConfig"]; /** * Configure Email Template * @description Configure Email Template */ put: operations["configureEmail"]; /** * Delete Email Template * @description Delete Email Template */ delete: operations["deleteEmailConfig"]; }; "/v0/org/{org_id}/evm/eip191/sign/{pubkey}": { /** * Sign EIP-191 Data * @description Sign EIP-191 Data * * Signs a message using EIP-191 personal_sign with a given Secp256k1 key. */ post: operations["eip191Sign"]; }; "/v0/org/{org_id}/evm/eip712/sign/{pubkey}": { /** * Sign EIP-712 Typed Data * @description Sign EIP-712 Typed Data * * Signs typed data according to EIP-712 with a given Secp256k1 key. */ post: operations["eip712Sign"]; }; "/v0/org/{org_id}/evm/eip7702/sign/{pubkey}": { /** * Sign an EIP-7702 Authorization * @description Sign an EIP-7702 Authorization * * Signs an EIP-7702 authorization tuple `(chain_id, address, nonce)` with a given * Secp256k1 key. The resulting 65-byte signature (`r || s || y_parity`) can be used to * assemble a `SignedAuthorization` for an EIP-7702 set-code transaction. */ post: operations["eip7702Sign"]; }; "/v0/org/{org_id}/export/{key_id}": { /** * Get an Org-Export Ciphertext * @description Get an Org-Export Ciphertext * * Returns the export ciphertext associated with the provided key-id. * In order to use this API, you must be an org owner and your org must * be configured for org export and for API-based export delivery. */ get: operations["getOrgExport"]; }; "/v0/org/{org_id}/identity": { /** * List associated OIDC identities with the current user. * @description List associated OIDC identities with the current user. */ get: operations["listOidcIdentities"]; /** * Associate an OIDC identity with the current user in org . * @description Associate an OIDC identity with the current user in org . * * Alien users are allowed to call this endpoint, but for them MFA is required * (unless they are registering an email-otp identity matching their current email); * additionally, limits may apply to how many identities that may register. */ post: operations["addOidcIdentity"]; /** * Remove an OIDC identity from the current user's account in org . * @description Remove an OIDC identity from the current user's account in org . */ delete: operations["removeOidcIdentity"]; }; "/v0/org/{org_id}/identity/prove": { /** * Create [IdentityProof] from CubeSigner user session * @description Create [IdentityProof] from CubeSigner user session * * This route can be used to prove to another party that a user has a * valid CubeSigner session. * * Clients are intended to call this route and pass the returned evidence * to another service which will verify it by making a request to `/v0/org//identity/verify`. */ post: operations["createProofCubeSigner"]; }; "/v0/org/{org_id}/identity/prove/oidc": { /** * Create [IdentityProof] from OIDC token * @description Create [IdentityProof] from OIDC token * * Exchange an OIDC ID token (passed via the `Authorization` header) for a proof of authentication. * * This route can be used to prove to another party that a user has met the * authentication requirements (allowed issuers & audiences) for CubeSigner * without leaking their credentials. * * Clients are intended to call this route and pass the returned evidence to another service * which will verify it by making a request to `/v0/org//identity/verify`. */ post: operations["createProofOidc"]; }; "/v0/org/{org_id}/identity/verify": { /** * Verify identity proof * @description Verify identity proof * * Allows a third-party to validate proof of authentication. * * When a third-party is provided an [IdentityProof] object, they must check its * veracity by calling this endpoint */ post: operations["verifyProof"]; }; "/v0/org/{org_id}/idp/authenticate": { /** * Authenticate * @description Authenticate * * This endpoint exchanges an email & password for an OIDC token */ post: operations["idpAuthenticate"]; }; "/v0/org/{org_id}/idp/password_reset": { /** * Request Password Reset * @description Request Password Reset * * This endpoint generates an OIDC token without a signature (of the form `{header}.{payload}.`), * and sends the signature to the user's email. Client applications can reconstruct the token * by concatenating the `{header}.{payload}.` with the signature, producing a valid OIDC token of * the form `{header}.{payload}.{signature}`. The token can then be used to authenticate the user * when performing the `idp_password_reset_confirm` request. */ post: operations["idpPasswordResetRequest"]; /** * Confirm Password Reset * @description Confirm Password Reset * * This endpoint allows IDP users to reset their password * using a token they have received in their email. */ patch: operations["idpPasswordResetConfirm"]; }; "/v0/org/{org_id}/import_key": { /** * Create Key-Import Key * @description Create Key-Import Key * * Generate an ephemeral key that a client can use for key-import encryption. */ get: operations["createKeyImportKey"]; /** * Import Key * @description Import Key * * Securely imports an existing key using a previously generated key-import key. */ put: operations["importKey"]; }; "/v0/org/{org_id}/info": { /** * Public Org Info * @description Public Org Info * * Unauthenticated endpoint that returns publicly-available information about an organization. */ get: operations["public_org_info"]; }; "/v0/org/{org_id}/internal/custom_chain_rpc": { /** * (INTERNAL) Custom chain RPC proxy * @description (INTERNAL) Custom chain RPC proxy */ post: operations["customChainRpcCall"]; }; "/v0/org/{org_id}/internal/esplora": { /** * (INTERNAL) Esplora API Proxy * @description (INTERNAL) Esplora API Proxy */ post: operations["esploraApiCall"]; }; "/v0/org/{org_id}/internal/sentry": { /** * (INTERNAL) Authenticated Sentry API Proxy * @description (INTERNAL) Authenticated Sentry API Proxy */ post: operations["sentryApiCall"]; }; "/v0/org/{org_id}/invitation/accept": { /** * Accept an invitation * @description Accept an invitation * * This endpoint allows idp users to register using a token they have received in their email */ post: operations["invitationAccept"]; }; "/v0/org/{org_id}/invitations": { /** * List pending invitations * @description List pending invitations * * Returns all pending invitations for the organization, i.e., those that have neither * been accepted nor canceled, and have not expired. */ get: operations["listInvitations"]; /** * Cancel a pending invitation * @description Cancel a pending invitation * * Removes a pending invitation from the organization. If no pending invitation * exists for the given email address, a not-found error is returned. */ delete: operations["cancelInvitation"]; }; "/v0/org/{org_id}/invite": { /** * Invite User * @description Invite User * * Creates a new user in an existing org and sends that user an invite email. */ post: operations["invite"]; }; "/v0/org/{org_id}/keys": { /** * List Keys * @description List Keys * * Gets the list of accessible keys in a given org (to org owner, all org keys * are accessible; to members, only their own keys are accessible). * * If a search condition is, the result will contain only the keys whose either * material ID or metadata contain the search condition string. * * NOTE that if pagination is used and a page limit is set, the returned result * set may contain either FEWER or MORE elements than the requested page limit. */ get: operations["listKeysInOrg"]; /** * Create Key * @description Create Key * * Creates one or more new keys of the specified type. */ post: operations["createKey"]; }; "/v0/org/{org_id}/keys/{key_id}": { /** * Get Key * @description Get Key * * Returns the properties of a key. */ get: operations["getKeyInOrg"]; /** * Delete Key * @description Delete Key * * Deletes a key specified by its ID. * * Only the key owner and org owners are allowed to delete keys. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["deleteKey"]; /** * Update Key * @description Update Key * * Enable or disable a key. The user must be the owner of the key or * organization to perform this action. * * For each requested update, the session must have the corresponding 'manage:key:update:_' scope; * if no updates are requested, the session must have 'manage:key:get'. */ patch: operations["updateKey"]; }; "/v0/org/{org_id}/keys/{key_id}/attest": { /** * Attest to Key Properties * @description Attest to Key Properties * * The response is a JWT whose claims are the key properties. */ get: operations["attestKey"]; }; "/v0/org/{org_id}/keys/{key_id}/roles": { /** * List Key Roles * @description List Key Roles * * Get all roles the key is in */ get: operations["listKeyRoles"]; }; "/v0/org/{org_id}/keys/{key_id}/tx": { /** * List Historical Transactions * @description List Historical Transactions * * Returns a sorted, paginated list of transactions signed by a given key, * ordered from most recent first. */ get: operations["listHistoricalKeyTx"]; }; "/v0/org/{org_id}/keys/{key_type}/{material_id}": { /** * Get Key by Material ID * @description Get Key by Material ID * * Returns the properties of a key. */ get: operations["getKeyByMaterialId"]; }; "/v0/org/{org_id}/metrics": { /** * Query org metrics. * @description Query org metrics. * * Metrics summarize usage information about your CubeSigner organization over time. For example, * you can call this endpoint find out: * * - the average number of keys over the last month, * - the average number monthly users over the last year, * - the total number of transactions signed last week, * - how the number of different API requests was trending day-by-day over the last week/month/year, etc. * * Each metric kind can have one or more dimensions, to further specify the org property it describes. * For example, the `UserCount` metrics have a membership dimensions to specify the kind of user membership * in the organization ("Owner" vs. "Member" vs. "Alien"). */ post: operations["queryMetrics"]; }; "/v0/org/{org_id}/mfa": { /** * List Pending MFA Requests * @description List Pending MFA Requests * * Retrieves and returns all pending MFA requests that are accessible to the current session, * i.e., those created by the current session identity plus those in which the current user * is listed as an approver * * NOTE that if pagination is used and a page limit is set, the returned result * set may contain either FEWER or MORE elements than the requested page limit. * In particular, legacy MFA requests are not paginated: every accessible one * is returned in the first page, on top of the page limit. */ get: operations["mfaList"]; }; "/v0/org/{org_id}/mfa/{mfa_id}": { /** * Get Pending MFA Request * @description Get Pending MFA Request * * Retrieves and returns a pending MFA request by its id. */ get: operations["mfaGet"]; /** * Approve or Reject MFA Request * @description Approve or Reject MFA Request * * Approve or reject request after logging in with CubeSigner. * * If approving, adds the currently-logged user as an approver * of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of * approvers is reached, the MFA request is approved; the confirmation receipt can be used to * resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteCs"]; }; "/v0/org/{org_id}/mfa/{mfa_id}/email": { /** * Initiate an Email OTP MFA Approval/Rejection * @description Initiate an Email OTP MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using Email OTP. */ post: operations["mfaEmailInit"]; /** * Finalize a Email OTP MFA Approval/Rejection. * @description Finalize a Email OTP MFA Approval/Rejection. * * The request should contain the full JWT obtained by concatenating the * partial token returned by the `mfa_email_init` endpoint and the signature * emailed to the user issuing the request. * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteEmailComplete"]; }; "/v0/org/{org_id}/mfa/{mfa_id}/fido": { /** * Initiate a FIDO MFA Approval/Rejection * @description Initiate a FIDO MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using FIDO. */ post: operations["mfaFidoInit"]; /** * Finalize a FIDO MFA Approval/Rejection * @description Finalize a FIDO MFA Approval/Rejection * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteFidoComplete"]; }; "/v0/org/{org_id}/mfa/{mfa_id}/totp": { /** * Approve/Reject a TOTP MFA Request * @description Approve/Reject a TOTP MFA Request * * If approving, adds the current user as approver to a pending MFA request by * providing TOTP code. If the required number of approvers is reached, the MFA request is * approved; the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ patch: operations["mfaVoteTotp"]; }; "/v0/org/{org_id}/mmi/v3/messages": { /** * List pending MMI requests * @description List pending MMI requests * * Retrieves and returns all pending MMI messages accessible to the current session identity, i.e., * - a role session can access only the messages created by that role * - a user session can access the messages created by either that user or any role which the user is a member of */ get: operations["mmiMessageList"]; }; "/v0/org/{org_id}/mmi/v3/messages/{msg_id}": { /** * Get an MMI request * @description Get an MMI request * * Retrieves a pending MMI request by its ID. */ get: operations["mmiMessageGet"]; /** * Delete an MMI request * @description Delete an MMI request * * Rejects an existing MMI request and then deletes it from the database. */ delete: operations["mmiMessageDelete"]; }; "/v0/org/{org_id}/mmi/v3/messages/{msg_id}/reject": { /** * Reject an MMI request * @description Reject an MMI request * * Rejects a pending MMI request. The record of the MMI request is kept in * the database until it expires or is explicitly deleted. * * Returns the updated request information. */ post: operations["mmiMessageReject"]; }; "/v0/org/{org_id}/mmi/v3/messages/{msg_id}/sign": { /** * Approve and sign an MMI request * @description Approve and sign an MMI request * * Signs a pending request that was generated through the MMI JSON RPC endpoint. * The signature is stored with the pending message and the updated request info is returned. * * The message should be associated with the organization this is called from, * and the user should be the owner of the corresponding message's key. */ post: operations["mmiMessageSign"]; }; "/v0/org/{org_id}/oauth2/twitter": { /** * Mint an OIDC ID token for Twitter * @description Mint an OIDC ID token for Twitter * * This function acts identically to Twitter's [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint, * but extends the output with an `id_token`. * * This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token. * Callers must request *at least* scopes `tweet.read` and `users.read` during auth with twitter. * * By default, the id token does not contain a confirmed email; * callers can request this field be populated by requesting the `users.email` scope * and adding `fetch_email` as a URL parameter to this route. * * * > [!IMPORTANT] * > This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter. */ post: operations["oauth2Twitter"]; }; "/v0/org/{org_id}/oidc": { /** * Login with OIDC * @description Login with OIDC * * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session. * * MFA is required when: * - an MFA policy is explicitly attached to the user logging in * (e.g., an org owner can do that at user creation time to require certain kind of MFA) * - the user has at least 1 MFA factor configured */ post: operations["oidcAuth"]; }; "/v0/org/{org_id}/oidc/email-otp": { /** * Initiate login via email token * @description Initiate login via email token * * This endpoint generates an OIDC token without a signature (of the form `header.payload.`), and sends the signature to the user's email. * Client applications can reconstruct the token by concatenating the `partial_token` with the signature, producing a valid OIDC token of the form `header.payload.signature` * The token can then be used to authenticate the user. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID * > 2. Have an email sender configured for OTPs */ post: operations["emailOtpAuth"]; }; "/v0/org/{org_id}/oidc/siwe": { /** * Initiate login via Sign-in With Ethereum (SIWE). * @description Initiate login via Sign-in With Ethereum (SIWE). * * This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) * to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard * OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID */ post: operations["siweInit"]; /** * Complete login via Sign-in With Ethereum (SIWE) * @description Complete login via Sign-in With Ethereum (SIWE) * * If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint * generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID */ patch: operations["siweComplete"]; }; "/v0/org/{org_id}/oidc/siws": { /** * Initiate login via Sign-in With Solana (SIWS). * @description Initiate login via Sign-in With Solana (SIWS). * * This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) * to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard * OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID */ post: operations["siwsInit"]; /** * Complete login via Sign-in With Solana (SIWS) * @description Complete login via Sign-in With Solana (SIWS) * * If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint * generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID */ patch: operations["siwsComplete"]; }; "/v0/org/{org_id}/oidc/telegram": { /** * Allows a user to authenticate with the telegram API using the tgWebAppData value * @description Allows a user to authenticate with the telegram API using the tgWebAppData value * The token has the following properties: * - The `sub` field is the telegram user ID * - The `iss` field depends on the chosen environment: * - `https://shim.oauth2.cubist.dev/telegram/production` for the production environment * - `https://shim.oauth2.cubist.dev/telegram/test` for the test environment * - The `aud` field is the provided telegram bot ID * - The `exp` field is derived from the `auth_date` field in the telegram data * * Fails if the telegram data is invalid or the signature is invalid */ post: operations["telegramAuth"]; }; "/v0/org/{org_id}/orgs": { /** * Create Org * @description Create Org * * Creates a new organization. The new org is a child of the * current org and inherits its key-export policy. The new org * is created with one owner, the caller of this API. */ post: operations["createOrg"]; }; "/v0/org/{org_id}/policies": { /** * List Policies * @description List Policies * * Returns the list of all policies in the Org. */ get: operations["listPolicies"]; /** * Create Policy * @description Create Policy * * Creates a new named policy in the organization. The user making the request is the * owner of the policy, giving them edit access to the policy along with the org owners. */ post: operations["createPolicy"]; }; "/v0/org/{org_id}/policies/{policy_id}": { /** * Delete Policy * @description Delete Policy * * Delete the named policy with the given name or id. */ delete: operations["deletePolicy"]; /** * Update Policy * @description Update Policy * * Updates the policy with the given name or id. */ patch: operations["updatePolicy"]; }; "/v0/org/{org_id}/policies/{policy_id}/logs": { /** * Get Policy Logs * @description Get Policy Logs * * Returns the logs for the given policy, within the given timeframe. */ post: operations["getPolicyLogs"]; }; "/v0/org/{org_id}/policies/{policy_id}/{version}": { /** * Get Policy * @description Get Policy * * Returns the specified version or latest of a named policy with the given name or id. */ get: operations["getPolicy"]; }; "/v0/org/{org_id}/policies/{policy_id}/{version}/invoke": { /** * Invoke Policy * @description Invoke Policy * * Invokes the [NamedPolicy] with the given ID with the given request information. * It is only supported for Wasm policies. */ post: operations["invokePolicy"]; }; "/v0/org/{org_id}/policy/buckets": { /** * List Buckets * @description List Buckets * * List available meta information about all policy KV store buckets in the org. */ get: operations["listPolicyBuckets"]; }; "/v0/org/{org_id}/policy/buckets/{bucket_name}": { /** * Get Bucket * @description Get Bucket * * Returns the meta information of a policy KV store bucket. */ get: operations["getPolicyBucket"]; /** * Update Bucket * @description Update Bucket * * Updates meta information for an existing policy KV store bucket. */ patch: operations["updatePolicyBucket"]; }; "/v0/org/{org_id}/policy/import_key": { /** * Create Policy Import Key * @description Create Policy Import Key * * Generate an ephemeral key that a client can use for encrypting data related to Wasm * policies (e.g., policy secrets). */ get: operations["createPolicyImportKey"]; }; "/v0/org/{org_id}/policy/secrets": { /** * Get the org-wide policy secrets. * @description Get the org-wide policy secrets. * * Note that this only returns the keys for the secrets, omitting the values. * The values are secret and are not accessible outside Wasm policy execution. */ get: operations["getPolicySecrets"]; /** * Update org-level policy secrets * @description Update org-level policy secrets * * The provided secrets will replace any existing org-level secrets. * It fails if the secrets weren't previously created. * * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ patch: operations["updatePolicySecrets"]; }; "/v0/org/{org_id}/policy/secrets/{secret_name}": { /** * Create or overwrite an org-level policy secret. * @description Create or overwrite an org-level policy secret. * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ put: operations["setPolicySecret"]; /** * Delete an org-level policy secret. * @description Delete an org-level policy secret. * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ delete: operations["deletePolicySecret"]; }; "/v0/org/{org_id}/policy/wasm": { /** * Upload Wasm Policy * @description Upload Wasm Policy * * Returns a signed URL for uploading a wasm policy to CubeSigner. The policy will be * deleted if not attached to a [NamedPolicy] soon after the upload has been completed. */ post: operations["uploadWasmPolicy"]; }; "/v0/org/{org_id}/roles": { /** * List Roles * @description List Roles * * Retrieves all roles in an organization that the current user is allowed to access. */ get: operations["listRoles"]; /** * Create Role * @description Create Role * * Creates a new role in an organization. Unless the logged-in user * is the owner, they are automatically added to the newly created role. */ post: operations["createRole"]; }; "/v0/org/{org_id}/roles/{role_id}": { /** * Get Role * @description Get Role * * Retrieves information about a role in an organization */ get: operations["getRole"]; /** * Delete Role * @description Delete Role * * Deletes a role in an organization. * * Only users in the role can perform this action. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["deleteRole"]; /** * Update Role * @description Update Role * * Enables or disables a role (this requires the `manage:role:update:enable` scope). * Updates the role's policies (this requires the `manage:role:update:policy` scope). * Updates the role's edit policies (this requires the `manage:role:update:editPolicy` scope). * * The user must be in the role or an owner of the organization. * Additionally, the role's edit policy (if set) must permit the update. */ patch: operations["updateRole"]; }; "/v0/org/{org_id}/roles/{role_id}/add_keys": { /** * Add Keys * @description Add Keys * * Adds a list of existing keys to an existing role. * * The key owner is allowed to add their key to any role that they are in. * * In "org custody" model only, org owners are allowed to add any key to any role. * * In all cases: the role's edit policy, as well as the edit policy of each of the keys, must permit the update. * * Each request to this endpoint can add, at maximum, 32 keys. */ put: operations["addKeysToRole"]; }; "/v0/org/{org_id}/roles/{role_id}/add_user/{user_id}": { /** * Add User * @description Add User * * Adds an existing user to an existing role. * * Only users in the role or org owners can add users to a role. * Additionally, the role's edit policy (if set) must permit the update. */ put: operations["addUserToRole"]; }; "/v0/org/{org_id}/roles/{role_id}/attest": { /** * Attest to Role Properties * @description Attest to Role Properties * * The response is a JWT whose claims are the requested role properties. */ get: operations["attestRole"]; }; "/v0/org/{org_id}/roles/{role_id}/keys": { /** * List Role Keys * @description List Role Keys * * Returns an array of all keys in a role. */ get: operations["listRoleKeys"]; }; "/v0/org/{org_id}/roles/{role_id}/keys/{key_id}": { /** * Get a Key in Role * @description Get a Key in Role * * Returns the key-in-role information for a given key and role. If `details` is set to `true`, * this endpoint returns detailed key information. */ get: operations["getRoleKey"]; /** * Remove Key * @description Remove Key * * Removes a given key from a role. * * Only users in the role or org owners can remove keys from a role. * Additionally, both the role's and the key's edit policy must permit the update. */ delete: operations["removeKeyFromRole"]; }; "/v0/org/{org_id}/roles/{role_id}/tokens": { /** * Create Token * @description Create Token * * Creates a new access token for a given role (to be used as "API Key" for all signing actions). * The `restricted_actions` field on the [Role] determines the membership role that is required to * create tokens. */ post: operations["createRoleToken"]; }; "/v0/org/{org_id}/roles/{role_id}/tx": { /** * List Historical Transactions * @description List Historical Transactions * * Returns a sorted, paginated list of transactions signed by the given role, * ordered from most recent first. */ get: operations["listHistoricalRoleTx"]; }; "/v0/org/{org_id}/roles/{role_id}/users": { /** * List Role Users. * @description List Role Users. * * Returns an array of all users who have access to a role. */ get: operations["listRoleUsers"]; }; "/v0/org/{org_id}/roles/{role_id}/users/{user_id}": { /** * Remove User * @description Remove User * * Removes an existing user from an existing role. * * Only users in the role or org owners can remove users from a role. * Additionally, the role's edit policy (if set) must permit the update. */ delete: operations["removeUserFromRole"]; }; "/v0/org/{org_id}/rpc": { /** * High-level RPC endpoint. * @description High-level RPC endpoint. */ post: operations["rpcApi"]; }; "/v0/org/{org_id}/session": { /** * List sessions * @description List sessions * * If no query parameters are provided, all active sessions for the current user are returned. * * If a `role` query parameter is provided, all active sessions for the selected role are returned * (asserting first that the current user has permissions to read sessions for that role). * * If a `role_created_by` query parameter is provided, all active **role** sessions created by that * user are returned (gated by the same permissions as listing that user's own sessions: the * current user must be that user or an org owner). When combined with `role`, the result is * further restricted to the sessions created by that user for the given role; the permission model * is unchanged. The `user` selector cannot be combined with `role` or `role_created_by`. */ get: operations["listSessions"]; /** * Create new user session (management and/or signing) * @description Create new user session (management and/or signing) * * Creates a new user session, silently truncating requested session and auth lifetimes to be at * most requestor's session and auth lifetime, respectively. To extend the requested lifetimes past * the requestor's, set the `extend_lifetimes` flag in the request body (in which case MFA will * be required). */ post: operations["createSession"]; /** * Revoke ALL existing user or role session(s) * @description Revoke ALL existing user or role session(s) * * Immediately revokes existing sessions, preventing them from being used or refreshed. * * If no query params are provided, **ALL** sessions for the **CURRENT USER** are revoked * (to revoke just the current user session, use `DELETE /v0/org//session/self`) * * If a `role` query parameter is provided, **ALL** session for **THAT ROLE** are revoked * (if the current user has permissions to revoke sessions for the role). * * If a `role_created_by` query parameter is provided, **ROLE** sessions created by **THAT USER** * are revoked (gated by the same permissions as revoking that user's own sessions: the current * user must be that user or an org owner). User sessions are not affected. Unless the current * user is an org owner, only sessions for roles the current user is **still a member of** are * revoked (so a user cannot revoke sessions for a role they have since been removed from); org * owners revoke across all roles. * * If **both** a `role` and a `role_created_by` query parameter are provided, the selection above * is narrowed to only the sessions created by **THAT USER** for **THAT ROLE**. The permission * model is unchanged from the `role_created_by`-only case (the current user must be that user or * an org owner, and non-owners are still limited to roles they are a member of); `role` is purely * an additional filter. * * The `user` selector cannot be combined with `role` or `role_created_by`. */ delete: operations["revokeSessions"]; }; "/v0/org/{org_id}/session/self": { /** * Revoke current session * @description Revoke current session * * Immediately revokes the current session, preventing it from being used or refreshed */ delete: operations["revokeCurrentSession"]; }; "/v0/org/{org_id}/session/{session_id}": { /** * Get session information * @description Get session information */ get: operations["getSession"]; /** * Revoke a session * @description Revoke a session * * Immediately revokes an existing session, preventing it from being used or refreshed */ delete: operations["revokeSession"]; }; "/v0/org/{org_id}/solana/sign/{pubkey}": { /** * Sign Solana Message * @description Sign Solana Message * * Signs a Solana message with a given key. * This is a pre-release feature. */ post: operations["solanaSign"]; }; "/v0/org/{org_id}/sui/sign/{pubkey}": { /** * Sign a serialized SUI transaction. * @description Sign a serialized SUI transaction. * * This is a pre-release feature. */ post: operations["suiSign"]; }; "/v0/org/{org_id}/tendermint/sign/{pubkey}": { /** * Sign a tendermint message. * @description Sign a tendermint message. * * Signs the given base-64 encoded vote or proposal with the given tendermint key. */ post: operations["tendermintSign"]; }; "/v0/org/{org_id}/token/keys": { /** * Get Token-Accessible Keys * @description Get Token-Accessible Keys * * Retrieves the keys that a user or role session can access. */ get: operations["listTokenKeys"]; }; "/v0/org/{org_id}/user/me": { /** * User Info * @description User Info * * Retrieves information about the current user. */ get: operations["aboutMe"]; }; "/v0/org/{org_id}/user/me/email": { /** * Initiate Reset Verified Email Flow * @description Initiate Reset Verified Email Flow */ post: operations["userResetEmailInit"]; /** * Finalize a Reset Verified Email Flow * @description Finalize a Reset Verified Email Flow */ patch: operations["userResetEmailComplete"]; }; "/v0/org/{org_id}/user/me/export": { /** * List outstanding user-export requests * @description List outstanding user-export requests */ get: operations["userExportList"]; /** * Initiate a user-export request * @description Initiate a user-export request * * This starts a delay (whose length is determined by Org-wide settings) * before export can be completed, and returns a ticket that can be used * to complete the export once the timer has expired. * * Only one user-export request can be active for a given key. If there * is already an active export, this endpoint will return an error. To * create a new request, first delete the existing one. */ post: operations["userExportInit"]; /** * Delete an existing user-export request * @description Delete an existing user-export request */ delete: operations["userExportDelete"]; /** * Complete a user-export request * @description Complete a user-export request * * This endpoint can be called only after initiating a user-export request via * the `user_export_init` API, and only within the subsequent export window * (i.e., after the export delay has passed and before the request has expired). * * To check on the status of an export request, see the `user_export_list` API. */ patch: operations["userExportComplete"]; }; "/v0/org/{org_id}/user/me/fido": { /** * Initiate registration of a FIDO key. * @description Initiate registration of a FIDO key. * * If a discoverable key is requested, user verification (PIN) is required. * * Generates a challenge that must be answered to prove ownership of a key. */ post: operations["userRegisterFidoInit"]; /** * Finalize registration of a FIDO key * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ patch: operations["userRegisterFidoComplete"]; }; "/v0/org/{org_id}/user/me/fido/{fido_id}": { /** * Delete FIDO key * @description Delete FIDO key * * Deletes a FIDO key from the user's account (if the key is not the sole MFA factor). MFA is always required. */ delete: operations["userDeleteFido"]; }; "/v0/org/{org_id}/user/me/totp": { /** * Initialize TOTP Reset * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ post: operations["userResetTotpInit"]; /** * Delete TOTP * @description Delete TOTP * * Deletes TOTP from the user's account (if TOTP is not the sole MFA factor). MFA is always required. */ delete: operations["userDeleteTotp"]; /** * Finalize resetting TOTP * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ patch: operations["userResetTotpComplete"]; }; "/v0/org/{org_id}/user/me/totp/verify": { /** * Verify TOTP * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ post: operations["userVerifyTotp"]; }; "/v0/org/{org_id}/users": { /** * List users in organization * @description List users in organization * * If a query is defined, the result will contain only the users whose name or * email contain the query string. NOTE that if pagination is used and a page * limit is set, the returned result set may contain FEWER elements than the * requested page limit. */ get: operations["listUsersInOrg"]; /** * Add a third-party user to the org * @description Add a third-party user to the org */ post: operations["createOidcUser"]; }; "/v0/org/{org_id}/users/email/{email}": { /** * Get user by email. * @description Get user by email. * * The search includes all users and their third-party identities. */ get: operations["getUserInOrgByEmail"]; }; "/v0/org/{org_id}/users/oidc": { /** * Remove a third-party user from the org * @description Remove a third-party user from the org */ delete: operations["deleteOidcUser"]; }; "/v0/org/{org_id}/users/oidc/{iss}/{sub}": { /** * Get a user by their OIDC identity * @description Get a user by their OIDC identity * * Retrieves a user in the organization by their OIDC issuer and subject. */ get: operations["getUserInOrgByOidc"]; }; "/v0/org/{org_id}/users/reset_mfa": { /** * Initialize MFA reset for user * @description Initialize MFA reset for user */ post: operations["resetMemberMfa"]; /** * Complete MFA reset for user * @description Complete MFA reset for user */ patch: operations["completeResetMemberMfa"]; }; "/v0/org/{org_id}/users/{user_id}": { /** * Get user by id * @description Get user by id * * If the requesting user is an owner of the org, the response additionally * includes the user's OIDC identities. */ get: operations["getUserInOrg"]; /** * Remove a user from the org * @description Remove a user from the org */ delete: operations["deleteUser"]; }; "/v0/org/{org_id}/users/{user_id}/membership": { /** * Update a user's membership in the org * @description Update a user's membership in the org * * Enable/disable another user in the org, or change their membership role. */ patch: operations["updateUserMembership"]; }; "/v0/passkey": { /** * Initiate Login with Passkey * @description Initiate Login with Passkey * * The response contains a FIDO challenge that the client must answer with any of their * discoverable credentials. The answer should be submitted with the corresponding PATCH request. */ post: operations["passkeyAuthInit"]; /** * Complete Login with Passkey * @description Complete Login with Passkey * * The request should contain an answer to the challenge issued by the corresponding POST request. * The challenge may be answered with any of the user's discoverable credentials; if the credential * included in the answer is registered with a user and an organization, the response will contain * a CubeSigner session (with the parameters supplied in the previous POST request) for that user * in that organization. */ patch: operations["passkeyAuthComplete"]; }; "/v0/user/me/fido": { /** * Initiate registration of a FIDO key * @deprecated * @description Initiate registration of a FIDO key * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/fido` instead. * * Generates a challenge that must be answered to prove ownership of a key */ post: operations["registerFidoInitLegacy"]; /** * Finalize registration of a FIDO key * @deprecated * @description Finalize registration of a FIDO key * * DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/fido` instead. * * Accepts the response to the challenge generated by the POST to this endpoint. */ patch: operations["registerFidoCompleteLegacy"]; }; "/v0/user/me/totp": { /** * Initialize TOTP Reset * @deprecated * @description Initialize TOTP Reset * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp` instead. * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ post: operations["resetTotpInitLegacy"]; /** * Finalize resetting TOTP * @deprecated * @description Finalize resetting TOTP * * DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/totp` instead. * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ patch: operations["resetTotpCompleteLegacy"]; }; "/v0/user/me/totp/verify": { /** * Verify TOTP * @deprecated * @description Verify TOTP * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp/verify` instead. * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ post: operations["verifyTotpLegacy"]; }; "/v0/user/orgs": { /** * Retrieves all the orgs the user is a part of * @description Retrieves all the orgs the user is a part of */ get: operations["userOrgs"]; }; "/v1/org/{org_id}/blob/sign/{key_id}": { /** * Sign Raw Blob * @description Sign Raw Blob * * Signs an arbitrary blob with a given key. * * - ECDSA signatures are serialized as big-endian r and s plus recovery-id * byte v, which can in general take any of the values 0, 1, 2, or 3. * * - EdDSA signatures are serialized in the standard format. * * - BLS signatures are not supported on the blob-sign endpoint. */ post: operations["blobSign"]; }; "/v1/org/{org_id}/cube3signer/heartbeat": { /** * Record heartbeat * @description Record heartbeat * * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch. */ post: operations["cube3signerHeartbeat"]; }; "/v1/org/{org_id}/eth1/sign/{pubkey}": { /** * Sign EVM Transaction * @description Sign EVM Transaction * * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key. * Returns an RLP-encoded transaction with EIP-155 signature. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["eth1Sign"]; }; "/v1/org/{org_id}/eth2/sign/{pubkey}": { /** * Sign Validator Request * @description Sign Validator Request * * Signs an eth2 validator request with a given BLS key. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["eth2Sign"]; }; "/v1/org/{org_id}/eth2/stake": { /** * Sign Stake Deposit * @description Sign Stake Deposit * * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the * provided validator key. Otherwise, we generate a new BLS key. * * When using a pregenerated key, the key must be associated with the role and organization on whose * behalf this action is called. */ post: operations["stake"]; }; "/v1/org/{org_id}/eth2/unstake/{pubkey}": { /** * Sign Unstake Request * @description Sign Unstake Request * * Handle unstaking request, producing a signed voluntary exit message * that can be posted directly to the Beacon chain. * * The key must be associated with the role and organization on whose behalf this action is called. */ post: operations["unstake"]; }; "/v1/org/{org_id}/token/refresh": { /** * Refresh Signer Session * @description Refresh Signer Session */ patch: operations["signerSessionRefresh"]; }; } export type webhooks = Record; export interface components { schemas: { AcceptedResponse: components["schemas"]["ErrorResponse"] & Record; /** @description Different responses we return for success status codes. */ AcceptedValue: OneOf< [ { SignDryRun: components["schemas"]["SignDryRunArgs"]; }, { BinanceDryRun: components["schemas"]["BinanceDryRunArgs"]; }, { BybitDryRun: components["schemas"]["BybitDryRunArgs"]; }, { CoinbaseDryRun: components["schemas"]["CoinbaseDryRunArgs"]; }, { MfaRequired: components["schemas"]["MfaRequiredArgs"]; }, ] >; /** @enum {string} */ AcceptedValueCode: | "SignDryRun" | "BinanceDryRun" | "BybitDryRun" | "CoinbaseDryRun" | "MfaRequired"; /** * @description Determines who controls the keys within an org * @enum {string} */ AccessModel: "User" | "Org"; /** * @description One asset balance entry in [`AccountInfoResponse::balances`]. Distinct from * [`SubAccountAsset`] because the spot-account schema lacks the `freeze` and * `withdrawing` fields. */ AccountBalance: { /** @description Asset symbol (e.g. `"USDT"`, `"BTC"`). */ asset: string; /** @description Available balance. */ free: string; /** @description Balance locked in open orders. */ locked: string; }; /** * @description Parameters for `GET /api/v3/account`. * * Returns Spot account info for whichever account the signing key * authenticates as (master or sub). */ AccountInfoRequest: { /** * @description If `true`, the response omits assets with all-zero balances. Defaults to * `false` (Binance's default). */ omitZeroBalances?: boolean | null; }; /** @description Response returned by `cs_binanceAccountInfo`. */ AccountInfoResponse: { /** @description Account type, e.g. `"SPOT"`. Left as `String` for forward compatibility. */ accountType: string; /** @description One entry per asset. Affected by the `omit_zero_balances` request flag. */ balances: components["schemas"]["AccountBalance"][]; brokered: boolean; /** Format: int64 */ buyerCommission: number; canDeposit: boolean; canTrade: boolean; canWithdraw: boolean; commissionRates: components["schemas"]["CommissionRates"]; /** * Format: int64 * @description Maker commission, in basis points (e.g. `10` = 0.1%). Superseded by * [`AccountInfoResponse::commission_rates`] for fractional rates. */ makerCommission: number; /** @description Permission flags, e.g. `["SPOT", "MARGIN"]`. */ permissions: string[]; preventSor: boolean; requireSelfTradePrevention: boolean; /** Format: int64 */ sellerCommission: number; /** Format: int64 */ takerCommission: number; /** * Format: int64 * @description Account user id. */ uid: number; /** * Format: int64 * @description Last account update time (ms since epoch). */ updateTime: number; }; /** * @description Wallet type used as the source or destination of a [`UniversalTransferRequest`]. * * Serializes to the SCREAMING_SNAKE_CASE strings Binance expects. The default * is [`AccountType::Spot`]. * @enum {string} */ AccountType: "SPOT" | "USDT_FUTURE" | "COIN_FUTURE" | "MARGIN"; /** @description Request to add OIDC identity to an existing user account */ AddIdentityRequest: { oidc_token: string; user_id?: components["schemas"]["Id"] | null; }; AddKeysToRoleRequest: { /** * @description A list of keys to add to a role * @example [ * "Key#63023a27-1e70-430a-b293-ffbc9d6c4484" * ] */ key_ids: string[]; /** * @description Optional policies to apply for each key * @example [ * { * "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa" * }, * { * "TxDeposit": { * "kind": "Canonical" * } * }, * { * "RequireMfa": { * "kind": { * "RequiredApprovers": { * "count": 1 * } * }, * "restricted_operations": [ * "Eth1Sign", * "BlobSign" * ] * } * } * ] */ policy?: unknown[] | null; }; AddThirdPartyUserRequest: { /** * @description Optional user email * @example alice@example.com */ email?: string | null; identity?: components["schemas"]["OidcIdentity"] | null; /** @description Optional login MFA policy */ mfa_policy?: Record | null; /** * @description Optional user full name * @example Alice Wonderland */ name?: string | null; proof?: components["schemas"]["IdentityProof"] | null; role: components["schemas"]["MemberRole"]; }; AddThirdPartyUserResponse: { /** @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; /** @description The addresses associated with a contact. */ AddressMap: { /** @description Bitcoin addresses. */ btc?: components["schemas"]["BitcoinAddressInfo"][]; /** @description Canton parties. */ canton?: components["schemas"]["CantonPartyInfo"][]; /** @description EVM addresses. */ evm?: components["schemas"]["EvmAddressInfo"][]; /** @description Solana addresses. */ sol?: components["schemas"]["SolanaAddressInfo"][]; /** @description SUI addresses. */ sui?: components["schemas"]["SuiAddressInfo"][]; }; /** @enum {string} */ AlertKind: "PolicyChanges" | "Eth2ConcurrentBlockSigning" | "BabylonEotsConcurrentSigning"; /** * @description MFA types that are allowed to be used for individual implicitly security-sensitive * operations (like logging in, adding an MFA factor, exporting keys, etc; see `MfaProtectedAction`). */ AllowedMfaMap: { [key: string]: components["schemas"]["MfaType"][]; }; ApprovalInfo: { timestamp: components["schemas"]["EpochDateTime"]; }; /** * @description WebAuthn Relying Parties may use AttestationConveyancePreference to specify * their preference regarding attestation conveyance during credential * generation. * * https://www.w3.org/TR/webauthn-2/#enumdef-attestationconveyancepreference * @enum {string} */ AttestationConveyancePreference: "none" | "indirect" | "direct" | "enterprise"; /** * @description Audience(s) that this ID Token is intended for. It MUST contain the * OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain * identifiers for other audiences. In the general case, the aud value is an array of * case-sensitive strings. In the common special case when there is one audience, * the aud value MAY be a single case-sensitive string. */ Aud: string | string[]; AuditLogEntry: { event: components["schemas"]["OrgEventDiscriminants"]; /** @description UUID of the event. Unique across all events. */ event_id: string; org_id: components["schemas"]["Id"]; /** * @description The id of the HTTP request which triggered the event * (a single request can trigger multiple events). */ request_id: string; /** @description The time when the event was logged. */ time: string; /** * @description The id of the identity (user or role) which triggered the event * (may be undefined for certain unauthenticated endpoints) */ triggered_by?: string | null; [key: string]: unknown; }; /** @description The request type for querying the audit log. */ AuditLogRequest: { /** * Format: int64 * @description End time in seconds since unix epoch. If omitted, defaults to 'now'. */ end_time?: number | null; /** * @description Filter the log by the event name. * If omitted, all events will be included. * Must not be set to an empty array */ events?: components["schemas"]["OrgEventDiscriminants"][] | null; /** * Format: int64 * @description Start time in seconds since unix epoch. */ start_time: number; }; /** @description The audit log response */ AuditLogResponse: { /** @description Audit log entries */ entries: components["schemas"]["AuditLogEntry"][]; }; /** @description Data required for both `authenticate` and `refresh`. */ AuthData: { /** Format: int32 */ epoch_num: number; epoch_token: components["schemas"]["B32"]; other_token: string; }; /** * @description At redemption time, the user must provide a credential they wish to use to authenticate. * This enum represents the two possible sources of authentication. */ AuthSource: { credential: string; kind: components["schemas"]["AuthSourceKind"]; }; /** * @description At redemption time, the user must provide a credential they wish to use to authenticate. * This enum represents the two possible sources of authentication. * @enum {string} */ AuthSourceKind: "password" | "oidc"; /** @description The request body for the idp authenticate endpoint */ AuthenticationRequest: { /** * @description The email address of the user attempting to authenticate * @example alice@example.com */ email: string; /** @description The password for that user */ password: string; }; /** @description The response to the idp authenticate endpoint */ AuthenticationResponse: { /** @description An OIDC token that can be used to authenticate with CubeSigner */ id_token: string; }; /** * @description Represents the assertion response used by clients when attempting to log in with a known credential * https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse */ AuthenticatorAssertionResponse: { /** * @description Contains the standard CTAP2 authenticator data. Must be a valid [`AuthenticatorData`]. * This contains information about how key was invoked. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-authenticatordata */ authenticatorData: string; /** * @description Contains UTF8 encoded JSON which must be a valid [`ClientData`] * This data is combined with `authenticator_data` to produce the signature * meaning the client attests to the correctness of this data. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorresponse-clientdatajson */ clientDataJSON: string; /** * @description The signature of the concatenated `authenticatorData || hash` where * `hash` is the SHA256 hash of the `clientDataJSON` buffer: * * Field Definition: https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-signature * Step 11 of `getAssertion` specifies the concatenation: https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion * Requirement for SHA-256: https://www.w3.org/TR/webauthn-2/#collectedclientdata-hash-of-the-serialized-client-data */ signature: string; /** * @description Allows the authenticator to optionally declare the credential identifier they used. * https://www.w3.org/TR/webauthn-2/#dom-authenticatorassertionresponse-userhandle */ userHandle?: string | null; }; /** * @description This enumeration’s values describe authenticators' attachment modalities. * Relying Parties use this to express a preferred authenticator attachment * modality when calling navigator.credentials.create() to create a credential. * * https://www.w3.org/TR/webauthn-2/#enumdef-authenticatorattachment * @enum {string} */ AuthenticatorAttachment: "platform" | "cross-platform"; /** * @description The AuthenticatorAttestationResponse interface represents the authenticator's * response to a client’s request for the creation of a new public key * credential. It contains information about the new credential that can be * used to identify it for later use, and metadata that can be used by the * WebAuthn Relying Party to assess the characteristics of the credential * during registration. * * https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse */ AuthenticatorAttestationResponse: { /** * @description This attribute contains an attestation object, which is opaque to, and * cryptographically protected against tampering by, the client. The * attestation object contains both authenticator data and an attestation * statement. The former contains the AAGUID, a unique credential ID, and * the credential public key. The contents of the attestation statement are * determined by the attestation statement format used by the * authenticator. It also contains any additional information that the * Relying Party's server requires to validate the attestation statement, * as well as to decode and validate the authenticator data along with the * JSON-compatible serialization of client data. For more details, see * § 6.5 Attestation, § 6.5.4 Generating an Attestation Object, and Figure * 6. */ attestationObject: string; /** * @description This attribute, inherited from AuthenticatorResponse, contains the * JSON-compatible serialization of client data (see § 6.5 Attestation) * passed to the authenticator by the client in order to generate this * credential. The exact JSON serialization MUST be preserved, as the hash * of the serialized client data has been computed over it. */ clientDataJSON: string; }; /** * @description WebAuthn Relying Parties may use the AuthenticatorSelectionCriteria * dictionary to specify their requirements regarding authenticator * attributes. * * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria */ AuthenticatorSelectionCriteria: { authenticatorAttachment?: components["schemas"]["AuthenticatorAttachment"] | null; /** * @description This member is retained for backwards compatibility with WebAuthn Level * 1 and, for historical reasons, its naming retains the deprecated * “resident” terminology for discoverable credentials. Relying Parties * SHOULD set it to true if, and only if, residentKey is set to required. * * https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-requireresidentkey */ requireResidentKey?: boolean; residentKey?: components["schemas"]["ResidentKeyRequirement"] | null; userVerification?: components["schemas"]["UserVerificationRequirement"]; }; /** * @description Authenticators may implement various transports for communicating with * clients. This enumeration defines hints as to how clients might communicate * with a particular authenticator in order to obtain an assertion for a * specific credential. Note that these hints represent the WebAuthn Relying * Party's best belief as to how an authenticator may be reached. A Relying * Party will typically learn of the supported transports for a public key * credential via getTransports(). * * https://www.w3.org/TR/webauthn-2/#enumdef-authenticatortransport * @enum {string} */ AuthenticatorTransport: "usb" | "nfc" | "ble" | "internal"; /** @description Request to sign a serialized Avalanche transaction */ AvaSerializedTxSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** @description Serialized transaction to sign */ tx: string; }; /** @description Request to sign an Avalanche transaction */ AvaSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description Transaction to sign. * * Examples: * - {"P": { "AddPermissionlessValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_permissionless_validator.rs#L14) }} * - {"P": { "AddSubnetValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_subnet_validator.rs#L29) }} * - {"P": { "AddValidator": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/add_validator.rs#L12) }} * - {"P": { "CreateChain": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/create_chain.rs#L8) }} * - {"P": { "CreateSubnet": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/create_subnet.rs#L8) }} * - {"P": { "Export": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/export.rs#L12) }} * - {"P": { "Import": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/platformvm/txs/import.rs#L12) }} * - {"X": { "Base": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/mod.rs#L21) }} * - {"X": { "Export": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/export.rs#L16) }} * - {"X": { "Import": [TxJson](https://github.com/ava-labs/avalanche-rs/blob/avalanche-types-v0.1.3/crates/avalanche-types/src/avm/txs/import.rs#L14) }} */ tx: Record; }; /** @description Wrapper around a zeroizing 32-byte fixed-size array */ B32: string; BabylonCovSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The keys for the finality providers to which this transaction is being staked. * Each key is a hex string containing a SEC1-encoded secp256k1 public key. * @example [ * "03b573e318803fd7aee1be5b6b18d496cc60ecc52429dbd477a879217c3ed26a795cb4f4e880aaff3a6ad66335e5404fa51caeb4964f0c9f7562737864e3bde5bc" * ] */ fp_enc_keys: string[]; /** * @description The slash-unbonding transaction being approved by the covenant signer. * This is a Bitcoin consensus--encoded hex string. * @example 6899b5baf713a2c60e6abf05e8909440d41dc4125b98891c332f7087daf017fb2436286e2aa097464d9c927d644fa6de */ slash_unbonding_tx: string; /** * @description The slashing script in the staking transaction. * This is a Bitcoin consensus--encoded hex string. * @example 877f05cc626dedcf53b50eeba0821ca0 */ slashing_script: string; /** * @description The slashing transaction being approved by the covenant signer. * This is a Bitcoin consensus--encoded hex string. * @example f37e7ca2b24a5f7b8b6c9ba054f9932efb047ce80cf50a118e3f72751429fb13a355fa093bd358cdc30efacf5a62cabe */ slashing_tx: string; stake_expansion?: components["schemas"]["BabylonCovStakeExpansionRequest"] | null; /** * Format: int32 * @description The output index of the Babylon staking scripts in the staking transaction. * @example 1 */ staking_output_idx: number; /** * @description The staking transaction being approved by the covenant signer. * This is a Bitcoin consensus--encoded hex string. * @example 954ba118e7133b4bb3a67acc4f40cb9529aabbc01007229f7bfd85706850175d77d5cbe5e4c0ca67238d14afa47c51cc */ staking_tx: string; /** * @description The unbonding script in the staking transaction. * This is a Bitcoin consensus--encoded hex string. * @example 55f6638c0c0c0b0e51ca922e0e9e6abd */ unbonding_script: string; /** * @description The slashing script in the unbonding transaction. * This is a Bitcoin consensus--encoded hex string. * @example e133f5a923a07b9c7f6767cda171005b */ unbonding_slashing_script: string; /** * @description The unbonding transaction being approved by the covenant signer. * This is a Bitcoin consensus--encoded hex string. * @example 969cb95129a55a96d51919f5f67f3adc597ecdee6eda21e7777f370c3b1809336ee7d08ec574c8bbb361ff63d032a976 */ unbonding_tx: string; }; BabylonCovSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The slash-unbonding transaction signatures as an array of hex strings with no 0x prefix * @example [ * "02e21a7b0519539ef670f79d1c25a54f90b0c6d9fdb56a7de813fb207033032fffad8aaafeb1b77dd9ea8f17dadcf297696bbf5a4133292f3515b86bb9c2d78d9c" * ] */ slash_unbonding_transactions_signatures: string[]; /** * @description The slashing transaction signatures as an array of hex strings with no 0x prefix * @example [ * "03075eca9d176d1605d6c096c111e9a4f8d8739ac9708c1df3ed516106e7ab1387a3924a6652acf2e3524359731ca1fbb338a3afb1a67f6ea19c207b6ff466a5ad", * "022224493f4cffad5b84076db32dd8c49a28ff48af4e19e2bcc9953ff80347ba6e8343cf7a44e74a96ff71ea59a03b40166e85b0d1355954e04a4427dc8d637ff0" * ] */ slashing_transactions_signatures: string[]; /** * @description The signature that allows expanding a stake by spending the current active * stake transaction into a new staking transaction. A value is present iff the * corresponding request included a `stake_expansion` value. * @example b573e318803fd7aee1be5b6b18d496cc60ecc52429dbd477a879217c3ed26a795cb4f4e880aaff3a6ad66335e5404fa51caeb4964f0c9f7562737864e3bde5bc */ stake_expansion_transaction_signature?: string | null; /** * @description The unbonding transaction signature as hex string with no 0x prefix * @example b573e318803fd7aee1be5b6b18d496cc60ecc52429dbd477a879217c3ed26a795cb4f4e880aaff3a6ad66335e5404fa51caeb4964f0c9f7562737864e3bde5bc */ unbonding_transaction_signature: string; }; /** @description Request to expand an active stake with additional funds. */ BabylonCovStakeExpansionRequest: { /** * @description The transaction output that is being used to fund the stake expansion. * This is a Bitcoin consensus--encoded hex string. */ other_funding_output: string; /** * @description The active staking transaction that is being expanded with this request. * This is a Bitcoin consensus--encoded hex string. * @example 954ba118e7133b4bb3a67acc4f40cb9529aabbc01007229f7bfd85706850175d77d5cbe5e4c0ca67238d14afa47c51cc */ previous_active_stake_tx: string; /** * @description The unbonding script in the active staking transaction. * This is a Bitcoin consensus--encoded hex string. * @example e133f5a923a07b9c7f6767cda171005b */ previous_active_stake_unbonding_script: string; /** * Format: int32 * @description The index of the active stake output in the active staking transaction. * @example 1 */ previous_staking_output_idx: number; }; /** * @description The network-id for Babylon staking * @enum {string} */ BabylonNetworkId: "bbt4" | "bbn1" | "bbt5"; /** @description Babylon staking registration specification */ BabylonRegistrationRequest: ({ explicit_params?: components["schemas"]["BabylonStakingParams"] | null; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the finality * provider to which the stake is delegated. */ finality_provider_pks: string[]; /** * Format: int32 * @description The lock time used for the withdrawal output in the staking deposit transaction */ lock_time: number; network: components["schemas"]["BabylonNetworkId"]; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the staker. This * is the key that signs the slashing, withdrawal, and unbonding scripts. */ staker_pk: string; /** * Format: int32 * @description The parameter version to use. If `None`, uses the latest version. */ version?: number | null; } & { /** @description The change address, specified as a Bitcoin spend script */ change: string; /** * Format: int64 * @description The transaction fee value. The `fee_type` field determines whether this * is a fixed fee in sats or a rate in sats per (estimated) virtual byte of * transaction weight (i.e., sats per vb). */ fee: number; fee_type: components["schemas"]["FeeType"]; /** * @description By default, the PSBT in this request can only specify transaction inputs: * PSBTs that specify outputs will result in an error. When this flag is set, * existing outputs in the PSBT will instead be ignored (i.e., deleted from * the PSBT) when creating the deposit transaction. */ ignore_psbt_outputs?: boolean; /** * @description A hex-serialized PSBT (version 0) containing the transaction inputs and * all necessary information for signing (e.g., taproot path and leaf * information). This PSBT must not have any transaction outputs; they * will be added to the returned PSBT. */ psbt: string; /** * Format: int64 * @description The value to be staked in sats */ value: number; }) & { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The Babylon address that will receive the staking rewards for this deposit. * Babylon requires this to be the same address that registers the deposit on * the Babylon chain. * * This must be a secp256k1 Cosmos address with either a `bbn` or a `cosmos` * human-readable part (i.e., `bbn1...` or `cosmos1...`). The latter lets you * specify the material-id of a SecpCosmos CubeSigner key. * @example bbn1n5anmc0kkrh70yjy7f6f399c74yd09xl5teffm */ bbn_addr: string; }; BabylonRegistrationResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The Babylon address that will receive the staking rewards for this deposit. * * This value will correspond to the `bbn_addr` value specified in the request, * but it will always have a `bbn` human-readable part. * @example bbn1n5anmc0kkrh70yjy7f6f399c74yd09xl5teffm */ bbn_addr: string; /** * @description The deposit transaction PSBT. This PSBT includes signatures on any * inputs controlled by the staker taproot key specified in the request. */ deposit: string; /** * Format: int64 * @description The deposit transaction fee in sats. * @example 1337 */ deposit_fee: number; /** * @description The proof of possession, i.e., a BIP322 signature on the staker's * Babylon address signed by the staker taproot key. This is a Bitcoin * witness stack in Bitcoin consensus hex encoding. */ pop: string; /** @description The slash-deposit transaction in Bitcoin consensus hex encoding. */ slash_deposit: string; /** * @description The staker taproot key's signature on the slash-deposit transaction. * This is a BIP340 signature in hex format. */ slash_deposit_sig: string; /** @description The slash-unbond transaction in Bitcoin consensus hex encoding. */ slash_unbond: string; /** * @description The staker taproot key's signature on the slash-unbond transaction. * This is a BIP340 signature in hex format. */ slash_unbond_sig: string; /** @description The (unsigned) unbonding transaction in Bitcoin consensus hex encoding. */ unbond: string; }; /** @description Data needed to create the Babylon deposit scripts */ BabylonScriptData: { explicit_params?: components["schemas"]["BabylonStakingParams"] | null; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the finality * provider to which the stake is delegated. */ finality_provider_pks: string[]; /** * Format: int32 * @description The lock time used for the withdrawal output in the staking deposit transaction */ lock_time: number; network: components["schemas"]["BabylonNetworkId"]; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the staker. This * is the key that signs the slashing, withdrawal, and unbonding scripts. */ staker_pk: string; /** * Format: int32 * @description The parameter version to use. If `None`, uses the latest version. */ version?: number | null; }; /** @description Data needed to create a Babylon deposit transaction */ BabylonStakingDeposit: { explicit_params?: components["schemas"]["BabylonStakingParams"] | null; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the finality * provider to which the stake is delegated. */ finality_provider_pks: string[]; /** * Format: int32 * @description The lock time used for the withdrawal output in the staking deposit transaction */ lock_time: number; network: components["schemas"]["BabylonNetworkId"]; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the staker. This * is the key that signs the slashing, withdrawal, and unbonding scripts. */ staker_pk: string; /** * Format: int32 * @description The parameter version to use. If `None`, uses the latest version. */ version?: number | null; } & { /** @description The change address, specified as a Bitcoin spend script */ change: string; /** * Format: int64 * @description The transaction fee value. The `fee_type` field determines whether this * is a fixed fee in sats or a rate in sats per (estimated) virtual byte of * transaction weight (i.e., sats per vb). */ fee: number; fee_type: components["schemas"]["FeeType"]; /** * @description By default, the PSBT in this request can only specify transaction inputs: * PSBTs that specify outputs will result in an error. When this flag is set, * existing outputs in the PSBT will instead be ignored (i.e., deleted from * the PSBT) when creating the deposit transaction. */ ignore_psbt_outputs?: boolean; /** * @description A hex-serialized PSBT (version 0) containing the transaction inputs and * all necessary information for signing (e.g., taproot path and leaf * information). This PSBT must not have any transaction outputs; they * will be added to the returned PSBT. */ psbt: string; /** * Format: int64 * @description The value to be staked in sats */ value: number; }; /** @description Data needed to create a Babylon early-unbonding or slashing transaction */ BabylonStakingEarlyUnbond: { explicit_params?: components["schemas"]["BabylonStakingParams"] | null; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the finality * provider to which the stake is delegated. */ finality_provider_pks: string[]; /** * Format: int32 * @description The lock time used for the withdrawal output in the staking deposit transaction */ lock_time: number; network: components["schemas"]["BabylonNetworkId"]; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the staker. This * is the key that signs the slashing, withdrawal, and unbonding scripts. */ staker_pk: string; /** * Format: int32 * @description The parameter version to use. If `None`, uses the latest version. */ version?: number | null; } & { /** * @description If `true`, the resulting PSBT is encoded as a base64 string. * Otherwise, it is encoded as a hex string. */ as_base64?: boolean; /** @description Transaction-id of the deposit transaction to unbond or slash. */ txid: string; /** * Format: int64 * @description The value in sats that was staked in the transaction to unbond or slash. */ value: number; /** * Format: int32 * @description Transaction output index of the staking transaction to unbond or slash. * For staking transactions generated by CubeSigner, this will always be zero. */ vout: number; }; /** * @description Parameter set for Babylon staking. The latest parameter sets are * available from */ BabylonStakingParams: { /** * Format: int64 * @description Block height at which these params will enter use */ activation_height: number; /** @description Public keys of the covenant signers */ covenant_pks: string[]; /** @description Quorum for covenant signer */ covenant_quorum: number; /** * Format: int64 * @description Max amount that can be staked in a single txn */ max_staking_amount: number; /** * Format: int32 * @description Max timelock for staking */ max_staking_time: number; /** * Format: int64 * @description Min amount that must be staked */ min_staking_amount: number; /** * Format: int32 * @description Min timelock for staking */ min_staking_time: number; /** * Format: int64 * @description Minimum fee (in sats) that must be paid as part of the slashing txn */ slashing_fee?: number; /** * Format: int64 * @description An extra number of sats to slash in the slashing txn. This can be used * to ensure that the transaction meets the minimum slashing requirement * even if the covenant committee members use floats to compute the amount * that should be slashed. The default is 2; it should not be necessary to * go higher than this. */ slashing_margin?: number | null; /** * @description The pk_script value for the 0th output index of a slashing transaction, * serialized as a hex byte string. This value must be present to create * slashing signatures. */ slashing_pk_script?: string | null; /** @description The fraction of stake slashed if a double-sign is detected */ slashing_rate?: string | null; /** * @description Bitcoin transaction tag for staking metadata. If present, an identifiable * staking output (i.e., one with an OP_RETURN) will be created. */ tag?: string | null; /** * Format: int64 * @description Fee (in sats) that must be spent as part of the unbonding txn */ unbonding_fee: number; /** * Format: int32 * @description Min timelock for an unbonding script */ unbonding_time: number; /** * Format: int32 * @description Parameter version */ version: number; }; /** @description The actions possible via the Babylon Staking endpoint */ BabylonStakingRequest: | (components["schemas"]["BabylonStakingDeposit"] & { /** @enum {string} */ action: "deposit"; }) | (components["schemas"]["BabylonStakingEarlyUnbond"] & { /** @enum {string} */ action: "early_unbond"; }) | (components["schemas"]["BabylonStakingWithdrawal"] & { /** @enum {string} */ action: "withdraw_timelock"; }) | (components["schemas"]["BabylonStakingWithdrawal"] & { /** @enum {string} */ action: "withdraw_early_unbond"; }) | (components["schemas"]["BabylonStakingWithdrawal"] & { /** @enum {string} */ action: "withdraw_slashing"; }) | (components["schemas"]["BabylonStakingEarlyUnbond"] & { /** @enum {string} */ action: "slash_deposit"; }) | (components["schemas"]["BabylonStakingEarlyUnbond"] & { /** @enum {string} */ action: "slash_early_unbond"; }); BabylonStakingResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * Format: int64 * @description The transaction fee in sats * @example 1337 */ fee: number; /** * @description The PSBT in either hex or base64 serialization * @example 70736274ff01005e... */ psbt: string; }; /** @description Data needed to create a Babylon withdrawal transaction */ BabylonStakingWithdrawal: { explicit_params?: components["schemas"]["BabylonStakingParams"] | null; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the finality * provider to which the stake is delegated. */ finality_provider_pks: string[]; /** * Format: int32 * @description The lock time used for the withdrawal output in the staking deposit transaction */ lock_time: number; network: components["schemas"]["BabylonNetworkId"]; /** * @description The Schnorr public key (i.e., 32-byte X-coordinate) of the staker. This * is the key that signs the slashing, withdrawal, and unbonding scripts. */ staker_pk: string; /** * Format: int32 * @description The parameter version to use. If `None`, uses the latest version. */ version?: number | null; } & { /** * @description If `true`, the resulting PSBT is encoded as a base64 string. * Otherwise, it is encoded as a hex string. */ as_base64?: boolean; /** * Format: int64 * @description The transaction fee value. The `fee_type` field determines whether this * is a fixed fee in sats or a rate in sats per (estimated) virtual byte of * transaction weight (i.e., sats per vb). */ fee: number; fee_type: components["schemas"]["FeeType"]; /** @description The withdrawal recipient, specified as a Bitcoin spend script */ recipient: string; /** @description Transaction-id of the deposit or early unbonding transaction to withdraw from */ txid: string; /** * Format: int32 * @description An optional lock height (in blocks) for this transaction. The resulting * transaction cannot be mined before the specified block height. */ txn_lock_height?: number | null; /** * Format: int64 * @description The value in sats that is staked in the transaction being withdrawn */ value: number; /** * Format: int32 * @description Transaction output index of the staking transaction from which to withdraw. * For staking transactions generated by CubeSigner, this will always be 0. * For slashing transactions generated by CubeSigner, this will always be 1. */ vout: number; }; /** @enum {string} */ BadGatewayErrorCode: | "Generic" | "CustomChainRpcError" | "EsploraApiError" | "SentryApiError" | "CallWebhookError" | "OAuthProviderError" | "OidcDisoveryFailed" | "OidcIssuerJwkEndpointUnavailable" | "SmtpServerUnavailable"; /** @enum {string} */ BadRequestErrorCode: | "GenericBadRequest" | "CannotVoteOnRedeemedRequest" | "PendingOpAlreadyVetoed" | "MultiplePendingOpsReferenced" | "DisallowedAllowRuleReference" | "InvalidPaginationToken" | "InvalidEmail" | "InvalidEmailTemplate" | "QueryMetricsError" | "InvalidTelegramData" | "ValidationError" | "WebhookPolicyTimeoutOutOfBounds" | "WebhookPolicyDisallowedUrlScheme" | "WebhookPolicyDisallowedUrlHost" | "WebhookPolicyDisallowedHeaders" | "ReservedName" | "UserEmailNotConfigured" | "EmailPasswordNotFound" | "PasswordAuthNotAllowedByInvitation" | "OneTimeCodeExpired" | "InvalidBody" | "InvalidJwt" | "InvitationNoLongerValid" | "TokenRequestError" | "InvalidMfaReceipt" | "InvalidMfaPolicyCount" | "InvalidMfaPolicyNumAuthFactors" | "InvalidMfaPolicyNumAllowedApprovers" | "InvalidMfaPolicyGracePeriodTooLong" | "InvalidBabylonStakingPolicyParams" | "InvalidSuiTxReceiversEmptyAllowlist" | "InvalidBtcTxReceiversEmptyAllowlist" | "InvalidRequireRoleSessionAllowlist" | "InvalidCreateKeyCount" | "InvalidDiffieHellmanCount" | "OrgInviteExistingUser" | "OrgUserAlreadyExists" | "OrgNameTaken" | "KwkNotFoundInRegion" | "OrgIsNotOrgExport" | "RoleNameTaken" | "PolicyNameTaken" | "NameTaken" | "ContactNameInvalid" | "ContactAddressesInvalid" | "ContactLabelInvalid" | "ContactModified" | "PolicyNotFound" | "PolicyVersionNotFound" | "PolicyRuleDisallowedByType" | "PolicyTypeDisallowed" | "PolicyDuplicateError" | "PolicyStillAttached" | "PolicyModified" | "PolicyNotAttached" | "AddKeyToRoleCountTooHigh" | "InvalidKeyId" | "InvalidTimeLockAlreadyInThePast" | "InvalidRestrictedScopes" | "InvalidUpdate" | "InvalidMetadataLength" | "InvalidLength" | "InvalidKeyMaterialId" | "KeyNotFound" | "SiweChallengeNotFound" | "SiweInvalidRequest" | "SiwsChallengeNotFound" | "SiwsInvalidRequest" | "UserExportDerivedKey" | "UserExportPublicKeyInvalid" | "NistP256PublicKeyInvalid" | "UnableToAccessSmtpRelay" | "UserExportInProgress" | "RoleNotFound" | "InvalidRoleNameOrId" | "InvalidMfaReceiptOrgIdMissing" | "InvalidMfaReceiptInvalidOrgId" | "MfaRequestNotFound" | "InvalidKeyType" | "InvalidPropertiesForKeyType" | "MismatchedKeyPropertiesPatch" | "MissingBinanceApiKey" | "MissingBybitApiKey" | "MissingCoinbaseApiKey" | "BinanceKeyMasterMismatch" | "InvalidKeyMaterial" | "InvalidHexValue" | "InvalidBase32Value" | "InvalidBase58Value" | "InvalidBase64Value" | "InvalidSs58Value" | "InvalidForkVersionLength" | "InvalidEthAddress" | "InvalidStellarAddress" | "InvalidOrgNameOrId" | "InvalidUpdateOrgRequestDisallowedMfaType" | "InvalidUpdateOrgRequestEmptyAllowedMfaTypes" | "EmailOtpDelayTooShortForRegisterMfa" | "InvalidStakeDeposit" | "InvalidBlobSignRequest" | "InvalidDiffieHellmanRequest" | "InvalidSolanaSignRequest" | "InvalidEip712SignRequest" | "InvalidEip7702SignRequest" | "OnlySpecifyOne" | "IncompatibleParams" | "NoOidcDataInProof" | "InvalidEvmSignRequest" | "InvalidEth2SignRequest" | "InvalidDeriveKeyRequest" | "InvalidStakingAmount" | "CustomStakingAmountNotAllowedForWrapperContract" | "InvalidUnstakeRequest" | "InvalidCreateUserRequest" | "UserAlreadyExists" | "IdpUserAlreadyExists" | "CognitoUserAlreadyOrgMember" | "UserNotFound" | "UserWithEmailNotFound" | "PolicyKeyMismatch" | "EmptyScopes" | "InvalidScopesForRoleSession" | "InvalidLifetime" | "NoSingleKeyForUser" | "InvalidOrgPolicyRule" | "SourceIpAllowlistEmpty" | "LimitWindowTooLong" | "Erc20ContractDisallowed" | "EmptyRuleError" | "PolicyFieldValidationError" | "OptionalListEmpty" | "MultipleExclusiveFieldsProvided" | "DuplicateFieldEntry" | "InvalidRange" | "InvalidOrgPolicyRepeatedRule" | "InvalidSuiTransaction" | "SuiSenderMismatch" | "AvaSignHashError" | "AvaSignError" | "BtcSegwitHashError" | "BtcTaprootHashError" | "BtcSignError" | "TaprootSignError" | "Eip712SignError" | "InvalidMemberRoleInUserAdd" | "InvalidMemberRoleInRecipientAdd" | "ThirdPartyUserAlreadyExists" | "OidcIdentityAlreadyExists" | "UserAlreadyHasIdentity" | "ThirdPartyUserNotFound" | "DeleteOidcUserError" | "DeleteUserError" | "SessionRoleMismatch" | "InvalidOidcToken" | "InvalidOidcIdentity" | "OidcIssuerUnsupported" | "OidcIssuerNotAllowed" | "OidcIssuerNoApplicableJwk" | "FidoKeyAlreadyRegistered" | "FidoKeySignCountTooLow" | "FidoVerificationFailed" | "FidoChallengeMfaMismatch" | "UnsupportedLegacyCognitoSession" | "InvalidIdentityProof" | "PaginationDataExpired" | "ExistingKeysViolateExclusiveKeyAccess" | "ExportDelayTooShort" | "ExportWindowTooLong" | "InvalidTotpFailureLimit" | "InvalidEip191SignRequest" | "CannotResendUserInvitation" | "InvalidNotificationEndpointCount" | "CannotDeletePendingSubscription" | "InvalidNotificationUrlProtocol" | "EmptyOneOfOrgEventFilter" | "EmptyAllExceptOrgEventFilter" | "InvalidTapNodeHash" | "InvalidOneTimeCode" | "MessageNotFound" | "MessageAlreadySigned" | "MessageRejected" | "MessageReplaced" | "InvalidMessageType" | "EmptyAddress" | "InvalidEth2SigningPolicySlotRange" | "InvalidEth2SigningPolicyEpochRange" | "InvalidEth2SigningPolicyTimestampRange" | "InvalidEth2SigningPolicyOverlappingRule" | "RpcUrlMissing" | "MmiChainIdMissing" | "EthersInvalidRpcUrl" | "EthersGetTransactionCountError" | "InvalidPassword" | "BabylonStakingFeePlusDustOverflow" | "BabylonStaking" | "BabylonStakingIncorrectKey" | "BabylonStakingSegwitNonDeposit" | "BabylonStakingRegistrationRequiresTaproot" | "PsbtSigning" | "TooManyResets" | "TooManyRequests" | "TooManyFailedLogins" | "BadBtcMessageSignP2shFlag" | "InvalidTendermintRequest" | "PolicyVersionMaxReached" | "PolicyVersionInvalid" | "PolicySecretLimitReached" | "PolicySecretTooLarge" | "InvalidRandomSecretLength" | "InvalidImportKey" | "AlienOwnerInvalid" | "EmptyUpdateRequest" | "InvalidPolicyReference" | "PolicyEngineDisabled" | "InvalidWasmPolicy" | "CelProgramTooLarge" | "InvalidPolicy" | "RedundantDerivationPath" | "ImportKeyMissing" | "InvalidAbiMethods" | "BabylonCovSign" | "InvalidPolicyLogsRequest" | "UserProfileMigrationMultipleEntries" | "UserProfileMigrationTooManyItems" | "InputTooShort" | "InvalidTweakLength" | "InvalidCustomChains" | "InvalidRpcRequest" | "InvalidAclEntry"; BillingArgs: { billing_org: components["schemas"]["Id"]; event_type: components["schemas"]["BillingEvent"]; key?: components["schemas"]["Id"] | null; role?: components["schemas"]["Id"] | null; user?: components["schemas"]["Id"] | null; }; BillingDimensions: { kind: components["schemas"]["BillingEvent"]; /** @description All metrics must include 'org_id' as a dimension. */ org_id: string; }; /** * @description Billing event types. * @enum {string} */ BillingEvent: | "mmi" | "mmiMessageGet" | "mmiMessageList" | "mmiMessageSign" | "mmiMessageReject" | "mmiMessageDelete" | "aboutMe" | "userResetEmailInit" | "userResetEmailComplete" | "userDeleteTotp" | "userResetTotpInit" | "userResetTotpComplete" | "userVerifyTotp" | "userRegisterFidoInit" | "userRegisterFidoComplete" | "userDeleteFido" | "createProofOidc" | "createProofCubeSigner" | "verifyProof" | "addOidcIdentity" | "removeOidcIdentity" | "listOidcIdentities" | "getOrg" | "updateOrg" | "getOrgExport" | "createOrg" | "listKeysInOrg" | "attestKey" | "getKeyInOrg" | "getKeyByMaterialId" | "listKeyRoles" | "updateKey" | "listHistoricalKeyTx" | "invite" | "cancelInvitation" | "listInvitations" | "listUsersInOrg" | "getUserInOrg" | "getUserInOrgByEmail" | "getUserInOrgByOidc" | "updateUserMembership" | "resetMemberMfa" | "completeResetMemberMfa" | "createRole" | "attestRole" | "getRole" | "listTokenKeys" | "listRoles" | "getRoleKey" | "listRoleKeys" | "listRoleUsers" | "updateRole" | "deleteRole" | "configureEmail" | "getEmailConfig" | "deleteEmailConfig" | "listHistoricalRoleTx" | "createPolicy" | "getPolicy" | "listPolicies" | "deletePolicy" | "updatePolicy" | "invokePolicy" | "getPolicyLogs" | "uploadWasmPolicy" | "getPolicySecrets" | "updatePolicySecrets" | "setPolicySecret" | "deletePolicySecret" | "createPolicyImportKey" | "getPolicyBucket" | "listPolicyBuckets" | "updatePolicyBucket" | "userExportDelete" | "userExportList" | "userExportInit" | "userExportComplete" | "addUserToRole" | "removeUserFromRole" | "mfaApproveCs" | "mfaRejectCs" | "mfaGet" | "mfaList" | "addKeysToRole" | "removeKeyFromRole" | "createRoleToken" | "createSession" | "revokeSession" | "revokeCurrentSession" | "revokeSessions" | "listSessions" | "getSession" | "signerSessionRefresh" | "mfaApproveTotp" | "mfaRejectTotp" | "mfaFidoInit" | "mfaApproveFidoComplete" | "mfaRejectFidoComplete" | "mfaEmailInit" | "mfaEmailComplete" | "cube3signerHeartbeat" | "createContact" | "getContact" | "listContacts" | "deleteContact" | "updateContact" | "lookupContactsByAddress" | "queryMetrics" | "queryAuditLog" | "counts" | "createKey" | "importKey" | "createKeyImportKey" | "deriveKey" | "deleteKey" | "avaSign" | "avaSerializedTxSign" | "babylonRegistration" | "babylonStaking" | "babylonCovSign" | "binanceSign" | "bybitSign" | "coinbaseSign" | "blobSign" | "btcMessageSign" | "btcSign" | "diffieHellmanExchange" | "psbtSign" | "psbtLegacyInputSign" | "psbtSegwitInputSign" | "psbtTaprootInputSign" | "btcTaprootSign" | "eip712Sign" | "eip191Sign" | "eip7702Sign" | "eth1Sign" | "eth2Sign" | "solanaSign" | "suiSign" | "tendermintSign" | "stake" | "unstake" | "passkeyAuthInit" | "passkeyAuthComplete" | "oidcAuth" | "oauth2Twitter" | "oauth2TokenRefresh" | "emailOtpAuth" | "siweInit" | "siweComplete" | "siwsInit" | "siwsComplete" | "telegramAuth" | "createOidcUser" | "deleteOidcUser" | "deleteUser" | "createEotsNonces" | "eotsSign" | "authMigrationIdentityAdd" | "authMigrationIdentityRemove" | "authMigrationUserUpdate" | "keyCreated" | "keyImported" | "invitationAccept" | "idpAuthenticate" | "idpPasswordResetRequest" | "idpPasswordResetConfirm" | "rpcApi" | "rpcCreateTransaction" | "rpcGetTransaction" | "rpcListTransactions" | "rpcBtcListUtxos" | "rpcRetryTransaction" | "rpcCancelTransaction" | "rpcDeleteTransaction" | "rpcBinance" | "rpcBybit" | "rpcCoinbase" | "customChainRpcCall" | "esploraApiCall" | "sentryApiCall" | "sentryApiCallPublic" | "mmiJwkSet" | "attestationJwkSet" | "userOrgs" | "public_org_info" | "email_my_orgs"; /** @description Parameters envelope for all Binance RPC methods. */ BinanceAccountInfoParams: components["schemas"]["AccountInfoRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; BinanceApiPropertiesPatch: { /** @description The Binance-issued API key string. Encrypted server-side before storage. */ api_key?: string | null; /** @description Email address of the Binance (master or sub) account this key authenticates as. */ email?: string | null; /** @description Whether this corresponds to a master (as opposed to a sub) account on Binance. */ is_master?: boolean | null; /** @description Arbitrary label. Useful for storing the corresponding API key label on the Binance side. */ label?: string | null; /** * @description If this is a sub-account, this field can be used to link it to its master account * (by providing the master account email, which Binance uses as an account identifier). */ sub_of?: string | null; }; /** * @description Parameters for `cs_binanceCoinInfo`. * * Binance endpoint: `GET /sapi/v1/capital/config/getall`. Returns the list * of coins supported by the calling account along with per-coin balances, * deposit/withdraw enablement, and network info. Since the endpoint takes * no parameters beyond the common `recvWindow` / `timestamp` envelope, this * struct is defined directly instead of going through the * [`BinanceParams`] generic alias. */ BinanceCoinInfoParams: { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceDepositHistoryParams: components["schemas"]["DepositHistoryRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceDepositParams: components["schemas"]["DepositRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; BinanceDryRunArgs: { /** @description The Binance API method that would have been used */ method: string; /** @description The Binance API url method that would have been called */ url: string; }; /** * @description Different "dry run" modes for executing Binance requests. * @enum {string} */ BinanceDryRunMode: "NO_SIGN" | "NO_SUBMIT"; /** @description Parameters envelope for all Binance RPC methods. */ BinanceListSubAccountsParams: components["schemas"]["ListSubAccountsRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** * @description Binance-family RPC methods. Each variant authenticates as the * [`KeyType::Ed25519BinanceApi`] key in its `params.key_id`. */ BinanceRpc: | { /** @enum {string} */ method: "cs_binanceSubToMaster"; params: components["schemas"]["BinanceSubToMasterParams"]; } | { /** @enum {string} */ method: "cs_binanceSubToSub"; params: components["schemas"]["BinanceSubToSubParams"]; } | { /** @enum {string} */ method: "cs_binanceUniversalTransfer"; params: components["schemas"]["BinanceUniversalTransferParams"]; } | { /** @enum {string} */ method: "cs_binanceSubAccountAssets"; params: components["schemas"]["BinanceSubAccountAssetsParams"]; } | { /** @enum {string} */ method: "cs_binanceAccountInfo"; params: components["schemas"]["BinanceAccountInfoParams"]; } | { /** @enum {string} */ method: "cs_binanceSubAccountTransferHistory"; params: components["schemas"]["BinanceSubAccountTransferHistoryParams"]; } | { /** @enum {string} */ method: "cs_binanceUniversalTransferHistory"; params: components["schemas"]["BinanceUniversalTransferHistoryParams"]; } | { /** @enum {string} */ method: "cs_binanceWithdraw"; params: components["schemas"]["BinanceWithdrawParams"]; } | { /** @enum {string} */ method: "cs_binanceWithdrawHistory"; params: components["schemas"]["BinanceWithdrawHistoryParams"]; } | { /** @enum {string} */ method: "cs_binanceDeposit"; params: components["schemas"]["BinanceDepositParams"]; } | { /** @enum {string} */ method: "cs_binanceDepositHistory"; params: components["schemas"]["BinanceDepositHistoryParams"]; } | { /** @enum {string} */ method: "cs_binanceListSubAccounts"; params: components["schemas"]["BinanceListSubAccountsParams"]; } | { /** @enum {string} */ method: "cs_binanceCoinInfo"; params: components["schemas"]["BinanceCoinInfoParams"]; } | { /** @enum {string} */ method: "cs_binanceSubAccountDepositAddress"; params: components["schemas"]["BinanceSubAccountDepositAddressParams"]; } | { /** @enum {string} */ method: "cs_binanceSubAccountDepositHistory"; params: components["schemas"]["BinanceSubAccountDepositHistoryParams"]; }; /** @description Response returned by the typed `binance_sign` endpoint. */ BinanceSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The full signed query string, ready to be submitted to Binance. * Encoded as `&recvWindow=×tamp=&signature=`. */ signed_query: string; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubAccountAssetsParams: components["schemas"]["SubAccountAssetsRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubAccountDepositAddressParams: components["schemas"]["SubAccountDepositAddressRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubAccountDepositHistoryParams: components["schemas"]["SubAccountDepositHistoryRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubAccountTransferHistoryParams: components["schemas"]["SubAccountTransferHistoryRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubToMasterParams: components["schemas"]["SubToMasterRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceSubToSubParams: components["schemas"]["SubToSubRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceUniversalTransferHistoryParams: components["schemas"]["UniversalTransferHistoryRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceUniversalTransferParams: components["schemas"]["UniversalTransferRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceWithdrawHistoryParams: components["schemas"]["WithdrawHistoryRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description Parameters envelope for all Binance RPC methods. */ BinanceWithdrawParams: components["schemas"]["WithdrawRequest"] & { dryRun?: components["schemas"]["BinanceDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: float * @description Optional "receive window", i.e., for how long the request stays valid. * May only be specified in milliseconds, with up to three decimal places of precision. * If omitted, defaults to 10000. Must not be greater than 60000. */ recvWindow?: number | null; }; /** @description A bitcoin address and its network. */ BitcoinAddressInfo: { /** * @description The bitcoin address. * @example bc1puc0q8jhx3knc2stlfhl35nja89nvkmqr4c5e2ldyuq2mcckhr3msavj99j */ address: string; chain: components["schemas"]["BtcChain"]; }; /** * @example { * "message_base64": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTYK" * } */ BlobSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description An optional base64 string comprising a SEC1-encoded secp256k1 public key. * This field can be used *only* with Schnorr keys. * * If this field is present, the response will be a Schnorr adaptor signature * in the format specified by Blockstream for use in libsecp256k1-zkp. See * * for more information. * @example Arny4WoHDNBVXYcynhNl9/y7JttJ2rk0CCRfLR7t3aDg */ adaptor_pk?: string | null; /** * @description An optional domain separation tag for use *only* with BLS signing requests. * This field must not be supplied for requests involving non-BLS key types. * * If this field is not present or null, the domain separation tag specified in * the IETF BLS Signatures draft versions 4 and 5, section 4.2.3 (minimal pubkey * size variant) is used. * * Otherwise, this field must contain a base-64 string encoding a non-empty byte * vector. When using a custom tag, RFC9380 (Section 3.1) recommends a length of * at least 16 bytes. * @example EbbLvCxI7gan71iISDsfr46etOv606QkGGDP5PpVl5Q= */ bls_dst?: string | null; /** * @description The blob to sign, encoded as a base64 string. * * Note that certain signing keys impose additional requirements on the contents of * the message. For example, Secp256k1 keys require that the message is 32 bytes long. */ message_base64: string; /** * @description An optional tweak value for use only with (some) secp256k1 key types. * This field must not be supplied for requests involving any other key type. * * If this field is not present or null, no tweak is applied. Otherwise, this field * must contain a base-64 string encoding a vector of exactly 32 bytes. See the * CubeSigner documentation for more information on the Segwit tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ segwit_tweak?: string | null; /** * @description An optional tweak value for use *only* with Taproot keys. This field must not * be supplied for requests involving any other key type. * * If this field is not present or null, no tweak is applied. If the field is an * empty string, the key is tweaked with an unspendable script path per BIP0341. * Otherwise, this field must contain a 32-byte, base-64 string representing the * Merkle root with which to tweak the key before signing. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ taproot_tweak?: string | null; }; /** * @description Supported BTC chains. * @enum {string} */ BtcChain: "mainnet" | "signet"; /** @description Leaf hash and code, as per BIP341 and https://github.com/rust-bitcoin/rust-bitcoin/blob/464202109d2b2c96e9b4867461bffe420dbd8177/bitcoin/src/crypto/sighash.rs#L691 */ BtcLeafHashCodeSeparator: { /** * Format: int32 * @description Code separator */ code_separator: number; /** @description Taproot-tagged hash with tag "TapLeaf". */ leaf_hash: string; }; /** @description Parameters for the [`cs_btcListUtxos`](CsRpc::BtcListUtxos) method. */ BtcListUtxosRequest: { /** @description The Bitcoin address whose unspent outputs (UTXOs) are being queried. */ address: string; /** * Format: int32 * @description The maximum number of UTXOs to return (1-250). * @default 100 */ max_results?: number; network: components["schemas"]["BtcNetwork"]; /** @description Pagination token returned by a previous call. */ next_token?: string | null; }; /** @description The response to [`cs_btcListUtxos`](super::request::CsRpc::BtcListUtxos). */ BtcListUtxosResponse: { /** @description Pagination token to pass to the next call, if more results remain. */ next_token?: string | null; /** @description The unspent transaction outputs for the queried address. */ utxos: components["schemas"]["BtcUtxo"][]; }; /** @description Data to sign */ BtcMessageSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description Message to sign as a hex-encoded byte string. * @example 0xdeadbeef13c0ffee */ data: string; /** @description For segwit, sign the message as p2sh-p2wpkh instead of p2wpkh */ is_p2sh?: boolean; }; /** @description BTC message signing response */ BtcMessageSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** @description The base64-encoded signature in BIP137 format. */ sig: string; }; /** * @description The Bitcoin network to query for UTXOs. * @enum {string} */ BtcNetwork: "mainnet" | "testnet"; /** @enum {string} */ BtcSighashType: | "All" | "None" | "Single" | "AllPlusAnyoneCanPay" | "NonePlusAnyoneCanPay" | "SinglePlusAnyoneCanPay"; BtcSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { sig_kind: components["schemas"]["BtcSignatureKind"]; tx: components["schemas"]["BtcTx"]; }; BtcSignatureKind: { /** @description Segregated Witness */ Segwit: { /** * @description Transaction input index * @example 0 */ input_index: number; /** * @description Script * @example 0x76a91479091972186c449eb1ded22b78e40d009bdf008988ac */ script_code: string; sighash_type: components["schemas"]["BtcSighashType"]; /** * @description Optional tweak to apply to the key before signing. * * When supplied, this field must contain a base-64 string encoding a vector of * exactly 32 bytes, which are used to compute the tweaked public key. See the * CubeSigner documentation for more information on the Segwit tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ tweak?: string | null; /** * Format: int64 * @description The total amount of the input (in satoshis). * @example 1000000 */ value: number; }; }; /** * @example { * "input": [ * { * "previous_output": "77541aeb3c4dac9260b68f74f44c973081a9d4cb2ebe8038b2d70faa201b6bdb:1", * "script_sig": "", * "sequence": 4294967294, * "witness": [] * } * ], * "lock_time": 1170, * "output": [ * { * "script_pubkey": "76a914a457b684d7f0d539a46a45bbc043f35b59d0d96388ac", * "value": 199996600 * }, * { * "script_pubkey": "76a914fd270b1ee6abcaea97fea7ad0402e8bd8ad6d77c88ac", * "value": 800000000 * } * ], * "version": 1 * } */ BtcTx: Record; BtcTxOut: { /** @description The script which must be satisfied for the output to be spent. */ script_pubkey: string; /** * Format: int64 * @description The value of the output, in satoshis. */ value: number; }; /** @description A single Bitcoin unspent transaction output (UTXO). */ BtcUtxo: { /** @description The address that controls this output. */ address?: string | null; /** @description Whether the output has reached finality (is confirmed). */ confirmed: boolean; /** * Format: int64 * @description The block time of the output, in seconds since the Unix epoch. */ time?: number | null; /** @description The hash of the transaction that created this output. */ transaction_hash: string; /** @description The output value, in satoshis, as a decimal string. */ value?: string | null; /** * Format: int32 * @description The index of this output within its transaction. */ vout_index?: number | null; }; /** * @description The access-controlled actions that can be performed on a bucket * @enum {string} */ BucketAction: | "read:key:value" | "read:key:exists" | "update:key:value" | "delete:key:value" | "scan:keys" | "update:bucket:owner" | "update:bucket:acl" | "update:bucket:metadata"; /** @description Information about a policy KV store bucket. */ BucketInfo: ({ created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & { /** @description The access-control entries for the bucket. */ acl?: unknown[] | null; /** @description Arbitrary user-defined metadata. */ metadata?: unknown; org_id: components["schemas"]["Id"]; owner: components["schemas"]["Id"]; }) & { /** @description The name of the bucket. */ name: string; }; /** * @description Sub-entity of org where per-bucket metadata (like ACL) is stored. * The [Id] of a [BucketMeta] must be the bucket name. */ BucketMeta: { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & { /** @description The access-control entries for the bucket. */ acl?: unknown[] | null; /** @description Arbitrary user-defined metadata. */ metadata?: unknown; org_id: components["schemas"]["Id"]; owner: components["schemas"]["Id"]; }; /** * @description Different Bybit account kinds. * @enum {string} */ BybitAccountKind: "Main" | "Sub"; /** * @description Wire-format patch payload for [`KeyProperties::BybitApi`]. * * Every field follows the same per-field PATCH semantics: a missing field * leaves the existing value alone, a JSON `null` clears it, and a value sets it. */ BybitApiPropertiesPatch: { account_kind?: components["schemas"]["BybitAccountKind"] | null; /** @description The Bybit-issued API key string. Encrypted server-side before storage. */ api_key?: string | null; /** @description Arbitrary label. Useful for storing the corresponding API key label on the Bybit side. */ label?: string | null; }; /** @description One entry in [`BybitQueryCoinsBalanceResponse::balance`]. */ BybitCoinBalance: { /** @description Bonus / promotional balance, as a decimal string. */ bonus?: string | null; /** @description Coin symbol, uppercase (e.g. `USDT`, `BTC`). */ coin: string; /** @description Portion of `wallet_balance` that can be transferred out. */ transferBalance: string; /** @description Total wallet balance for `coin`, as a decimal string. */ walletBalance: string; }; /** @description One entry in [`BybitCoinInfoEntry::chains`]. */ BybitCoinInfoChain: { /** @description Short chain code (e.g. `ETH`, `TRX`). */ chain: string; /** @description Whether deposits are enabled on this chain: `"0"` off, `"1"` on. */ chainDeposit?: string | null; /** @description Human-readable chain name (e.g. `ERC20`). */ chainType?: string | null; /** @description Whether withdrawals are enabled on this chain: `"0"` off, `"1"` on. */ chainWithdraw?: string | null; /** @description Number of confirmations required for a deposit to be credited. */ confirmation?: string | null; /** @description Minimum deposit amount, as a decimal string. */ depositMin?: string | null; /** @description Withdrawal fee on this chain, as a decimal string. If empty string, this coin does not support withdrawal. */ withdrawFee?: string | null; /** @description Minimum withdrawal amount, as a decimal string. */ withdrawMin?: string | null; [key: string]: unknown; }; /** @description One entry in [`BybitCoinInfoResponse::rows`]. */ BybitCoinInfoEntry: { /** @description Per-chain configuration for this coin. */ chains?: components["schemas"]["BybitCoinInfoChain"][]; /** @description Coin symbol, uppercase (e.g. `USDT`). */ coin: string; /** @description Full coin name (e.g. `Tether`). */ name?: string | null; [key: string]: unknown; }; /** @description Response of `GET /v5/asset/coin/query-info`. */ BybitCoinInfoResponse: { /** @description Per-coin info entries. */ rows: components["schemas"]["BybitCoinInfoEntry"][]; }; /** @description One entry in [`BybitQueryDepositAddressResponse::chains`]. */ BybitDepositChain: { /** @description Deposit address on this chain. */ addressDeposit: string; /** @description Single-deposit cap for this coin on this chain; `"-1"` means no limit. */ batchReleaseLimit?: string | null; /** @description Short chain code (e.g. `ETH`, `TRX`). */ chain: string; /** @description Human-readable chain name (e.g. `Ethereum (ERC20)`). */ chainType?: string | null; /** * @description Token contract address on this chain. Bybit only returns the last 6 * characters; empty for native coins. */ contractAddress?: string | null; /** * @description Memo / tag required for chains that use one (e.g. XRP, EOS). Empty for * chains that don't. */ tagDeposit?: string | null; }; /** @description One entry in [`BybitDepositHistoryResponse::rows`]. */ BybitDepositEntry: { /** @description Deposit amount as a decimal string. */ amount: string; /** @description Short chain code (e.g. `ETH`, `TRX`). */ chain: string; /** @description Coin symbol, uppercase (e.g. `USDT`). */ coin: string; /** @description Number of confirmations received so far. */ confirmations?: string | null; /** @description Deposit fee charged, as a decimal string. */ depositFee?: string | null; /** * Format: int32 * @description Deposit state (e.g. `3` = deposit success). See the Bybit docs. */ status?: number | null; /** @description Timestamp the deposit succeeded, in milliseconds since epoch (as a string). */ successAt?: string | null; /** @description Memo / tag for chains that use one (e.g. XRP, EOS). */ tag?: string | null; /** @description Destination deposit address. */ toAddress?: string | null; /** @description On-chain transaction hash. */ txID?: string | null; [key: string]: unknown; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitDepositHistoryParams: components["schemas"]["BybitDepositHistoryRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** * @description Parameters for `GET /v5/asset/deposit/query-record`. * * By default, queries records from the last 30 days; otherwise, `endTime` - `startTime` must be less than 30 days. */ BybitDepositHistoryRequest: { /** @description Filter by coin symbol (uppercase). */ coin?: string | null; /** @description Pagination cursor (the `nextPageCursor` from a prior response). */ cursor?: string | null; /** * Format: int64 * @description End timestamp (ms since epoch). */ endTime?: number | null; /** @description Filter by Bybit-internal deposit id. */ id?: string | null; /** * Format: int32 * @description Page size, `[1, 50]`. Defaults to 50. */ limit?: number | null; /** * Format: int64 * @description Start timestamp (ms since epoch). The span between `start_time` and * `end_time` must not exceed 30 days. */ startTime?: number | null; /** * @description Filter by on-chain transaction id. Data before 2024-01-01 is not * queryable via this field. */ txID?: string | null; }; /** @description Response of `GET /v5/asset/deposit/query-record`. */ BybitDepositHistoryResponse: { /** * @description Opaque cursor to pass back as `cursor` on the next request; absent on * the last page. */ nextPageCursor?: string | null; /** @description Deposit records matching the query. */ rows: components["schemas"]["BybitDepositEntry"][]; }; BybitDryRunArgs: { /** @description The Bybit API method that would have been used */ method: string; /** @description The request body (for POST endpoints) or query string (for GET endpoints). */ payload: string; /** @description The Bybit API url that would have been called */ url: string; }; /** * @description "Dry run" modes for Bybit requests. * @enum {string} */ BybitDryRunMode: "NO_SIGN" | "NO_SUBMIT"; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitQueryCoinInfoParams: components["schemas"]["BybitQueryCoinInfoRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `GET /v5/asset/coin/query-info`. */ BybitQueryCoinInfoRequest: { /** * @description Filter by coin symbol (uppercase, e.g. `"BTC"`). Bybit returns info for * all coins when omitted. */ coin?: string | null; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitQueryCoinsBalanceParams: components["schemas"]["BybitQueryCoinsBalanceRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `GET /v5/asset/transfer/query-account-coins-balance`. */ BybitQueryCoinsBalanceRequest: { /** * @description Wallet type. Common values: `"FUND"`, `"UNIFIED"`, `"CONTRACT"`. Bybit * expects this verbatim; we don't constrain it on our side. */ accountType: string; /** * @description Optional list of coin symbols, comma-separated (e.g. `"BTC,USDT"`). * Bybit returns balances for all coins when omitted. */ coin?: string | null; /** * @description Optional sub-account UID. When supplied, the master key queries the * named sub-account's balance. */ memberId?: string | null; /** * @description Optional flag: `"0"` query without conversion to USD (default), * `"1"` include USD valuation. Bybit accepts this as a string. */ withBonus?: string | null; }; /** @description Response of `GET /v5/asset/transfer/query-account-coins-balance`. */ BybitQueryCoinsBalanceResponse: { /** @description Account type the balances belong to (e.g. `UNIFIED`, `FUND`, `CONTRACT`). */ accountType: string; /** @description Per-coin balances. */ balance: components["schemas"]["BybitCoinBalance"][]; /** @description UID of the (sub-)account whose balance is being reported. */ memberId?: string | null; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitQueryDepositAddressParams: components["schemas"]["BybitQueryDepositAddressRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `GET /v5/asset/deposit/query-address`. */ BybitQueryDepositAddressRequest: { /** * @description Optional network identifier (e.g. `"ETH"`, `"TRX"`). When omitted, * Bybit returns the deposit address on every supported chain. */ chainType?: string | null; /** @description Coin symbol (e.g. `"BTC"`, `"USDT"`). */ coin: string; }; /** @description Response of `GET /v5/asset/deposit/query-address`. */ BybitQueryDepositAddressResponse: { /** @description One deposit address per supported chain. */ chains: components["schemas"]["BybitDepositChain"][]; /** @description Coin symbol the deposit addresses are for (e.g. `USDT`). */ coin: string; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitQuerySubDepositAddressParams: components["schemas"]["BybitQuerySubDepositAddressRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `GET /v5/asset/deposit/query-sub-member-address`. */ BybitQuerySubDepositAddressRequest: { /** * @description Short chain code, as returned in the `chain` field of * [`BybitRpc::QueryCoinInfo`] (e.g. `"ETH"`, `"TRX"`). */ chainType: string; /** @description Coin symbol, uppercase only (e.g. `"USDT"`). */ coin: string; /** @description UID of the sub-account whose deposit address to fetch. */ subMemberId: string; }; /** * @description Response of `GET /v5/asset/deposit/query-sub-member-address`. * * NOTE: unlike the master-account `query-address` endpoint (modelled by * [`BybitQueryDepositAddressResponse`]), Bybit returns `chains` here as a * single object rather than an array — the request pins one `chainType`, so * there is only ever one chain to report. */ BybitQuerySubDepositAddressResponse: { chains: components["schemas"]["BybitDepositChain"]; /** @description Coin symbol the deposit address is for (e.g. `USDT`). */ coin: string; }; /** * @description Parameters for [`BybitRpc::QuerySubMembers`]. * * Bybit endpoint: `GET /v5/user/query-sub-members`. Takes no inputs beyond * the common envelope. */ BybitQuerySubMembersParams: { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional receive window in milliseconds. Defaults to 10000. */ recvWindow?: number | null; }; /** @description Response of `GET /v5/user/query-sub-members`. */ BybitQuerySubMembersResponse: { /** @description The sub-accounts under the calling master account. */ subMembers: components["schemas"]["BybitSubMember"][]; }; /** * @description Parameters for [`BybitRpc::QueryUser`]. * * Bybit endpoint: `GET /v5/user/query-api`. Takes no inputs beyond the common * `recvWindow` / `timestamp` envelope; defined directly (instead of through * the [`BybitParams`] generic alias) so utoipa emits a non-empty schema. */ BybitQueryUserParams: { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional receive window in milliseconds. Defaults to 10000. */ recvWindow?: number | null; }; /** @description Response of `GET /v5/user/query-api`. */ BybitQueryUserResponse: { /** @description Bybit account KYC level (`"0"` = none). */ kycLevel?: string | null; /** @description Optional free-text label set on the API key. */ note?: string | null; /** * @description Master account UID for sub-accounts, `"0"` if the calling key is a * master account. */ parentUid: string; /** @description API permissions assigned to the key. */ permissions?: unknown; /** * Format: int64 * @description Bybit-assigned account UID of the API key. */ userID: number; /** @description VIP level. */ vipLevel?: string | null; [key: string]: unknown; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitQueryWithdrawAddressParams: components["schemas"]["BybitQueryWithdrawAddressRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `GET /v5/asset/withdraw/query-address`. */ BybitQueryWithdrawAddressRequest: { /** * Format: int32 * @description Filter by address category: `0` on-chain, `1` internal transfer, `2` * both. Bybit returns every category when omitted. */ addressType?: number | null; /** @description Filter by short chain code (e.g. `"ETH"`, `"TRX"`). */ chain?: string | null; /** * @description Filter by coin symbol (uppercase). Bybit also accepts the coin's * `baseCoin` here, which matches addresses whitelisted for every chain of * that coin. */ coin?: string | null; /** @description Pagination cursor (the `nextPageCursor` from a prior response). */ cursor?: string | null; /** * Format: int32 * @description Page size, `[1, 50]`. Defaults to 50. */ limit?: number | null; }; /** @description Response of `GET /v5/asset/withdraw/query-address`. */ BybitQueryWithdrawAddressResponse: { /** * @description Opaque cursor to pass back as `cursor` on the next request; absent on * the last page. */ nextPageCursor?: string | null; /** @description Whitelisted withdrawal addresses matching the query. */ rows: components["schemas"]["BybitWithdrawAddressEntry"][]; }; /** * @description Bybit-family RPC methods. Each variant authenticates as the * [`KeyType::HmacSha256Bybit`] key in its `params.key_id` (which must carry * [`KeyProperties::BybitApi`]). */ BybitRpc: | { /** @enum {string} */ method: "cs_bybitQueryUser"; params: components["schemas"]["BybitQueryUserParams"]; } | { /** @enum {string} */ method: "cs_bybitQuerySubMembers"; params: components["schemas"]["BybitQuerySubMembersParams"]; } | { /** @enum {string} */ method: "cs_bybitQueryCoinsBalance"; params: components["schemas"]["BybitQueryCoinsBalanceParams"]; } | { /** @enum {string} */ method: "cs_bybitQueryDepositAddress"; params: components["schemas"]["BybitQueryDepositAddressParams"]; } | { /** @enum {string} */ method: "cs_bybitUniversalTransfer"; params: components["schemas"]["BybitUniversalTransferParams"]; } | { /** @enum {string} */ method: "cs_bybitWithdraw"; params: components["schemas"]["BybitWithdrawParams"]; } | { /** @enum {string} */ method: "cs_bybitWithdrawals"; params: components["schemas"]["BybitWithdrawalsParams"]; } | { /** @enum {string} */ method: "cs_bybitQueryCoinInfo"; params: components["schemas"]["BybitQueryCoinInfoParams"]; } | { /** @enum {string} */ method: "cs_bybitDepositHistory"; params: components["schemas"]["BybitDepositHistoryParams"]; } | { /** @enum {string} */ method: "cs_bybitSubDepositHistory"; params: components["schemas"]["BybitSubDepositHistoryParams"]; } | { /** @enum {string} */ method: "cs_bybitUniversalTransferHistory"; params: components["schemas"]["BybitUniversalTransferHistoryParams"]; } | { /** @enum {string} */ method: "cs_bybitQueryWithdrawAddress"; params: components["schemas"]["BybitQueryWithdrawAddressParams"]; } | { /** @enum {string} */ method: "cs_bybitQuerySubDepositAddress"; params: components["schemas"]["BybitQuerySubDepositAddressParams"]; }; /** @description Response returned by the typed `bybit_sign` endpoint. */ BybitSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The Bybit-bound payload (URL-encoded query for GET, JSON body for * POST). Submitted verbatim by the rpc-api lambda; the payload bytes are * also part of the signing input. */ payload: string; /** * Format: int32 * @description Effective receive window in milliseconds. */ recv_window: number; /** * @description Hex-encoded HMAC-SHA256 signature of * `timestamp || apiKey || recvWindow || payload`. Goes into the * `X-BAPI-SIGN` header. */ signature_hex: string; /** * Format: int64 * @description Signing timestamp (ms since epoch). Picked by the signer. */ timestamp_ms: number; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitSubDepositHistoryParams: components["schemas"]["BybitSubDepositHistoryRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** * @description Parameters for `GET /v5/asset/deposit/query-sub-member-record`. * * Master-only: returns the deposit records of the sub-account named by * `sub_member_id`. Bybit exposes these to the parent account's credentials * alone; a sub-account key reads its own deposits through * [`BybitDepositHistoryRequest`] instead. * * By default, queries records from the last 30 days; otherwise, `endTime` - * `startTime` must be less than 30 days. */ BybitSubDepositHistoryRequest: { /** @description Filter by coin symbol (uppercase). */ coin?: string | null; /** @description Pagination cursor (the `nextPageCursor` from a prior response). */ cursor?: string | null; /** * Format: int64 * @description End timestamp (ms since epoch). */ endTime?: number | null; /** @description Filter by Bybit-internal deposit id. */ id?: string | null; /** * Format: int32 * @description Page size, `[1, 50]`. Defaults to 50. */ limit?: number | null; /** * Format: int64 * @description Start timestamp (ms since epoch). The span between `start_time` and * `end_time` must not exceed 30 days. */ startTime?: number | null; /** * @description UID of the sub-account whose deposit history to fetch. Bybit requires * this, so there is no "calling account" fallback on this endpoint. */ subMemberId: string; /** * @description Filter by on-chain transaction id. Data before 2024-01-01 is not * queryable via this field. */ txID?: string | null; }; /** @description One entry in [`BybitQuerySubMembersResponse::sub_members`]. */ BybitSubMember: { /** * Format: int32 * @description Trading account configuration: `1` Classic, `3` UTA1.0, `4` UTA1.0 Pro, * `5` UTA2.0, `6` UTA2.0 Pro. */ accountMode?: number | null; /** * Format: int32 * @description Sub-account category: `1` standard, `6` custodial. */ memberType?: number | null; /** @description Free-text remark associated with the sub-account. */ remark?: string | null; /** * Format: int32 * @description Account state: `1` active, `2` login-restricted, `4` frozen. */ status?: number | null; /** @description Sub-account UID. */ uid: string; /** @description Display name of the sub-account. */ username?: string | null; [key: string]: unknown; }; /** @description One entry in [`BybitUniversalTransferHistoryResponse::list`]. */ BybitTransferEntry: { /** @description Transfer amount as a decimal string. */ amount: string; /** @description Coin symbol, uppercase (e.g. `USDT`). */ coin: string; /** @description Source wallet type (e.g. `FUND`, `UNIFIED`). */ fromAccountType?: string | null; /** @description Source account UID. */ fromMemberId?: string | null; /** @description Transfer state: `SUCCESS`, `PENDING`, or `FAILED`. */ status?: string | null; /** @description Creation timestamp, in milliseconds since epoch (as a string). */ timestamp?: string | null; /** @description Destination wallet type. */ toAccountType?: string | null; /** @description Destination account UID. */ toMemberId?: string | null; /** @description UUID of the transfer (the caller-supplied `transferId`). */ transferId: string; [key: string]: unknown; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitUniversalTransferHistoryParams: components["schemas"]["BybitUniversalTransferHistoryRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** * @description Parameters for `GET /v5/asset/transfer/query-universal-transfer-list`. * * If `startTime` and `endTime` are not provided, the API returns data from the past 7 days by default. * If only `startTime` is provided, the API returns records from `startTime` to `startTime` + 7 days. * If only `endTime` is provided, the API returns records from `endTime` - 7 days to `endTime`. * If both are provided, the maximum allowed range is 7 days (`endTime` - `startTime` ≤ 7 days). */ BybitUniversalTransferHistoryRequest: { /** @description Filter by coin symbol (uppercase). */ coin?: string | null; /** @description Pagination cursor (the `nextPageCursor` from a prior response). */ cursor?: string | null; /** * Format: int64 * @description End timestamp (ms since epoch). */ endTime?: number | null; /** * Format: int32 * @description Page size, `[1, 50]`. Defaults to 20. */ limit?: number | null; /** * Format: int64 * @description Start timestamp (ms since epoch). The span between `start_time` and * `end_time` must not exceed 7 days. */ startTime?: number | null; /** @description Filter by transfer status: `"SUCCESS"`, `"FAILED"`, or `"PENDING"`. */ status?: string | null; /** * @description Filter by the transfer's UUID (as supplied to * [`BybitRpc::UniversalTransfer`]). */ transferId?: string | null; }; /** @description Response of `GET /v5/asset/transfer/query-universal-transfer-list`. */ BybitUniversalTransferHistoryResponse: { /** * @description Universal-transfer records matching the query. (Bybit names this field * `list`, unlike the `rows` used by other history endpoints.) */ list: components["schemas"]["BybitTransferEntry"][]; /** * @description Opaque cursor to pass back as `cursor` on the next request; absent on * the last page. */ nextPageCursor?: string | null; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitUniversalTransferParams: components["schemas"]["BybitUniversalTransferRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `POST /v5/asset/transfer/universal-transfer`. */ BybitUniversalTransferRequest: { /** @description Amount as a decimal string (e.g. `"1.5"`). Sent verbatim. */ amount: string; /** @description Coin symbol (e.g. `"USDT"`). */ coin: string; /** * @description Source wallet type. Defaults to `"FUND"` if omitted; the signer * substitutes the default before signing so the signed and submitted * payloads match. */ fromAccountType?: string | null; /** * Format: int64 * @description Source account UID. For "self", the manager substitutes the caller's * own UID before this struct reaches the signer. */ fromMemberId: number; /** @description Destination wallet type. Defaults to `"FUND"` if omitted. */ toAccountType?: string | null; /** * Format: int64 * @description Destination account UID. */ toMemberId: number; /** * @description Client-supplied transfer id (UUID). Bybit echoes it back as the * canonical reference for this transfer. */ transferId: string; }; /** @description Response of `POST /v5/asset/transfer/universal-transfer`. */ BybitUniversalTransferResponse: { /** * @description Transfer state: one of `SUCCESS`, `PENDING`, `FAILED`, or * `STATUS_UNKNOWN`. */ status?: string | null; /** * @description UUID Bybit assigned to the transfer; the caller-supplied `transferId` * echoed back. */ transferId: string; }; /** @description One entry in [`BybitQueryWithdrawAddressResponse::rows`]. */ BybitWithdrawAddressEntry: { /** @description The whitelisted destination address. */ address: string; /** * Format: int32 * @description Address category: `0` on-chain, `1` internal transfer, `2` both. */ addressType?: number | null; /** @description Short chain code (e.g. `ETH`, `TRX`). */ chain: string; /** @description Coin symbol, uppercase (e.g. `USDT`). */ coin: string; /** @description Creation timestamp, in milliseconds since epoch (as a string). */ createdAt?: string | null; /** @description User-supplied label for this address-book entry. */ remark?: string | null; /** * Format: int32 * @description Entry state: `0` normal, `1` newly added (Bybit blocks withdrawals to * it for 24 hours). */ status?: number | null; /** * @description Memo / tag for chains that use one (e.g. XRP, EOS). Empty for chains * that don't. */ tag?: string | null; /** * Format: int32 * @description Whether the address has been verified: `0` unverified, `1` verified. */ verified?: number | null; [key: string]: unknown; }; /** @description One entry in [`BybitWithdrawalsResponse::rows`]. */ BybitWithdrawEntry: { /** @description Withdrawal amount as a decimal string. */ amount: string; /** @description Short chain code (e.g. `ETH`, `TRX`). */ chain: string; /** @description Coin symbol, uppercase (e.g. `USDT`). */ coin: string; /** @description Creation timestamp, in milliseconds since epoch (as a string). */ createTime: string; /** * @description Withdrawal state, e.g. `success`, `pending`, `failed`, `cancelled`. See * the Bybit docs for the full set, which depends on `withdraw_type`. */ status: string; /** @description Memo / tag for chains that use one (e.g. XRP, EOS). */ tag?: string | null; /** @description Destination: an on-chain address, or a Bybit UID for internal transfers. */ toAddress: string; /** * @description On-chain transaction hash; empty for failed/cancelled withdrawals and * for in-flight on-chain withdrawals before broadcast. */ txId?: string | null; /** @description Timestamp of the most recent status change, in milliseconds since epoch. */ updateTime: string; /** @description Network / processing fee charged for the withdrawal, as a decimal string. */ withdrawFee: string; /** @description Bybit-assigned withdrawal id. */ withdrawId: string; /** * Format: int32 * @description Withdrawal classification: `0` on-chain, `1` off-chain (internal). */ withdrawType?: number | null; [key: string]: unknown; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitWithdrawParams: components["schemas"]["BybitWithdrawRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** @description Parameters for `POST /v5/asset/withdraw/create`. Master-only. */ BybitWithdrawRequest: { /** * @description Source wallet (`"FUND"` or `"SPOT"`). Defaults to Bybit's account-level * default when omitted. */ accountType?: string | null; /** @description Destination address. Must already be in Bybit's address book. */ address: string; /** @description Amount as a decimal string. Sent verbatim. */ amount: string; /** @description Network identifier (e.g. `"ETH"`, `"TRX"`). Required by Bybit. */ chain: string; /** @description Coin symbol (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** * Format: int32 * @description Force-chain flag: `0` (default), `1`, or `2`. See Bybit docs. */ forceChain?: number | null; /** @description Client-supplied request id (UUID). Used by Bybit for idempotency. */ requestId: string; /** @description Optional memo / tag (e.g. for XRP, XLM). */ tag?: string | null; /** * Format: int64 * @description Server-supplied timestamp (ms since epoch). Set by the signer just before * signing; clients leave this `None` (because the server will ignore it anyway). */ timestamp?: number | null; }; /** @description Response of `POST /v5/asset/withdraw/create`. */ BybitWithdrawResponse: { /** @description Bybit-assigned withdrawal id. */ id: string; }; /** * @description Parameters envelope for all Bybit RPC variants whose payload schema is * derived from a `*Request` struct. (`BybitQueryUserParams` and * `BybitQuerySubMembersParams` have no per-variant payload and are defined * directly below.) */ BybitWithdrawalsParams: components["schemas"]["BybitWithdrawalsRequest"] & { dryRun?: components["schemas"]["BybitDryRunMode"] | null; keyId: components["schemas"]["Id"]; /** * Format: int32 * @description Optional "receive window", i.e., for how long the request stays valid. * Specified in milliseconds. If omitted, defaults to 10000. */ recvWindow?: number | null; }; /** * @description Parameters for `GET /v5/asset/withdraw/query-record`. * * Master-only: Bybit answers this endpoint for the master UID's API key * alone, and has no sub-account equivalent, because sub-accounts cannot * withdraw to an external address. * * By default, queries records from the last 30 days; otherwise, `endTime` - * `startTime` must be less than 30 days. */ BybitWithdrawalsRequest: { /** @description Filter by coin symbol. */ coin?: string | null; /** @description Pagination cursor (the `nextPageCursor` from a prior response). */ cursor?: string | null; /** * Format: int64 * @description End timestamp (ms since epoch). */ endTime?: number | null; /** * Format: int32 * @description Page size, `[1, 50]`. Defaults to 50. */ limit?: number | null; /** * Format: int64 * @description Start timestamp (ms since epoch). The span between `start_time` and * `end_time` must not exceed 30 days. */ startTime?: number | null; /** @description Filter by on-chain transaction id. */ txID?: string | null; /** * @description Filter by Bybit-assigned withdrawal id (the `id` returned by * [`BybitRpc::Withdraw`]). */ withdrawID?: string | null; /** * Format: int32 * @description Which kinds of withdrawal to return: `0` on-chain only, `1` off-chain * (internal Bybit-to-Bybit) only, `2` both. Bybit defaults to `0`, so * internal transfers out are invisible unless this is set to `1` or `2`. */ withdrawType?: number | null; }; /** @description Response of `GET /v5/asset/withdraw/query-record`. */ BybitWithdrawalsResponse: { /** * @description Opaque cursor to pass back as `cursor` on the next request to fetch * the next page; absent on the last page. */ nextPageCursor?: string | null; /** @description Withdrawal records matching the query. */ rows: components["schemas"]["BybitWithdrawEntry"][]; }; /** @description Return type of [proxy::call_webhook] */ CallWebhookResult: { /** @description The response body */ body: string; /** * Format: int32 * @description The HTTP status of the response */ status: number; }; CancelInvitationRequest: { email: components["schemas"]["Email"]; }; /** @description Parameters for the [`cs_transactionCancel`](RpcMethod::CancelTransaction) method. */ CancelTransactionRequest: { /** @description The transaction id. */ id: string; }; /** * @description Supported Canton environments. * @enum {string} */ CantonEnvironment: "mainnet" | "devnet"; /** @description Information about a specific Canton party. */ CantonPartyInfo: { /** * @description A Canton party. * @example Alice::1220f2fe29866fd6a0009ecc8a64ccdc09f1958bd0f801166baaee469d1251b2eb72 */ address: string; chain: components["schemas"]["CantonEnvironment"]; }; /** @description Describes how to derive a WebAuthn challenge value. */ ChallengePieces: { /** * @description A base64url encoding of UTF8 JSON. The data in that JSON is endpoint specific, and describes what this FIDO challenge will be used for. * * Clients can use `preimage` along with `random_seed` to reconstruct the challenge like so: * * `challenge = HMAC-SHA256(key=random_seed, message=preimage)` */ preimage: string; /** @description A random seed that prevents replay attacks */ random_seed: string; }; /** @description Client information representing the nature of front-end in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`]. */ ClientProfile: { /** * @description Agent/Product name * @example Mozilla Firefox */ agent?: string | null; /** * @description Name of the engine * @example Gecko */ engine?: string | null; /** * @description Agent/product version * @example 41.2 */ version?: string | null; }; /** * @description Session information sent to the client. * This struct works in tandem with its server-side counterpart [`SessionData`]. */ ClientSessionInfo: { /** @description Token to use for authorization. */ auth_token: string; auth_token_exp: components["schemas"]["EpochDateTime"]; /** * Format: int32 * @description Epoch at which the token was last refreshed */ epoch: number; epoch_token: components["schemas"]["B32"]; /** @description Token to use for refreshing the `(auth, refresh)` token pair */ refresh_token: string; refresh_token_exp: components["schemas"]["EpochDateTime"]; /** @description Session ID */ session_id: string; }; /** @description Attributes that are expected to be provided by the client */ ClientSessionMetadata: { client?: components["schemas"]["ClientProfile"]; os_info?: components["schemas"]["OsInfo"]; }; /** @description One coin entry in [`CoinInfoResponse`]. */ CoinInfoEntry: { /** @description Asset symbol (e.g. `"BTC"`, `"USDT"`). */ coin: string; /** @description Whether deposits are enabled on any network for this coin. */ depositAllEnable: boolean; /** @description Available balance, as a decimal string. */ free: string; /** @description Balance frozen by Binance, as a decimal string. */ freeze: string; /** @description Balance available to subscribe to an IPO, as a decimal string. */ ipoable: string; /** @description Balance pending an IPO subscription, as a decimal string. */ ipoing: string; /** @description `true` if the asset represents a fiat currency. */ isLegalMoney: boolean; /** @description Balance locked in open orders, as a decimal string. */ locked: string; /** @description Human-readable name (e.g. `"Bitcoin"`). */ name: string; /** @description One entry per supported network for this coin. */ networkList: components["schemas"]["CoinInfoNetwork"][]; /** @description Balance held in long-term storage, as a decimal string. */ storage: string; /** @description `true` if the asset is currently tradable on Binance. */ trading: boolean; /** @description Whether withdrawals are enabled on any network for this coin. */ withdrawAllEnable: boolean; /** @description Balance currently being withdrawn, as a decimal string. */ withdrawing: string; }; /** @description One network entry in [`CoinInfoEntry::network_list`]. */ CoinInfoNetwork: { /** @description Regex describing the expected address format. */ addressRegex?: string | null; /** @description `true` if the network is currently busy. */ busy?: boolean | null; /** @description Asset symbol on this network. */ coin: string; /** @description Two-letter country code, if applicable. */ country?: string | null; /** @description Free-text deposit description. */ depositDesc?: string | null; /** @description Whether deposits are enabled on this network. */ depositEnable: boolean; /** * Format: int64 * @description Estimated arrival time in minutes. */ estimatedArrivalTime?: number | null; /** @description Whether this is the default network for the coin. */ isDefault: boolean; /** @description Regex describing the expected memo/tag format (when applicable). */ memoRegex?: string | null; /** * Format: int32 * @description Minimum number of confirmations before Binance credits a deposit. */ minConfirm?: number | null; /** @description Human-readable name (e.g. `"BNB Smart Chain (BEP20)"`). */ name: string; /** @description Network identifier (e.g. `"BSC"`, `"ETH"`). */ network: string; /** @description `true` if the deposit address is shared across users. */ sameAddress?: boolean | null; /** @description Free-text special tips for users. */ specialTips?: string | null; /** * Format: int32 * @description Confirmations after which the deposit is unlocked for trading. */ unLockConfirm?: number | null; /** @description Free-text withdraw description. */ withdrawDesc?: string | null; /** @description Whether withdrawals are enabled on this network. */ withdrawEnable: boolean; /** @description Withdrawal fee, as a decimal string. */ withdrawFee?: string | null; /** @description Step size for withdrawal amounts, as a decimal string. */ withdrawIntegerMultiple?: string | null; /** @description Minimum internal transfer amount */ withdrawInternalMin?: string | null; /** @description Maximum withdrawal amount, as a decimal string. */ withdrawMax?: string | null; /** @description Minimum withdrawal amount, as a decimal string. */ withdrawMin?: string | null; }; /** * @description Response returned by `cs_binanceCoinInfo`. * * Binance returns a top-level JSON array; this newtype preserves that wire * format while giving the response a named type in the OpenAPI schema. */ CoinInfoResponse: components["schemas"]["CoinInfoEntry"][]; /** * @description One account entry in [`CoinbaseListAccountsResponse`]. Coinbase's account schema is * flexible; we capture the subset of fields the typed endpoint exposes today * and leave room to grow. */ CoinbaseAccount: { /** @description Whether the account is currently active. */ active: boolean; available_balance: components["schemas"]["CoinbaseAmount"]; /** @description Account creation time (RFC3339). */ created_at?: string | null; /** @description Asset symbol (e.g. `"BTC"`, `"USD"`). */ currency: string; /** @description Whether this is the primary account for the asset. */ default: boolean; /** @description Soft-deletion time, if any (RFC3339). */ deleted_at?: string | null; hold?: components["schemas"]["CoinbaseAmount"] | null; /** @description Human-readable name (e.g. `"BTC Wallet"`). */ name: string; /** @description Ready flag (`true` after Coinbase has finished onboarding the account). */ ready?: boolean | null; /** @description UUID of the portfolio this account belongs to. */ retail_portfolio_id?: string | null; /** * @description Account type (e.g. `"ACCOUNT_TYPE_CRYPTO"`). Left as a string for * forward compatibility. */ type: string; /** @description Last modification time (RFC3339). */ updated_at?: string | null; /** @description Account UUID. */ uuid: string; }; /** @description A `{ value, currency }` amount pair used throughout Coinbase responses. */ CoinbaseAmount: { /** @description Asset symbol (e.g. `"USD"`, `"BTC"`). */ currency: string; /** * @description Decimal-string amount (Coinbase preserves precision by not converting * to floats). */ value: string; }; /** * @description Wire-format patch payload for [`KeyProperties::CoinbaseApi`]. * * Every field follows the same per-field PATCH semantics: a missing field * leaves the existing value alone, a JSON `null` clears it, and a value sets it. */ CoinbaseApiPropertiesPatch: { /** * @description Identifier of the Coinbase API key this key authenticates as. Plain * (non-secret) value; appears in JWT `kid`/`sub` claims. */ api_key_id?: string | null; /** @description Coinbase portfolio name. */ portfolio_name?: string | null; /** @description Coinbase portfolio UUID. */ portfolio_uuid?: string | null; }; CoinbaseDryRunArgs: { /** @description The Coinbase API method that would have been used */ method: string; /** @description The Coinbase API url method that would have been called */ url: string; }; /** * @description Different "dry run" modes for executing Coinbase requests. * @enum {string} */ CoinbaseDryRunMode: "NO_SIGN" | "NO_SUBMIT"; /** @description Parameters envelope for all Coinbase RPC methods. */ CoinbaseListAccountsParams: components["schemas"]["ListAccountsRequest"] & { dry_run?: components["schemas"]["CoinbaseDryRunMode"] | null; key_id: components["schemas"]["Id"]; }; /** @description Response returned by `cs_coinbaseListAccounts`. */ CoinbaseListAccountsResponse: { /** @description One entry per visible account. */ accounts: components["schemas"]["CoinbaseAccount"][]; /** @description Pagination cursor; pass to a follow-up request to fetch the next page. */ cursor?: string | null; /** @description `true` if there are more accounts to fetch with `cursor`. */ has_next: boolean; /** * Format: int32 * @description Number of entries in `accounts`. */ size: number; }; /** @description Parameters envelope for all Coinbase RPC methods. */ CoinbaseListPortfoliosParams: components["schemas"]["ListPortfoliosRequest"] & { dry_run?: components["schemas"]["CoinbaseDryRunMode"] | null; key_id: components["schemas"]["Id"]; }; /** @description Response returned by `cs_coinbaseListPortfolios`. */ CoinbaseListPortfoliosResponse: { /** @description One entry per visible portfolio. */ portfolios: components["schemas"]["CoinbasePortfolio"][]; }; /** @description Parameters envelope for all Coinbase RPC methods. */ CoinbaseMoveFundsParams: components["schemas"]["MoveFundsRequest"] & { dry_run?: components["schemas"]["CoinbaseDryRunMode"] | null; key_id: components["schemas"]["Id"]; }; /** @description Response returned by `cs_coinbaseMoveFunds`. */ CoinbaseMoveFundsResponse: { /** @description Echoed source portfolio UUID. */ source_portfolio_uuid: string; /** @description Echoed target portfolio UUID. */ target_portfolio_uuid: string; }; /** @description One portfolio entry in [`CoinbaseListPortfoliosResponse`]. */ CoinbasePortfolio: { /** @description `true` if this portfolio is deleted. */ deleted?: boolean; /** @description Human-readable name. */ name: string; /** * @description Portfolio type, e.g. `"DEFAULT"`. Left as `String` for forward * compatibility. */ type: string; /** @description Portfolio UUID. */ uuid: string; }; /** * @description Coinbase-family RPC methods. Each variant authenticates as the * [`KeyType::Ed25519CoinbaseApi`] key in its `params.key_id`. */ CoinbaseRpc: OneOf< [ { /** @enum {string} */ method: "cs_coinbaseListAccounts"; params: components["schemas"]["CoinbaseListAccountsParams"]; }, { /** @enum {string} */ method: "cs_coinbaseListPortfolios"; params: components["schemas"]["CoinbaseListPortfoliosParams"]; }, { /** @enum {string} */ method: "cs_coinbaseMoveFunds"; params: components["schemas"]["CoinbaseMoveFundsParams"]; }, ] >; /** @description Response returned by the typed `coinbase_sign` endpoint. */ CoinbaseSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The signed JWT, ready to be sent in `Authorization: Bearer ` to * the Coinbase Advanced Trade API. */ jwt: string; }; /** @description Commission rates as decimal strings (e.g. `"0.00100000"`). */ CommissionRates: { buyer: string; maker: string; seller: string; taker: string; }; /** * @description Fields that are common to different types of resources such as keys, roles, etc. * Includes versioning fields plus metadata, edit policy, etc. */ CommonFields: { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & { edit_policy?: components["schemas"]["EditPolicy"]; /** * @description User-defined metadata. When rendering (e.g., in the browser) you should treat * it as untrusted user data (and avoid injecting metadata into HTML directly) if * untrusted users can create/update keys (or their metadata). */ metadata?: unknown; }; CompleteMfaResetRequest: { /** * @description The reset token emailed to the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ token: string; }; /** @description The number of users and keys in an org, organized by user role and key type */ ComputeCountsResponse: { /** * @description A map of a `KeyType` to the amount of keys with that type in the org. * @example { * "SecpBtc": 3, * "SecpEthAddr": 1 * } */ keys: { [key: string]: number; }; /** * @description A map of a `MemberRole` to the amount of number of users with that role in the org. * @example { * "Member": 10, * "Owner": 1 * } */ users: { [key: string]: number; }; }; /** @description Evaluation of a single if-then-else conditional. */ Conditional: { if: components["schemas"]["PolicyEvalTree"]; then?: components["schemas"]["PolicyEvalTree"] | null; }; ConfigureEmailRequest: { auth: { smtp: string; }; /** @description The email address that emails will be sent from */ sender: string; template?: { /** @description An HTML template to use for the body. */ body_template: string; /** @description The subject line template */ subject_template: string; } | null; }; ConfiguredMfa: | { /** @enum {string} */ type: "totp"; } | { /** @description UUID of the device type */ aaguid: string; /** * Format: int64 * @description Creation date */ created_at: number; /** @description Whether this key was requested to be discoverable. */ discoverable: boolean; /** @description A unique credential id */ id: string; /** * Format: int64 * @description Last used date */ last_used_at: number; /** @description A human-readable name given to the key */ name: string; /** @enum {string} */ type: "fido"; }; /** @enum {string} */ ConflictErrorCode: "ConcurrentRequestDisallowed" | "ConcurrentLockCreation"; /** @description A contact in the org. */ Contact: components["schemas"]["CommonFields"] & { /** * @description Labels to categorize this contact. * @example [ * "cubist:erc20_token" * ] */ labels?: components["schemas"]["ContactLabel"][]; /** * @description The name for the contact. Must be a unique name among contacts in the * org. The name must consist of alphanumeric characters, spaces, `.` and `-`, * and cannot be longer than 50 characters. * @example Satoshi Nakamoto */ name: string; owner: components["schemas"]["Id"]; }; /** @description An address associated with a contact. */ ContactAddressData: | (components["schemas"]["BitcoinAddressInfo"] & { /** @enum {string} */ network: "Bitcoin"; }) | (components["schemas"]["EvmAddressInfo"] & { /** @enum {string} */ network: "Evm"; }) | (components["schemas"]["SuiAddressInfo"] & { /** @enum {string} */ network: "Sui"; }) | (components["schemas"]["SolanaAddressInfo"] & { /** @enum {string} */ network: "Solana"; }) | (components["schemas"]["CantonPartyInfo"] & { /** @enum {string} */ network: "Canton"; }); /** @description Information about a Contact. */ ContactInfoResponse: components["schemas"]["Contact"] & { addresses: components["schemas"]["AddressMap"]; id: components["schemas"]["Id"]; }; /** * @description Labels that can be applied to a contact. * @enum {string} */ ContactLabel: "cubist:erc20_token" | "cubist:spl_token"; CreateAndUpdateKeyProperties: { /** * @description Set this key's access-control entries. * For an existing key, this overwrites the current acl, if any. */ acl?: unknown; edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description Set this key's metadata. If this value is `null`, the metadata is erased. If the field is * missing, the metadata remains unchanged. */ metadata?: unknown; /** * @description Specify a user other than themselves to be the (potentially new) owner of the key. * The specified owner must be an existing user who is a member of the same org. * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner?: string | null; /** * @description Set this key's policies. For an existing key, this overwrites all its policies. * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: unknown[] | null; }; /** @description The information needed to create a Contact. */ CreateContactRequest: { addresses?: components["schemas"]["AddressMap"]; edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description Optional labels to associate with the contact. * @example [ * "cubist:erc20_token" * ] */ labels?: components["schemas"]["ContactLabel"][]; /** @description Optional user-defined metadata about the contact. */ metadata?: unknown; /** * @description The name for the contact. Must be a unique name among contacts in the * org. Name must consist of alphanumeric characters, spaces, `.` and `-`, * and cannot be longer than 50 characters. * @example Satoshi Nakamoto */ name: string; }; /** @description Parameters for creating an EVM transaction. */ CreateEvmTransactionRequest: components["schemas"]["CreateEvmTransferRequest"] & { /** @enum {string} */ type: "Transfer"; }; /** @description Parameters for creating an EVM transfer. */ CreateEvmTransferRequest: { token: "CreateEvmTransferRequest"; } & Omit & components["schemas"]["EvmTxCustomization"] & { /** * Format: int64 * @description The EVM chain id this transaction is for. */ chain_id: number; /** * @description The address that the amount will be transferred from. * * Must match the material id of a key the session can access. */ from: string; /** @description The address that the amount will be transferred to. */ to: string; /** * @description The amount being transferred, as a hex value. * * This value should be in WEI for native transfers, and in the token's denomination * for ERC-20 transfers. */ value: string; }; CreateKeyImportKeyResponse: components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; CreateKeyRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * Format: int64 * @description Chain id for which the key is allowed to sign messages * @example 5 */ chain_id?: number | null; /** * Format: int32 * @description Number of keys to create * @example 1 */ count: number; key_type: components["schemas"]["KeyType"]; }; CreateKeyResponse: { /** @description The info about the created keys */ keys: components["schemas"]["KeyInfo"][]; }; CreateOrgRequest: { /** * @description The human readable name of the new organization * @example My Cool Org */ name: string; }; /** * @description The response to [create_import_key] containing the generated key and enclave * attestations. */ CreatePolicyImportKeyResponse: components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; /** @description Request for creating a named policy */ CreatePolicyRequest: { /** * @description Access-control entries defining how the policy can be accessed, modified, * attached and executed. * @example [ * { * "action": "attach", * "resources": [ * { * "key_id": "*", * "role_id": "Role#e427c28a-9c5b-49cc-a257-878aea58a22c" * } * ], * "subjects": "*" * }, * { * "action": "sign", * "subjects": "Role#e427c28a-9c5b-49cc-a257-878aea58a22c" * } * ] */ acl?: unknown[] | null; edit_policy?: components["schemas"]["EditPolicy"] | null; /** @description Optional metadata. */ metadata?: unknown; /** * @description The policy name. * Must be unique among the named policies in this org. Duplicate policy names * will be rejected. * @example my_policy */ name: string; policy_type: components["schemas"]["PolicyType"]; /** * @description The policy rules. * @example [ * { * "RequireMfa": { * "count": 1 * } * } * ] */ rules: unknown[]; }; /** @description Optional create role request body */ CreateRoleRequest: { /** * @description A human-readable name for the role. * @example my_role */ name: string; }; /** @description The newly created role information */ CreateRoleResponse: { /** * @description A human-readable name for the role. * @example my_role */ name?: string | null; /** * @description The id of the newly created role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }; CreateSessionRequest: components["schemas"]["RatchetConfig"] & components["schemas"]["ClientSessionMetadata"] & { /** * @description By default, the requested session and auth lifetimes are truncated to be at most requestor's * session and auth lifetime, respectively. To extend the requested lifetimes past the * requestor's, set this property to `true` (in which case MFA will be required). */ extend_lifetimes?: boolean; /** * @description A human readable description of the session's purpose * @example Manage keys on server foo.bar */ purpose: string; /** * @description Controls what capabilities this session will have. * @example [ * "manage:key:*" * ] */ scopes: components["schemas"]["Scope"][]; }; CreateTokenRequest: components["schemas"]["RatchetConfig"] & components["schemas"]["ClientSessionMetadata"] & { /** * @description A human readable description of the purpose of the key * @example Validator Signing */ purpose: string; /** * @description Controls what capabilities this session will have. By default, it has all * signing capabilities, i.e., just the 'sign:*' scope. * @example [ * "sign:*" * ] */ scopes?: components["schemas"]["Scope"][] | null; }; /** @description Parameters for the [`cs_transactionCreate`](RpcMethod::CreateTransaction) method. */ CreateTransactionRequest: { type: "CreateTransactionRequest"; } & Omit & { /** @enum {string} */ chain: "Evm"; }; /** * @description An extended form of `PublicKeyCredentialCreationOptions` that allows clients to derive the WebAuthn challenge * from a structured preimage. * * This ensures that the webuathn signature can only be used for a specific purpose */ CreationOptionsWithHash: components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }; /** @description Core RPC methods (transaction CRUD). */ CsRpc: | { /** @enum {string} */ method: "cs_transactionCreate"; params: components["schemas"]["CreateTransactionRequest"]; } | { /** @enum {string} */ method: "cs_transactionRetry"; params: components["schemas"]["RetryTransactionRequest"]; } | { /** @enum {string} */ method: "cs_transactionCancel"; params: components["schemas"]["CancelTransactionRequest"]; } | { /** @enum {string} */ method: "cs_transactionDelete"; params: components["schemas"]["DeleteTransactionRequest"]; } | { /** @enum {string} */ method: "cs_transactionGet"; params: components["schemas"]["GetTransactionRequest"]; } | { /** @enum {string} */ method: "cs_transactionList"; params: components["schemas"]["ListTransactionsRequest"]; } | { /** @enum {string} */ method: "cs_btcListUtxos"; params: components["schemas"]["BtcListUtxosRequest"]; }; CubeSignerUserInfo: { /** @description All multi-factor authentication methods configured for this user */ configured_mfa: components["schemas"]["ConfiguredMfa"][]; /** @description Set once the user successfully logs into CubeSigner */ initialized: boolean; /** @description Optional human name for the user */ name?: string | null; /** @description CubeSigner's user identifier */ user_id: string; }; /** @description Custom chain RPC request */ CustomChainRpcRequest: { /** @description HTTP body */ body?: string | null; chain: components["schemas"]["CustomChainSelector"]; /** @description HTTP relative path */ path: string; }; CustomChainRpcResponse: unknown; /** @description Custom chain selector */ CustomChainSelector: { /** @description EVM chain */ Evm: { /** @example 0x01 */ chain_id: string; }; }; /** @description Information about an org's custom chains. */ CustomChainsData: { /** @description Custom EVM chains. */ evm: components["schemas"]["EvmCustomChain"][]; }; /** @description Parameters for the [`cs_transactionDelete`](RpcMethod::DeleteTransaction) method. */ DeleteTransactionRequest: { /** * @description Whether to force the deletion. * * Transactions that are not "submitted" or "canceled" will not be deleted unless * this is true. * * **Note:** force deleting a pending transaction may prevent follow-up transactions * from succeeding, and require manual intervention (e.g. specifying the key nonce). * We strongly advise canceling the transaction first. */ force?: boolean | null; /** @description The transaction id. */ id: string; }; /** @description One deposit entry in [`DepositHistoryResponse`]. */ DepositHistoryEntry: { /** @description Destination address the deposit was sent to. */ address: string; /** * @description Secondary address identifier (e.g. memo for XRP, tag for XLM). Empty * string when the asset does not use one. */ addressTag?: string | null; /** @description Deposit amount, as a decimal string. */ amount: string; /** @description Asset symbol (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** * Format: int64 * @description Represents deposit completion datetime, available for deposits after 6-Mar-2025. */ completeTime?: number | null; /** @description On-chain confirmation progress (e.g. `"1/1"`). */ confirmTimes?: string | null; /** @description Binance-assigned deposit id. */ id?: string | null; /** * Format: int64 * @description Time the deposit record was created (ms since epoch). */ insertTime: number; /** @description Blockchain network identifier (e.g. `"BSC"`, `"ETH"`). */ network: string; /** @description Returned when 'includeSource' in the request is set to true */ sourceAddress?: string | null; /** * Format: int32 * @description Deposit status. Binance values: `0` = pending, `6` = credited but * cannot withdraw, `7` = wrong deposit, `8` = waiting user confirm, * `1` = success. Left as `u8` for forward compatibility. */ status: number; /** * Format: int32 * @description `0` = external transfer, `1` = internal (Binance↔Binance) transfer. */ transferType: number; /** * Format: int32 * @description 0: travel rule not required OR info already provided and funds ready to use; * 1: travel rule required to provide deposit info */ travelRuleStatus: number; /** @description On-chain transaction hash of the deposit. */ txId: string; /** * Format: int32 * @description Confirmations after which the deposit is unlocked for trading. */ unlockConfirm?: number | null; /** * Format: int32 * @description Destination wallet: `0` = spot wallet, `1` = funding wallet. */ walletType: number; }; /** * @description Parameters for `GET /sapi/v1/capital/deposit/hisrec`. * * Returns the calling account's deposit history. All filters are optional; * if `start_time`/`end_time` are omitted, Binance returns the most recent 90 * days. Use `tx_id` to look up a specific deposit by its on-chain * transaction hash, or `coin`/`status` to narrow the result set. */ DepositHistoryRequest: { /** @description Filter to a specific asset (e.g. `"USDT"`, `"BTC"`). */ coin?: string | null; /** * Format: int64 * @description Window end (ms since epoch, Binance default: present timestamp). */ endTime?: number | null; /** * @description If `true`, include the deposit's source address in each entry. Binance * defaults to `false`. */ includeSource?: boolean | null; /** * Format: int32 * @description Page size (Binance default and max: 1000). */ limit?: number | null; /** * Format: int32 * @description Pagination offset (Binance default: 0). */ offset?: number | null; /** * Format: int64 * @description Window start (ms since epoch, Binance default: 90 days from current timestamp). */ startTime?: number | null; /** * Format: int32 * @description Filter by deposit status. Binance values: `0` = pending, `6` = credited * but cannot withdraw, `7` = wrong deposit, `8` = waiting user confirm, * `1` = success, `2` = rejected. Left as `u8` for forward compatibility. */ status?: number | null; /** @description Look up a specific deposit by its on-chain transaction hash. */ txId?: string | null; }; /** * @description Response returned by `cs_binanceDepositHistory`. * * Binance returns a top-level JSON array; this newtype preserves that wire * format while giving the response a named type in the OpenAPI schema. */ DepositHistoryResponse: components["schemas"]["DepositHistoryEntry"][]; /** * @description Parameters for `GET /sapi/v1/capital/deposit/address`. * * Fetches the deposit address for `coin` on the account that the signing key * authenticates as. Optionally narrows the address to a specific `network`. */ DepositRequest: { /** * @description Required only when `network` is `"LIGHTNING"`: the deposit amount that * the returned invoice should encode, as a decimal string. */ amount?: string | null; /** @description The asset symbol whose deposit address to fetch (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** * @description Network identifier (e.g. `"BSC"`, `"ETH"`). If omitted, Binance returns * the address on the asset's default network. */ network?: string | null; }; /** @description Response returned by `cs_binanceDeposit`. */ DepositResponse: { /** @description Deposit address. */ address: string; /** @description Asset symbol (echoes the request's `coin` field). */ coin: string; /** * @description Secondary address identifier required by some assets (e.g. memo for * XRP, tag for XLM). Empty string when the asset does not use one. */ tag: string; /** @description Blockchain explorer URL for `address`. */ url: string; }; /** * @description Information produced by a successful deposit * @example { * "chain_id": 5, * "deposit_txn": { * "data": "0x...", * "to": "0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b", * "value": "0x1bc16d674ec800000" * }, * "new_validator_pk": "9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da" * } */ DepositTxn: { /** * Format: int64 * @description Chain ID for which the deposit transaction was created */ chain_id: number; /** @description The deposit transaction. Includes only `to`, `value`, and `data` fields. */ deposit_txn: Record; /** @description The hex-encoded compressed form of the new validator BLS public key */ new_validator_pk: string; }; /** * @description The type of deposit to perform * @enum {string} */ DepositType: "Canonical" | "Wrapper"; /** @description Request to derive keys for one type from a specified mnemonic. */ DeriveKeyRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * @description List of derivation paths for which to derive. * @example [ * "m/44'/60'/0'/0/0", * "m/44'/9000'/0'/0/0" * ] */ derivation_path: string[]; /** * @description When false (the default), nothing is returned when a derived key already * exists. When true, returns the KeyInfo struct for keys that already exist * if caller is allowed to list that key. */ idempotent?: boolean; key_type: components["schemas"]["KeyType"]; /** * @description Material-id of the mnemonic to use for derivation. * @example 0x9f07be82d934fcb5d0f75dd24c2dfea8a85a4d0c289d58828b3537fae24d32b8 */ mnemonic_id: string; }; /** @description Request to derive keys for multiple types from a specified mnemonic. */ DeriveKeysRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * @description When false (the default), nothing is returned when a derived key already * exists. When true, returns the KeyInfo struct for keys that already exist * if caller is allowed to list that key. */ idempotent?: boolean; /** * @description Key types and corresponding paths for derivation, plus optional * policies to include for specific keys. It is an error to specify * a policy that does not apply to the corresponding key type. * @example [ * { * "derivation_path": "m/44'/60'/0'/0/0", * "key_type": "SecpEthAddr" * }, * { * "derivation_path": "m/11'/22'/33", * "key_type": "TaprootBtc", * "policy": [ * "AllowRawBlobSigning" * ] * } * ] */ key_types_and_derivation_paths: components["schemas"]["KeyTypeAndDerivationPath"][]; /** * @description Material-id of the mnemonic to use for derivation. If unspecified, * a new mnemonic is first created. * @example 0x9f07be82d934fcb5d0f75dd24c2dfea8a85a4d0c289d58828b3537fae24d32b8 */ mnemonic_id?: string | null; }; DiffieHellmanRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The set of serialized elliptic curve points from which to compute shared secrets. * The serialization format of these points depends on the key type; see the CubeSigner * documentation for more information. */ points: string[]; /** * @description An optional NIST P-256 public key (base64-encoded SEC1 with or without compression). * * If provided, the response will be encrypted to this public key using RFC9180 * HPKE-DHKEM(P-256, HKDF-SHA256) with AES-256-GCM as the symmetric cipher. * * If no public key is specified, the results will be returned unencrypted. In this * case, the input points should be masked with a random scalar to avoid leaking the * shared secret in the response; the results can be unmasked via point multiplication * with the inverse of the masking scalar. * @example AkpLT/3dXApJzXSduaPQ7apyT0ADBwqkt1es/aT0iWWf */ public_key?: string | null; }; /** @description The result of a Diffie Hellman key exchange */ DiffieHellmanResponse: ( | { /** @description The resulting points as base64-encoded byte strings in a key-type--dependent format. */ points: string[]; /** @enum {string} */ response_type: "masked"; } | { /** * @description A ciphertext containing the resulting points. The enclosed plaintext is a sequence * of base64-encoded byte strings in a key-type--dependent format. */ encrypted_shared_secrets: string; /** * @description The ephemeral public key used for HPKE key derivation in base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @enum {string} */ response_type: "encrypted"; } ) & { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & Record; /** * @description A policy which governs when and who is allowed to update the entity this policy is * attached to (e.g., a role or a key). * * When attached to a role, by default, this policy applies to role deletion and all * role updates (including adding/removing keys and users); in terms of scopes, * it applies to `manage:role:update:*` and `manage:role:delete`. * * When attached to a key, by default, this policy applies to key deletion, all * key updates, and adding/removing that key to/from a role; in terms of scopes, * it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`. * * This default can be changed by setting the `applies_to_scopes` property. */ EditPolicy: { applies_to_scopes?: components["schemas"]["ScopeSet"]; mfa?: components["schemas"]["MfaPolicy"] | null; time_lock_until?: components["schemas"]["EpochDateTime"] | null; }; Eip191SignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description EIP-191 data to sign as hex-encoded bytes. * @example 0xdeadbeef13c0ffee */ data: string; /** * @description An optional tweak value that will be applied to the secret key before signing. * This field must contain a base-64 string encoding a vector of exactly 32 bytes. * See the CubeSigner documentation for more information on the tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ tweak?: string | null; }; /** * @example { * "chain_id": 1337, * "typed_data": { * "domain": { * "chainId": 1337, * "name": "Ether Mail", * "salt": "0x0000000000000000000000000000000000000000000000000000000000000000", * "verifyingContract": "0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC", * "version": "1" * }, * "message": { * "contents": "Hello, Bob!", * "from": { * "name": "Cow", * "wallets": [ * "0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826", * "0xDeaDbeefdEAdbeefdEadbEEFdeadbeEFdEaDbeeF" * ] * }, * "to": { * "name": "Bob", * "wallets": [ * "0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB", * "0xB0BdaBea57B0BDABeA57b0bdABEA57b0BDabEa57", * "0xB0B0b0b0b0b0B000000000000000000000000000" * ] * } * }, * "primaryType": "Mail", * "types": { * "EIP712Domain": [ * { * "name": "name", * "type": "string" * }, * { * "name": "version", * "type": "string" * }, * { * "name": "chainId", * "type": "uint256" * }, * { * "name": "verifyingContract", * "type": "address" * }, * { * "name": "salt", * "type": "bytes32" * } * ], * "Group": [ * { * "name": "name", * "type": "string" * }, * { * "name": "members", * "type": "Person[]" * } * ], * "Mail": [ * { * "name": "from", * "type": "Person" * }, * { * "name": "to", * "type": "Person" * }, * { * "name": "contents", * "type": "string" * } * ], * "Person": [ * { * "name": "name", * "type": "string" * }, * { * "name": "wallets", * "type": "address[]" * } * ] * } * } * } */ Eip712SignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * Format: int64 * @description The chain-id to which this typed data will be sent */ chain_id: number; /** * @description An optional tweak value that will be applied to the secret key before signing. * This field must contain a base-64 string encoding a vector of exactly 32 bytes. * See the CubeSigner documentation for more information on the tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ tweak?: string | null; typed_data: components["schemas"]["TypedData"]; }; Eip7702SignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The address to delegate to (the target of the authorization), as * hex-encoded bytes. Must be exactly 20 bytes. * @example 0x1100000000000000000000000000000000000011 */ address: string; /** * Format: int64 * @description The chain id for which this authorization is valid. A value of `0` means * the authorization is valid on any chain that supports EIP-7702. */ chain_id: number; /** * Format: int64 * @description The nonce of the authorizing account. */ nonce: number; /** * @description An optional tweak value that will be applied to the secret key before signing. * This field must contain a base-64 string encoding a vector of exactly 32 bytes. * See the CubeSigner documentation for more information on the tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ tweak?: string | null; }; Email: string; /** @description An answer to the challenge returned by the `mfa_email_init` endpoint. */ EmailOtpAnswer: { /** * @description Full JWT token, constructed by concatenating the "partial token" * (i.e., `{header}.{payload}.`) returned by the `mail_email_init` endpoint * and the signature sent to the user's email. */ token: string; }; /** @description The request users send to initiate email OTP */ EmailOtpRequest: { /** @description The email which will receive the OTP */ email: string; }; /** * @description The HTTP response to an email OTP request. * * This response contains an OIDC token without a signature. * The signature is sent to the end-user in an email. * The token can be reconstructed by concatenating the `partial_token` with the signature. */ EmailOtpResponse: { /** * @description The OIDC token without the signature. * (The signature, which is actually a MAC, is sent to the end-user in an email) */ partial_token: string; }; /** @description Describes email preferences at an Org level - what emails to send and options associated */ EmailPreferences: components["schemas"]["OrgAlertsPrefs"] & { /** @description If true, send notifications on every login */ login_notifications?: boolean | null; /** * @description If true, send notifications when logging in from a new device. * new_device takes precedence over login_notifications. E.g., email for * new_device is sent instead of a general login notification email when a * new device is detected */ new_device?: boolean | null; /** @description If true, send email notifications for mfa approvals */ pending_approvals?: boolean | null; }; /** @description Request to reset verified email. */ EmailResetRequest: { /** * @description Whether this email should be usable for email OTP login. The request * will fail if this field is set to `true`, and the org does not have * email OTP enabled. Default: `false` */ allow_otp_login?: boolean | null; /** @description The email to register */ email: string; }; /** @default null */ Empty: unknown; EmptyImpl: { status: components["schemas"]["StatusOk"]; }; /** * @description Request to create a set of EOTS nonces for a specified chain-id, starting * at a specified block height. */ EotsCreateNonceRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The chain id for which the nonces will be used, as a hex string * @example 0x11223344 */ chain_id: string; /** * Format: int32 * @description The number of nonces to generate * @example 16 */ num: number; /** * @description The starting block height of the generated nonces (quoted decimal u64) * @example 31337 */ start_height: string; }; /** @description Response generated when creating EOTS nonces */ EotsCreateNonceResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The generated nonces as an array of 0x-prefixed hex strings * @example [ * "0xb393bf39e71a16d784853d58255a296222a99fd3c87aa7ca206c5230c188f1c7", * "0xe01936584b4f0c0e97f0d3018c4f9db2bf7de41395c6403a48fd0dff0ef7b40d" * ] */ nonces: string[]; }; /** @description Request for an EOTS signature on a specified message, chain-id, block-height triple */ EotsSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description The block height for the signature (quoted decimal u64) * @example 123456 */ block_height: string; /** * @description The chain id for the signature * @example 0x11223344 */ chain_id: string; /** * @description The message to sign * @example 0x5a2688faea09d42b9270fdb8de6fff6f192243a910ba66329073e12e0d0046a2 */ message: string; }; /** * @description Epoch is a quoted `uint64`. * @example 256 */ Epoch: string; /** * Format: int64 * @description DateTime measured in seconds since unix epoch. * A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`] * representing the number of seconds since [`SystemTime::UNIX_EPOCH`]. */ EpochDateTime: number; ErrorObj: { /** * Format: int32 * @description Code */ code: number; /** @description Optional data */ data?: unknown; /** @description Message */ message: string; }; /** @description The structure of ErrorResponse must match the response template that AWS uses */ ErrorResponse: { accepted?: components["schemas"]["AcceptedValue"] | null; error_code: components["schemas"]["SignerErrorCode"]; /** @description Error message */ message: string; /** @description Optional policy evaluation tree (included in signer responses, when requested) */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; /** @description Optional request identifier */ request_id?: string; }; /** @description Esplora request */ EsploraRequest: { /** @description HTTP body */ body?: string | null; /** @description HTTP method */ method: string; /** @enum {string} */ network: "mainnet" | "testnet" | "signet"; /** @description HTTP relative path (which comes after '/{network}/api/') */ path: string; }; EsploraResponse: unknown; /** * @description EVM transaction signing request. * @example { * "chain_id": 43113, * "tx": { * "chain_id": "0xa869", * "gas": "0x61a80", * "maxFeePerGas": "0x9502F900", * "maxPriorityFeePerGas": "0x50", * "nonce": "0xb", * "to": "0xf00ba12f00000000b4121200000f00c0ffeef00d", * "type": "0x2", * "value": "0x10000000000" * } * } */ Eth1SignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * Format: int64 * @description The chain id to set in the given transaction. */ chain_id: number; /** * @description An optional tweak value that will be applied to the secret key before signing. * This field must contain a base-64 string encoding a vector of exactly 32 bytes. * See the CubeSigner documentation for more information on the tweaking procedure. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ tweak?: string | null; tx: components["schemas"]["Transaction"]; }; Eth1SignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description Hex-encoded RLP encoding of the transaction and its signature * @example 0x22895118000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000001201d58656b0e22aaa68fdc692db41979098c3886ed33015d7467de9211609cdac000000000000000000000000000000000000000000000000000000000000000308b0c2900324d3ff9adfba7fdfe5af3f9b2cdbeef7b280437bbf1b1c59a093d615afe3e5dfed9622b540cdd9b49b3c5ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002001000000000000000000000049011adbcc3bc9c0307bb07f37dda1a1a9c69d2e0000000000000000000000000000000000000000000000000000000000000060903db8525674b8e7904f9b7d7d9ec55a0a42d33cf58be25469b0c21bbb6d06172bc5bb5fd1aed8e4f35936968958116b0619553c2cb1c52e7323074c6f8eb3d5a7074fc6580148df907837fa3b164ad7fbc2288dad1e8a5b021095b57c8a36d4 */ rlp_signed_tx: string; }; /** * @example { * "eth2_sign_request": { * "aggregation_slot": { * "slot": "36" * }, * "fork_info": { * "fork": { * "current_version": "0x42424242", * "epoch": "0", * "previous_version": "0x42424242" * }, * "genesis_validators_root": "0x9d13d61212c067e02ce8e608a7007e2c3b02571e9e6f27ff45dfa91bf27c870b" * }, * "signingRoot": "0x9c57e77c4965727542b9337df6756f948464bca3859bea6ed3c0ec6600d8982a", * "type": "AGGREGATION_SLOT" * }, * "network": "mainnet" * } */ Eth2SignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description Subset of the Web3Signer Eth2 BLS signing request whose schema is defined * [here](https://consensys.github.io/web3signer/web3signer-eth2.html#tag/Signing/operation/ETH2_SIGN). * We handle deposits and voluntary exits separately. */ eth2_sign_request: Record; network: components["schemas"]["Network"]; }; /** * @description Auto-generated discriminant enum variants * @enum {string} */ EvalOutcome: "Permitted" | "Inapplicable" | "Denied" | "MfaRequired"; /** * @description Representation of an event. This type is used to serialize events to CloudWatch Logs and to * deserialize them when analyzing the logs. */ Event: { event: "Event"; } & Omit & { /** @description Unique identifier of an event. */ event_id?: string; org: components["schemas"]["Id"]; /** @description The origin header of the request that triggered this event */ origin?: string; /** @description The ID of the request that triggered this event */ request_id?: string; /** * Format: int64 * @description The timestamp of the event (in milliseconds since the Unix Epoch) */ utc_timestamp: number; }; /** * @description Data associated with an event. Depending on the event type (i.e., billing or org event), * different fields are used. */ EventData: | (components["schemas"]["BillingArgs"] & { /** @enum {string} */ event: "cubist::billing"; }) | (components["schemas"]["OrgEventArgs"] & { /** @enum {string} */ event: "cubist::org_event"; }); /** @description An EVM address and its chain. */ EvmAddressInfo: { /** * @description The EVM address. * @example 0x52f6c0b306e66893c0414abb70951c4dac15a969 */ address: string; /** * @description The EVM chain this address belongs to **as a hex string**. The string * must start with "0x" and have an even length. If the chain is omitted, * the address is allowed to be used on any EVM chain, and is referred to * as a global EVM address. * @example 0x01 */ chain?: string | null; }; /** @description Information about a currency used on an EVM chain. */ EvmCurrencyInfo: { /** * Format: int32 * @description The number of decimals this currency uses. * @example 18 */ decimals: number; /** * @description The full name of the currency. * @example Ether */ name: string; /** * @description The symbol for the currency, typically a three letter string. * @example ETH */ symbol: string; }; /** @description A custom EVM chain. */ EvmCustomChain: { /** * @description The chain id. Enforced to be unique among all custom EVM chains in the organization. It must be a hex string (starting with "0x") with even length. * @example 0x01 */ chain_id: string; /** * @description The name of the chain. * @example Ethereum Mainnet */ name: string; native_currency: components["schemas"]["EvmCurrencyInfo"]; /** * @description The URL of the RPC provider for this chain. * @example https://ethereum-rpc.publicnode.com */ rpc_url: string; }; /** @description An EVM token. */ EvmToken: | { /** @enum {string} */ token: "Native"; } | { /** @enum {string} */ token: "Erc20"; /** @description The ERC-20 token address. */ token_address: string; }; /** @description EVM-specific transaction details. */ EvmTransactionDetails: { /** * Format: int64 * @description The EVM chain id for the chain the transaction is submitted to. */ chain_id: number; /** * @description The transaction hash, as submitted to the chain. * * Can be undefined if the transaction hasn't been signed or submitted yet. */ hash?: string; /** * @description The signature for the transaction. * * Can be undefined if the transaction hasn't been signed yet, or failed to be signed. */ signature?: string | null; /** @description The transaction itself. */ tx: unknown; }; EvmTxCmp: { /** * Format: int64 * @description To prevent replay attacks, any given MFA receipt is normally allowed to be used only once. * * In this case, however, because EVM transactions already have a replay prevention mechanism * (namely the 'nonce' property), we allow the user to specify a grace period (in seconds) to * indicate how long an MFA receipt should remain valid after its first use. * * Note that we allow both 'grace' and 'ignore_nonce' to be set because once an MFA request * enters its grace period we unconditionally set its 'ignore_nonce' property to 'false' to * ensure that any subsequent requests that claim the same receipt must sign for the same * nonce as the request we signed originally with that receipt. * * Also note that the grace period cannot extend the lifetime of an MFA request beyond its * original expiration date. * * The grace period must not be greater than 30 days. */ grace?: number | null; /** @description Whether the 'gas' property of the EVM transaction is allowed to be different. */ ignore_gas?: boolean; /** @description Whether the 'nonce' property of the EVM transaction is allowed to be different. */ ignore_nonce?: boolean; }; /** @description Optional fields used to customize EVM transactions. */ EvmTxCustomization: { /** * @description Optional gas limit. * * If not specified, estimated gas is used. */ gas_limit?: string | null; /** * @description Optional max fee for the transaction. * * If not specified, estimated fees are used. */ max_fee_per_gas?: string | null; /** * @description Optional max priority fee for the transaction. * * If not specified, estimated fees are used. */ max_priority_fee_per_gas?: string | null; /** * @description Optional nonce. * * If not specified, the next available nonce is used. */ nonce?: string | null; }; /** @enum {string} */ EvmTxDepositErrorCode: | "EvmTxDepositReceiverMismatch" | "EvmTxDepositEmptyData" | "EvmTxDepositEmptyChainId" | "EvmTxDepositEmptyReceiver" | "EvmTxDepositUnexpectedValue" | "EvmTxDepositUnexpectedDataLength" | "EvmTxDepositNoAbi" | "EvmTxDepositNoDepositFunction" | "EvmTxDepositUnexpectedFunctionName" | "EvmTxDepositUnexpectedValidatorKey" | "EvmTxDepositInvalidValidatorKey" | "EvmTxDepositMissingDepositArg" | "EvmTxDepositWrongDepositArgType" | "EvmTxDepositValidatorKeyNotInRole" | "EvmTxDepositUnexpectedWithdrawalCredentials" | "EvmTxDepositUnresolvedRole" | "EvmTxDepositInvalidDepositEncoding"; /** * @description The source of a policy execution, i.e. the reason it was executed. * @enum {string} */ ExecutionSource: "SignRequest" | "UserInvocation"; /** * ExplicitScope * @description Explicitly named scopes for accessing CubeSigner APIs * @enum {string} */ ExplicitScope: | "sign:*" | "sign:ava" | "sign:binance:*" | "sign:binance:subToMaster" | "sign:binance:subToSub" | "sign:binance:universalTransfer" | "sign:binance:subAccountAssets" | "sign:binance:accountInfo" | "sign:binance:subAccountTransferHistory" | "sign:binance:universalTransferHistory" | "sign:binance:withdraw" | "sign:binance:withdrawHistory" | "sign:binance:deposit" | "sign:binance:depositHistory" | "sign:binance:listSubAccounts" | "sign:binance:coinInfo" | "sign:binance:subAccountDepositAddress" | "sign:binance:subAccountDepositHistory" | "sign:bybit:*" | "sign:bybit:queryUser" | "sign:bybit:querySubMembers" | "sign:bybit:queryCoinsBalance" | "sign:bybit:queryDepositAddress" | "sign:bybit:universalTransfer" | "sign:bybit:withdraw" | "sign:bybit:withdrawals" | "sign:bybit:queryCoinInfo" | "sign:bybit:depositHistory" | "sign:bybit:subDepositHistory" | "sign:bybit:universalTransferHistory" | "sign:bybit:queryWithdrawAddress" | "sign:bybit:querySubDepositAddress" | "sign:coinbase:*" | "sign:coinbase:accounts:list" | "sign:coinbase:portfolios:list" | "sign:coinbase:funds:move" | "sign:blob" | "sign:diffieHellman" | "sign:btc:*" | "sign:btc:segwit" | "sign:btc:taproot" | "sign:btc:psbt:*" | "sign:btc:psbt:doge" | "sign:btc:psbt:legacy" | "sign:btc:psbt:segwit" | "sign:btc:psbt:taproot" | "sign:btc:psbt:ltcSegwit" | "sign:btc:message:*" | "sign:btc:message:segwit" | "sign:btc:message:legacy" | "sign:babylon:*" | "sign:babylon:eots:*" | "sign:babylon:eots:nonces" | "sign:babylon:eots:sign" | "sign:babylon:staking:*" | "sign:babylon:staking:deposit" | "sign:babylon:staking:unbond" | "sign:babylon:staking:withdraw" | "sign:babylon:staking:slash" | "sign:babylon:registration" | "sign:babylon:covenant" | "sign:evm:*" | "sign:evm:tx" | "sign:evm:eip191" | "sign:evm:eip712" | "sign:evm:eip7702" | "sign:eth2:*" | "sign:eth2:validate" | "sign:eth2:stake" | "sign:eth2:unstake" | "sign:solana" | "sign:sui" | "sign:tendermint" | "sign:mmi" | "sign:auto" | "manage:*" | "manage:readonly" | "manage:email:*" | "manage:email:get" | "manage:email:update" | "manage:email:delete" | "manage:mfa:*" | "manage:mfa:readonly" | "manage:mfa:list" | "manage:mfa:vote:*" | "manage:mfa:vote:cs" | "manage:mfa:vote:email" | "manage:mfa:vote:fido" | "manage:mfa:vote:totp" | "manage:mfa:register:*" | "manage:mfa:register:fido" | "manage:mfa:register:totp" | "manage:mfa:register:email" | "manage:mfa:unregister:*" | "manage:mfa:unregister:fido" | "manage:mfa:unregister:totp" | "manage:mfa:verify:*" | "manage:mfa:verify:totp" | "manage:key:*" | "manage:key:readonly" | "manage:key:get" | "manage:key:attest" | "manage:key:listRoles" | "manage:key:list" | "manage:key:history:tx:list" | "manage:key:create" | "manage:key:import" | "manage:key:update:*" | "manage:key:update:owner" | "manage:key:update:policy" | "manage:key:update:acl" | "manage:key:update:enabled" | "manage:key:update:region" | "manage:key:update:metadata" | "manage:key:update:properties" | "manage:key:update:editPolicy" | "manage:key:delete" | "manage:policy:*" | "manage:policy:readonly" | "manage:policy:create" | "manage:policy:get" | "manage:policy:list" | "manage:policy:delete" | "manage:policy:update:*" | "manage:policy:update:owner" | "manage:policy:update:name" | "manage:policy:update:acl" | "manage:policy:update:editPolicy" | "manage:policy:update:metadata" | "manage:policy:update:rule" | "manage:policy:invoke" | "manage:policy:wasm:*" | "manage:policy:wasm:upload" | "manage:policy:secrets:*" | "manage:policy:secrets:get" | "manage:policy:secrets:update:*" | "manage:policy:secrets:update:values" | "manage:policy:secrets:update:acl" | "manage:policy:secrets:update:editPolicy" | "manage:policy:buckets:*" | "manage:policy:buckets:get" | "manage:policy:buckets:list" | "manage:policy:buckets:update:*" | "manage:policy:buckets:update:owner" | "manage:policy:buckets:update:acl" | "manage:policy:buckets:update:metadata" | "manage:contact:*" | "manage:contact:readonly" | "manage:contact:create" | "manage:contact:get" | "manage:contact:list" | "manage:contact:delete" | "manage:contact:update:*" | "manage:contact:update:name" | "manage:contact:update:addresses" | "manage:contact:update:owner" | "manage:contact:update:labels" | "manage:contact:update:metadata" | "manage:contact:update:editPolicy" | "manage:contact:lookup:*" | "manage:contact:lookup:address" | "manage:policy:createImportKey" | "manage:role:*" | "manage:role:readonly" | "manage:role:create" | "manage:role:delete" | "manage:role:get:*" | "manage:role:attest" | "manage:role:get:keys" | "manage:role:get:keys:list" | "manage:role:get:keys:get" | "manage:role:get:users" | "manage:role:list" | "manage:role:update:*" | "manage:role:update:enabled" | "manage:role:update:policy" | "manage:role:update:editPolicy" | "manage:role:update:actions" | "manage:role:update:key:*" | "manage:role:update:key:add" | "manage:role:update:key:remove" | "manage:role:update:user:*" | "manage:role:update:user:add" | "manage:role:update:user:remove" | "manage:role:history:tx:list" | "manage:identity:*" | "manage:identity:readonly" | "manage:identity:verify" | "manage:identity:add" | "manage:identity:remove" | "manage:identity:list" | "manage:org:*" | "manage:org:create" | "manage:org:metrics:query" | "manage:org:audit:query" | "manage:org:readonly" | "manage:org:addUser" | "manage:org:inviteUser" | "manage:org:inviteAlien" | "manage:org:invitation:list" | "manage:org:invitation:cancel" | "manage:org:updateMembership:*" | "manage:org:updateMembership:owner" | "manage:org:updateMembership:member" | "manage:org:updateMembership:alien" | "manage:org:listUsers" | "manage:org:user:get" | "manage:org:deleteUser:*" | "manage:org:deleteUser:owner" | "manage:org:deleteUser:member" | "manage:org:deleteUser:alien" | "manage:org:get" | "manage:org:update:*" | "manage:org:update:enabled" | "manage:org:update:policy" | "manage:org:update:signPolicy" | "manage:org:update:export" | "manage:org:update:totpFailureLimit" | "manage:org:update:notificationEndpoints" | "manage:org:update:defaultInviteKind" | "manage:org:update:idpConfiguration" | "manage:org:update:passkeyConfiguration" | "manage:org:update:emailPreferences" | "manage:org:update:historicalData" | "manage:org:update:requireScopeCeiling" | "manage:org:update:alienLoginRequirement" | "manage:org:update:memberLoginRequirement" | "manage:org:update:keyExportRequirement" | "manage:org:update:allowedMfaTypes" | "manage:org:update:policyEngineConf" | "manage:org:update:customChains" | "manage:org:update:extProps" | "manage:org:update:editPolicy" | "manage:org:user:resetMfa" | "manage:session:*" | "manage:session:readonly" | "manage:session:get" | "manage:session:list" | "manage:session:create" | "manage:session:extend" | "manage:session:revoke" | "manage:export:*" | "manage:export:readonly" | "manage:export:org:*" | "manage:export:org:get" | "manage:export:user:*" | "manage:export:user:delete" | "manage:export:user:list" | "manage:authMigration:*" | "manage:authMigration:identity:add" | "manage:authMigration:identity:remove" | "manage:authMigration:user:update" | "manage:mmi:*" | "manage:mmi:readonly" | "manage:mmi:get" | "manage:mmi:list" | "manage:mmi:reject" | "manage:mmi:delete" | "export:*" | "export:user:*" | "export:user:init" | "export:user:complete" | "mmi:*" | "orgAccess:*" | "orgAccess:child:*" | "rpc:*" | "rpc:transaction:*" | "rpc:transaction:create:*" | "rpc:transaction:create:evm" | "rpc:transaction:retry" | "rpc:transaction:cancel" | "rpc:transaction:delete" | "rpc:transaction:get" | "rpc:transaction:list" | "rpc:btcListUtxos" | "rpc:binance" | "rpc:bybit" | "rpc:coinbase"; /** * @description This type specifies the interpretation of the `fee` field in Babylon * staking requests. If `sats`, the field is intpreted as a fixed value * in sats. If `sats_pr_vb`, the field is interpreted as a rate and the * fee is computed by estimating the weight of the output transaction. * @enum {string} */ FeeType: "sats" | "sats_per_kwu" | "sats_per_vb"; /** @description Sent from the client to the server to answer a fido challenge */ FidoAssertAnswer: { /** @description The ID of the challenge that was returned from the POST endpoint */ challenge_id: string; credential: components["schemas"]["PublicKeyCredential"]; }; FidoAssertChallenge: (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; /** @description Sent from the client to the server to answer a fido challenge */ FidoCreateChallengeAnswer: { /** @description The ID of the challenge that was returned from the POST endpoint */ challenge_id: string; credential: components["schemas"]["PublicKeyCredential"]; }; /** * @description Sent by the server to the client. Contains the challenge data that must be * used to generate a new credential */ FidoCreateChallengeResponse: (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; /** @description Declares intent to register a new FIDO key */ FidoCreateRequest: { /** * @description If set, the attestation answering this registration challenge additionally counts as an * approving vote on pending MFA request `mfa_id`. * * This exists so that a user who must register their first second factor in order to complete * an operation (most commonly logging in) does not have to perform two authenticator * ceremonies back to back: one to enroll the credential and another to immediately prove * possession of it. The attestation is a full WebAuthn ceremony over a server-issued * challenge, so it is no weaker than the separate assertion it replaces. * * Requires the 'manage:mfa:vote:fido' scope in addition to 'manage:mfa:register:fido'. */ approve_mfa?: string | null; /** @description Whether this key can be used for passwordless login */ discoverable?: boolean; /** * @description A human-readable name for the new fido credential * @example Work Yubikey */ name: string; /** * @description Whether to request the unique authenticator device manufacturer identifier. * This information can be used to render the manufacturer name (e.g., "YubiKey", * or "Google Password Manager", or "1Password", etc.). When requested, some user * agents (e.g., Firefox) will ask the user to agree or disagree, whereas some * (e.g., Chrome) will silently agree. */ request_device_identifier?: boolean; }; /** @description Result of registering a FIDO key */ FidoRegisterResponse: { mfa?: components["schemas"]["MfaRequestInfo"]; status: components["schemas"]["StatusOk"]; }; /** @enum {string} */ ForbiddenErrorCode: | "AlienKeyCreate" | "CannotAssumeIdentity" | "SentryDisallowed" | "PasskeyLoginDisabled" | "PasskeyNotRegistered" | "CannotCreateOrg" | "WrongMfaEmailOtpJwt" | "OrgFlagNotSet" | "FidoRequiredToRemoveTotp" | "OidcIdentityLimitReached" | "OidcScopeCeilingMissing" | "OidcIssuerNotAllowedForMemberRole" | "OidcNoMemberRolesAllowed" | "EmailOtpNotConfigured" | "MfaChallengeExpired" | "ChainIdNotAllowed" | "InvalidOrg" | "OrgIdMismatch" | "SessionForWrongOrg" | "SelfDelete" | "SelfDisable" | "SelfMfaReset" | "InvalidOrgMembershipRoleChange" | "UserDisabled" | "OrgDisabled" | "OrgNotFound" | "OrgWithoutOwner" | "OrphanedUser" | "OidcUserNotFound" | "UserNotInOrg" | "UserNotOrgOwner" | "UserNotKeyOwner" | "InvalidRole" | "DisabledRole" | "KeyDisabled" | "KeyNotInRole" | "ContactNotInOrg" | "UserExportRequestNotInOrg" | "UserExportRequestInvalid" | "UserExportDisabled" | "UserNotOriginalKeyOwner" | "UserNotInRole" | "MustBeFullMember" | "SessionExpired" | "SessionChanged" | "SessionRevoked" | "ExpectedUserSession" | "SessionRoleChanged" | "ScopedNameNotFound" | "SessionInvalidEpochToken" | "SessionInvalidRefreshToken" | "SessionRefreshTokenExpired" | "InvalidAuthHeader" | "SessionNotFound" | "InvalidArn" | "SessionInvalidAuthToken" | "SessionAuthTokenExpired" | "SessionPossiblyStolenToken" | "MfaDisallowedIdentity" | "MfaDisallowedApprover" | "PendingOpDisallowedApprover" | "MfaTypeNotAllowed" | "MfaNotApprovedYet" | "MfaConfirmationCodeMismatch" | "MfaRemoveBelowMin" | "MfaOrgRequirementNotMet" | "MfaRegistrationDisallowed" | "TotpAlreadyConfigured" | "TotpConfigurationChanged" | "MfaTotpBadConfiguration" | "MfaTotpBadCode" | "MfaTotpRateLimit" | "ImproperSessionScope" | "FullSessionRequired" | "SessionWithoutAnyScopeUnder" | "UserRoleUnprivileged" | "MemberRoleForbidden" | "MfaNotConfigured" | "RemoveLastOidcIdentity" | "OperationNotAllowed" | "OrgExportRetrievalDisabled" | "ChangingKeyExportRequirementIsDisabled" | "AutoAddBlsKeyToProtectedRole" | "UserNotPolicyOwner" | "UserNotContactOwner" | "UserNotBucketOwner" | "LegacySessionCannotHaveScopeCeiling" | "RoleInParentOrgNotAllowed" | "RemoveKeyFromRoleUserNotAllowed" | "SiweChallengeExpired" | "SiweMessageNotValid" | "SiweMessageInvalidSignature" | "SiwsChallengeExpired" | "SiwsDomain" | "SiwsMessageInvalid" | "Acl"; /** * @description Specifies a fork of the `BeaconChain`, to prevent replay attacks. * The schema of `Fork` is defined in the [Beacon chain * spec](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#fork). * @example { * "current_version": "0x00001020", * "epoch": "0", * "previous_version": "0x00001020" * } */ Fork: { /** * @description Current fork version. * @example 0x43434343 */ current_version: string; epoch: components["schemas"]["Epoch"]; /** * @description Previous fork version. * @example 0x42424242 */ previous_version: string; }; /** * @description Genesis data as defined in the [Beacon API * spec](https://ethereum.github.io/beacon-APIs/#/Beacon/getGenesis). * You can get the genesis data from the Beacon node's `/eth/v1/beacon/genesis` end-point. * This struct definition is originally from lighthouse's eth2. */ GenesisData: { /** * @description Genesis fork version. * @example 0x42424242 */ genesis_fork_version: string; /** * @description Genesis time * @example 1679326449 */ genesis_time: string; /** * @description Genesis validators root. * @example 0x270d43e74ce340de4bca2b1936beca0f4f5408d9e78aec4850920baf659d5b69 */ genesis_validators_root: string; }; /** @description The email sender configuration (without sensitive auth details) */ GetEmailConfigResponse: { /** @description The email address that emails are sent from */ sender: string; template?: { /** @description An HTML template to use for the body. */ body_template: string; /** @description The subject line template */ subject_template: string; } | null; }; GetKeysInOrgRequest: { key_type?: components["schemas"]["KeyType"] | null; }; /** @description Parameters for the [`cs_transactionGet`](RpcMethod::GetTransaction) method. */ GetTransactionRequest: { id: components["schemas"]["Id"]; }; GetUserByEmailResponse: { /** * @description Typically, this array is either empty (if no user with a given email was found) * or contains a single element, i.e., the user with a given email. */ users: components["schemas"]["UserInOrgInfoWithIdentity"][]; }; GetUserByOidcResponse: { user?: components["schemas"]["UserInOrgInfoWithIdentity"] | null; }; /** @description Stats pertaining the the sender `cube3signer` instance */ HeartbeatRequest: { /** * Format: int64 * @description Number of requests currently active (received but not necessarily being processed yet) */ current_num_requests_active: number; /** * Format: int64 * @description Number of requests currently being processed by cube3signer */ current_num_requests_processing: number; /** @description Do not record metric data from this heartbeat */ ignore?: boolean; /** * Format: int64 * @description Number of new requests during this heartbeat period */ num_requests: number; /** * Format: int64 * @description Number of requests that failed during this heartbeat period */ num_requests_failed: number; /** * Format: int64 * @description Number of requests were retried during this heartbeat period */ num_requests_retried: number; /** * Format: int64 * @description Number of retries during this heartbeat period */ num_retries: number; /** * Format: int64 * @description Number of times auth token was refreshed during this heartbeat period */ num_token_refreshes?: number; /** * Format: int64 * @description Number of times auth token refresh failed during this heartbeat period */ num_token_refreshes_failed?: number; /** * @description Version of the proxy sending the heart beat request * * TODO: Make non-optional once we do not support proxies without version information */ proxy_version?: string | null; }; /** @description Configuration governing whether and how to save historical data. */ HistoricalDataConfiguration: { tx: components["schemas"]["HistoricalTxConfiguration"]; }; /** @description A recently signed transaction that we store in the DB. */ HistoricalTx: { date: components["schemas"]["EpochDateTime"]; exp_epoch: components["schemas"]["EpochDateTime"]; historical_tx_org_id: components["schemas"]["Id"]; key_id: components["schemas"]["Id"]; mfa_status?: components["schemas"]["Status"] | null; operation: components["schemas"]["OperationKind"]; request: components["schemas"]["HttpRequest"]; /** @description Original request id */ request_id?: string | null; /** @description Operation-specific result */ result: unknown; role_id?: components["schemas"]["Id"] | null; user_id?: components["schemas"]["Id"] | null; }; /** @description Configuration governing whether and how to save historical transactions. */ HistoricalTxConfiguration: { lifetime?: components["schemas"]["Seconds"] | null; }; /** * @description Information about the request. * * Captures all the relevant info (including the request body) about requests that require MFA. * We use this to verify that when a request is resumed (after obtaining necessary MFA approvals) * it is exactly the same as it originally was. */ HttpRequest: { /** @description HTTP request body */ body?: Record | null; /** @description HTTP method of the request */ method: string; /** @description HTTP path of the request, excluding the host */ path: string; }; /** @description How to compare HTTP requests when verifying MFA receipt (see [MfaRequest::verify_request]) */ HttpRequestCmp: OneOf< [ "Eq", { EvmTx: components["schemas"]["EvmTxCmp"]; }, { SolanaTx: components["schemas"]["SolanaTxCmp"]; }, ] >; Id: string; /** * @description Information about a linked OIDC identity including unique identifiers and user info * (e.g., email) */ IdentityInfo: components["schemas"]["OidcIdentity"] & components["schemas"]["OidcUserInfo"] & Record; /** * @description Proof that an end-user provided CubeSigner with a valid auth token * (either an OIDC token or a CubeSigner session token) */ IdentityProof: { aud?: components["schemas"]["Aud"] | null; /** * @description The email associated with the user * @example user@email.com */ email?: string | null; exp_epoch: components["schemas"]["EpochDateTime"]; identity?: components["schemas"]["OidcIdentity"] | null; /** * @description The username (if any) associated with the user * @example cubistdev */ preferred_username?: string | null; user_info?: components["schemas"]["CubeSignerUserInfo"] | null; } & { /** @description An opaque identifier for the proof */ id: string; }; /** @description IDP configuration */ IdpConfig: { throttle?: components["schemas"]["ThrottleConfig"] | null; /** @description Enable for certain user roles */ users?: components["schemas"]["MemberRole"][] | null; }; ImportKeyRequest: components["schemas"]["KeyImportKey"] & components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * @description When false (the default), nothing is returned when an imported key already * exists. When true, returns the KeyInfo struct for keys that already exist * if caller is allowed to list that key. */ idempotent?: boolean; /** @description A set of encrypted keys to be imported */ key_material: components["schemas"]["ImportKeyRequestMaterial"][]; key_type: components["schemas"]["KeyType"]; }; ImportKeyRequestMaterial: { /** * @description The client's ephemeral public key used to derive a shared key. * This is a base64-encoded, SEC1-encoded P384 public key. */ client_public_key: string; /** * @description The encrypted keying material to be imported. * This is a base64-encoded ciphertext. */ ikm_enc: string; /** * @description A salt value used to derive a shared key. * This is a base64-encoded byte string. */ salt: string; }; /** @enum {string} */ InternalErrorCode: | "NoMaterialId" | "InvalidAuditLogEntry" | "UnexpectedCheckerRule" | "UnresolvedPolicyReference" | "UnexpectedAclAction" | "FidoKeyAssociatedWithMultipleUsers" | "ClaimsParseError" | "InvalidThrottleId" | "InvalidEmailAddress" | "EmailTemplateRender" | "OidcIdentityHeaderMissing" | "OidcIdentityParseError" | "SystemTimeError" | "PasswordHashParseError" | "SendMailError" | "ReqwestError" | "EmailConstructionError" | "TsWriteError" | "TsQueryError" | "DbQueryError" | "DbGetError" | "DbBatchGetError" | "DbDeleteError" | "DbPutError" | "DbUpdateError" | "SerdeError" | "TestAndSetError" | "DbGetItemsError" | "DbWriteError" | "CubistSignerError" | "CwListMetricsError" | "CwPutMetricDataError" | "GetAwsSecretError" | "SecretNotFound" | "KmsGenerateRandomError" | "MalformedTotpBytes" | "KmsGenerateRandomNoResponseError" | "CreateKeyError" | "ParseDerivationPathError" | "SplitSignerError" | "CreateImportKeyError" | "CreateEotsNoncesError" | "EotsSignError" | "BabylonCovSignError" | "CognitoDeleteUserError" | "CognitoListUsersError" | "CognitoGetUserError" | "MissingUserEmail" | "CognitoResendUserInvitation" | "CognitoSetUserPasswordError" | "GenericInternalError" | "AssumeRoleWithoutEvidence" | "OidcAuthWithoutOrg" | "MissingKeyMetadata" | "KmsEnableKeyError" | "KmsDisableKeyError" | "LambdaInvokeError" | "LambdaNoResponseError" | "LambdaFailure" | "LambdaUnparsableResponse" | "SerializeEncryptedExportKeyError" | "DeserializeEncryptedExportKeyError" | "ReEncryptUserExport" | "S3UploadError" | "S3DownloadError" | "S3CopyError" | "S3ListObjectsError" | "S3DeleteObjectsError" | "S3BuildError" | "S3PresignedUrlError" | "ManagedStateMissing" | "InternalHeaderMissing" | "InvalidInternalHeaderValue" | "RequestLocalStateAlreadySet" | "OidcOrgMismatch" | "OidcIssuerInvalidJwk" | "InvalidPkForMaterialId" | "SegwitTweakFailed" | "UncheckedOrg" | "SessionOrgIdMissing" | "AvaSignCredsMissing" | "AvaSignSignatureMissing" | "ExpectedRoleSession" | "InvalidThirdPartyIdentity" | "CognitoGetUser" | "SnsSubscribeError" | "SnsUnsubscribeError" | "SnsGetSubscriptionAttributesError" | "SnsSubscriptionAttributesMissing" | "SnsSetSubscriptionAttributesError" | "SnsPublishBatchError" | "InconsistentMultiValueTestAndSet" | "MaterialIdError" | "InvalidBtcAddress" | "HistoricalTxBodyMissing" | "InvalidOperation" | "ParentOrgNotFound" | "OrgParentLoop" | "ResolvedParentOrgWithNoScopeCeiling" | "InvalidUploadObjectId" | "PolicyEngineNotFound" | "PolicyEngineError" | "PolicySecretsEncryptionError" | "CreatePolicyImportKeyError" | "InvalidAlias" | "EmptyUpdateModifiedObject" | "EmptyUpdateModifiedActions" | "DbContactAddressesInvalid" | "InvalidEvmSigedRlp" | "InvalidErc20Data" | "InvalidRpcUrl"; InvitationAcceptRequest: { auth: components["schemas"]["AuthSource"]; /** @description Invitation token */ token: string; }; /** @description Information about a pending invitation */ InvitationInfo: { created: components["schemas"]["EpochDateTime"]; /** @description The email address the invitation was sent to */ email: string; expiration: components["schemas"]["EpochDateTime"]; inviter?: components["schemas"]["Id"] | null; /** @description The invited user's name */ name: string; role: components["schemas"]["MemberRole"]; }; /** * @description Indicates the auth sources allowed to an invited user * @enum {string} */ InviteKind: "Cognito" | "IdpAndSso" | "Sso"; InviteRequest: { /** * @description The user's email address * @example alice@acme.com */ email: string; invite_kind?: components["schemas"]["InviteKind"] | null; /** @description Optional login MFA policy */ mfa_policy?: Record | null; /** * @description The user's full name * @example Alice Wonderland */ name: string; role?: components["schemas"]["MemberRole"] | null; /** * @description Skip sending an invitation email to this user if true. * * NOTE: this field is for internal testing use ONLY. If you do not * send an invitation email (and the invite kind is not SSO), the user will never be able to log in. * @example false */ skip_email?: boolean; }; /** @description A request containing the data that a Wasm policy should be invoked with. */ InvokePolicyRequest: { /** * @description An optional Key ID. If defined, the policy will be invoked as if it is signing * the message with this key. */ key_id?: string | null; /** @description The "request body" that should be sent to the policy. */ request?: unknown; /** @description An optional Role ID. If `None`, the policy will be invoked from the current user session. */ role_id?: string | null; }; /** @description The result of invoking a Wasm policy. */ InvokePolicyResponse: { response: components["schemas"]["WasmPolicyResponse"]; /** * @description The bytes written to `stderr`, encoded as a hex-string. * In most cases, these bytes correspond to a UTF-8-encoded `String`. */ stderr: string; /** * @description The bytes written to `stdout`, encoded as a hex-string. * In most cases, these bytes correspond to a UTF-8-encoded `String`. */ stdout: string; }; JrpcResponse: components["schemas"]["Response"] & Record; /** * @description A [`KeyPackage`] serialized into a format that gives a tidier JSON * representation suitable for encryption in the user-export flow. * * We construct values of this type rather than constructing `serde_json::Value`s * directly with `json!()` because this allows us to zeroize values on drop, which * doesn't work with `serde_json::Value`. * * Examples of serialized material: * * - `JsonKeyMaterial::EnglishMnemonic`: * * ``` * use cubist_signer_utils::{ * DerivationPath, KeyPackage, Mnemonic, MnemonicPackage, Secp256k1Pkg, * }; * use serde_json::json; * * const MNEMONIC: &str = "deposit fiscal brain swarm surround cousin horn glare fix love render believe guide shuffle stem cram broccoli resemble beach artefact language gift jar permit"; * const DER_PATH: &str = "m/44'/60'/0'/0/0"; * const KEY_TYPE: &str = "ecdsa:secp256k1"; * * let mne = Mnemonic::try_from(MNEMONIC).expect("good mnemonic"); * let derp = DerivationPath::try_from(DER_PATH).expect("good der path"); * let mne_pkg = MnemonicPackage::new(mne, "", derp); * let key_pkg = KeyPackage::::EnglishMnemonic(mne_pkg); * let json_pkg = key_pkg.into_json(KEY_TYPE); * * let json_expect = json!({ * "key_type": KEY_TYPE, * "material_type": "english_mnemonic", * "mnemonic": MNEMONIC, * "password": "", * "derivation_path": DER_PATH, * }); * * assert_eq!( * serde_json::to_value(&json_pkg).expect("json serialization"), * json_expect, * ); * ``` * * - `JsonKeyMaterial::RawSecret`: * * ``` * use cubist_signer_utils::{ * get_random_byte_array, hex_encode, KeyPackage, RngCore, Secp256k1Pkg, * }; * use serde_json::json; * * const KEY_TYPE: &str = "ecdsa:secp256k1"; * * // random 32-byte secret * let sk: [u8; 32] = *get_random_byte_array(); * * let key_pkg = KeyPackage::::Secret(sk); * let json_pkg = key_pkg.into_json(KEY_TYPE); * * let json_expect = json!({ * "key_type": KEY_TYPE, * "material_type": "raw_secret", * "secret": hex_encode(&sk), * }); * * assert_eq!( * serde_json::to_value(&json_pkg).expect("json serialization"), * json_expect, * ); * ``` */ JsonKeyPackage: ( | { /** @enum {string} */ material_type: "raw_secret"; /** @description The value of the raw secret */ secret: string; } | { /** @description The derivation path */ derivation_path: string; /** @enum {string} */ material_type: "english_mnemonic"; /** @description The mnemonic */ mnemonic: string; /** @description The password (which may be empty) */ password: string; } ) & { /** @description The type of key this package represents */ key_type: string; }; /** @description The top-level JSON-RPC request type. */ JsonRpcRequest: components["schemas"]["RpcMethod"] & { /** @description Request ID */ id?: string; /** @description JSON-RPC version. */ jsonrpc: string; }; /** @description The RPC API's response. */ JsonRpcResponse: { error?: components["schemas"]["ErrorObj"] | null; /** @description ID from the corresponding request. */ id?: unknown; /** @description Constant "2.0". */ jsonrpc: string; /** @description Result, if success. */ result?: Record | null; }; /** @description Valid `result` from the JSON-RPC API. */ JsonRpcResult: | components["schemas"]["RpcTransactionInfo"] | components["schemas"]["ListTransactionsPaginatedResponse"] | components["schemas"]["SubAccountTransferResponse"] | components["schemas"]["UniversalTransferResponse"] | components["schemas"]["SubAccountAssetsResponse"] | components["schemas"]["AccountInfoResponse"] | components["schemas"]["SubAccountTransferHistoryResponse"] | components["schemas"]["UniversalTransferHistoryResponse"] | components["schemas"]["WithdrawResponse"] | components["schemas"]["WithdrawHistoryResponse"] | components["schemas"]["DepositResponse"] | components["schemas"]["DepositHistoryResponse"] | components["schemas"]["ListSubAccountsResponse"] | components["schemas"]["CoinInfoResponse"] | components["schemas"]["SubAccountDepositAddressResponse"] | components["schemas"]["BybitQueryUserResponse"] | components["schemas"]["BybitQuerySubMembersResponse"] | components["schemas"]["BybitQueryCoinsBalanceResponse"] | components["schemas"]["BybitQueryDepositAddressResponse"] | components["schemas"]["BybitUniversalTransferResponse"] | components["schemas"]["BybitWithdrawResponse"] | components["schemas"]["BybitWithdrawalsResponse"] | components["schemas"]["BybitCoinInfoResponse"] | components["schemas"]["BybitDepositHistoryResponse"] | components["schemas"]["BybitUniversalTransferHistoryResponse"] | components["schemas"]["BybitQueryWithdrawAddressResponse"] | components["schemas"]["BybitQuerySubDepositAddressResponse"] | components["schemas"]["CoinbaseListAccountsResponse"] | components["schemas"]["CoinbaseListPortfoliosResponse"] | components["schemas"]["CoinbaseMoveFundsResponse"] | components["schemas"]["BtcListUtxosResponse"]; JwkSetResponse: { /** @description The keys included in this set */ keys: Record[]; }; KeyAttestationClaims: { exp: components["schemas"]["EpochDateTime"]; iat: components["schemas"]["EpochDateTime"]; key_info: components["schemas"]["KeyInfo"]; /** @description If requested, the roles the key is currently in. */ key_roles?: components["schemas"]["KeyInRoleInfo"][] | null; }; KeyCountDimensions: { /** @description The key type */ key_type: string; /** @description All metrics must include 'org_id' as a dimension. */ org_id: string; }; /** @description Derivation-related metadata for keys derived from a long-lived mnemonic */ KeyDerivationInfo: { /** @description The derivation path used to derive this key */ derivation_path: string; /** @description The mnemonic-id of the key's parent mnemonic */ mnemonic_id: string; }; /** @description A wrapped key-import key */ KeyImportKey: { /** @description Base64-encoded, encrypted data key. */ dk_enc: string; /** * Format: int64 * @description Expiration timestamp expressed as seconds since the UNIX epoch. */ expires: number; /** * @description The ephemeral public key to which an imported key should be encrypted. * This is a P384 public key in base64-encoded uncompressed SECG format. */ public_key: string; /** @description Base64-encoded, encrypted secret key. */ sk_enc: string; }; KeyInRoleInfo: { /** * @description Key ID * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_info?: components["schemas"]["KeyInfo"] | null; /** * @description Policies that are checked before this key is used on behalf of this role * @example [ * { * "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa" * }, * { * "TxDeposit": { * "kind": "Canonical" * } * } * ] */ policy?: Record[]; /** * @description Role ID * @example Role#e427c28a-9c5b-49cc-a257-878aea58a22c */ role_id: string; }; KeyInfo: components["schemas"]["CommonFields"] & { /** * @description Key access-control entries * @example [ * { * "actions": [ * "manage:key:properties" * ], * "subjects": [ * "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f" * ] * } * ] */ acl?: unknown[] | null; derivation_info?: components["schemas"]["KeyDerivationInfo"] | null; /** @description Whether the key is enabled (only enabled keys may be used for signing) */ enabled: boolean; /** * @description The id of the key: "Key#" followed by a unique identifier specific to * the type of key (such as a public key for BLS or an ethereum address for Secp) * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_type: components["schemas"]["KeyType"]; /** * @description A unique identifier specific to the type of key, such as a public key or an ethereum address * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ material_id: string; /** * @description Owner of the key * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner: string; /** * @description Key policy * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy: unknown[]; properties?: components["schemas"]["KeyPropertiesPatch"] | null; /** @description The key provenance. */ provenance?: string | null; /** * @description Hex-encoded, serialized public key. The format used depends on the key type: * - Secp256k1 keys use 65-byte uncompressed SECG format; * - Stark keys use 33-byte compressed SECG format; * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format; * - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032. * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431 */ public_key: string; /** * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages) * @example Eth2Validator(1) */ purpose: string; /** @description The region affinity for this key */ region?: string; }; /** @description Response returned when requesting a key attestation. */ KeyInfoJwt: { /** @description A JSON Web Token whose claims contain the `KeyInfo` structure. */ jwt: string; }; KeyInfos: { keys: components["schemas"]["KeyInfo"][]; }; /** * @description Client-side wire payload for [`KeyProperties`]. Used in both directions: * * - **On write**: a *patch*, i.e., for each field, missing means "leave alone", * `null` means "clear", and a value means "set". Secret fields arrive in the * clear and are encrypted server-side before persisting. * - **On read**: each field is omitted when the stored property is unset; secret * fields are emitted with the redacted marker (e.g. "[REDACTED]"). */ KeyPropertiesPatch: OneOf< [ components["schemas"]["BinanceApiPropertiesPatch"] & { /** @enum {string} */ kind: "BinanceApi"; }, components["schemas"]["CoinbaseApiPropertiesPatch"] & { /** @enum {string} */ kind: "CoinbaseApi"; }, components["schemas"]["BybitApiPropertiesPatch"] & { /** @enum {string} */ kind: "BybitApi"; }, ] >; /** @enum {string} */ KeyType: | "SecpEthAddr" | "SecpBtc" | "SecpBtcTest" | "SecpBtcLegacy" | "SecpBtcLegacyTest" | "SecpAvaAddr" | "SecpAvaTestAddr" | "BlsPub" | "BlsInactive" | "BlsAvaIcm" | "Ed25519SolanaAddr" | "Ed25519SuiAddr" | "Ed25519AptosAddr" | "Ed25519CardanoAddrVk" | "Ed25519StellarAddr" | "Ed25519SubstrateAddr" | "Ed25519CantonAddr" | "Ed25519BinanceApi" | "Ed25519CoinbaseApi" | "Mnemonic" | "Stark" | "BabylonEots" | "BabylonCov" | "TaprootBtc" | "TaprootBtcTest" | "SecpCosmosAddr" | "P256CosmosAddr" | "P256OntologyAddr" | "P256Neo3Addr" | "Ed25519TendermintAddr" | "SecpTronAddr" | "Ed25519TonAddr" | "SecpDogeAddr" | "SecpDogeTestAddr" | "SecpKaspaAddr" | "SecpKaspaTestAddr" | "SchnorrKaspaAddr" | "SchnorrKaspaTestAddr" | "SecpLtc" | "SecpLtcTest" | "SecpXrpAddr" | "Ed25519XrpAddr" | "BabyJubjub" | "HmacSha256" | "HmacSha256Bybit"; KeyTypeAndDerivationPath: { /** * @description List of derivation paths for which to derive. * @example m/44'/60'/0'/0/0 */ derivation_path: string; key_type: components["schemas"]["KeyType"]; /** * @description Policies to apply to this key. It is an error to specify a policy * that is not compatible with `key_type`. * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: unknown[] | null; }; /** * @description Wrapper around encrypted [UnencryptedLastEvalKey] bytes. * * We serialize this into a base64url-encoded string and return to the user * so that they can pass this back to us as a url query parameter. */ LastEvalKey: string; /** * @description The base policy evaluation result associated with a [leaf][PolicyEvalTree::Leaf] node. * * This type is very similar to [BasePolicyEvalResult], except that it contains only the * information we want to include in the evaluation tree that we send back to the client. */ LeafNodeResult: OneOf< [ { evidence: components["schemas"]["PermitEvidence"]; /** @enum {string} */ outcome: "Permitted"; }, { op: components["schemas"]["OperationKind"]; /** @enum {string} */ outcome: "Inapplicable"; }, { error_code: components["schemas"]["PolicyErrorCode"]; message: string; /** @description Additional structured details about the denial */ more_info?: unknown; /** @enum {string} */ outcome: "Denied"; }, { /** @enum {string} */ outcome: "MfaRequired"; }, ] >; /** @description Properties of a [PolicyEvalTree::Leaf] node. */ LeafProps: components["schemas"]["LeafNodeResult"] & { provenance: components["schemas"]["PolicyAttachedTo"]; /** @description The leaf rule that was evaluated */ rule: unknown; }; /** * @description Parameters for `cs_coinbaseListAccounts`. * * Coinbase endpoint: `GET /api/v3/brokerage/accounts`. * * Lists the brokerage accounts the calling key can see. All filters are * optional; Coinbase paginates the result via `cursor` / `has_next`. */ ListAccountsRequest: { /** @description Cursor from a previous response's [`CoinbaseListAccountsResponse::cursor`]. */ cursor?: string | null; /** * Format: int32 * @description Page size (Coinbase default: 49, max: 250). */ limit?: number | null; /** @description Filter to a specific retail portfolio. */ retail_portfolio_id?: string | null; }; /** @description Third-party identities associated with the user's account */ ListIdentitiesResponse: { identities: components["schemas"]["IdentityInfo"][]; }; /** @description List of pending invitations */ ListInvitationsResponse: { /** @description Pending invitations */ invitations: components["schemas"]["InvitationInfo"][]; }; /** @description All pending MMI requests created by the current user. */ ListPendingMessagesResponse: { /** @description All pending messages for a user. */ pending_messages: components["schemas"]["PendingMessageInfo"][]; }; /** * @description Parameters for `cs_coinbaseListPortfolios`. * * Coinbase endpoint: `GET /api/v3/brokerage/portfolios`. */ ListPortfoliosRequest: { /** * @description Filter by portfolio type (e.g. `"DEFAULT"`, `"CONSUMER"`, `"INTX"`). * Left as `String` for forward compatibility. */ portfolio_type?: string | null; }; /** * @description Parameters for `GET /sapi/v1/sub-account/list`. * * Enumerates the sub-accounts under the calling master account. All filters * are optional; if `email`/`is_freeze` are omitted, every sub-account is * returned subject to pagination. */ ListSubAccountsRequest: { /** @description Filter to the sub-account with this email. */ email?: string | null; /** * @description Filter by freeze status (`true` = frozen sub-accounts only, * `false` = active sub-accounts only). Binance accepts this as the * literal strings `"true"`/`"false"`, which is exactly what * `serde_urlencoded` emits for `bool`. */ isFreeze?: boolean | null; /** * Format: int32 * @description Page size (Binance default: 1, max: 200). */ limit?: number | null; /** * Format: int32 * @description 1-based page number (Binance default: 1). */ page?: number | null; }; /** * @description Response returned by `cs_binanceListSubAccounts`. Binance returns a * `{ "subAccounts": [...] }` envelope; this struct preserves that wire * format. */ ListSubAccountsResponse: { /** @description One entry per sub-account matching the request filters. */ subAccounts: components["schemas"]["SubAccountInfo"][]; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ ListTransactionsPaginatedResponse: { /** @description A list of transaction infos. */ transactions: components["schemas"]["RpcTransactionInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** @description Parameters for the [`cs_transactionList`](RpcMethod::ListTransactions) method. */ ListTransactionsRequest: components["schemas"]["Page"] & { /** * @description Optional user or role id. * * If defined, the response is filtered to transactions created by the given id. */ owner?: string | null; }; /** @description The response to [`cs_transactionList`](super::request::CsRpc::ListTransactions) */ ListTransactionsResponse: { /** @description A list of transaction infos. */ transactions: components["schemas"]["RpcTransactionInfo"][]; }; LoginRequest: components["schemas"]["OidcLoginRequest"]; /** * @description Describes whether a user in an org is an Owner or just a regular member * @enum {string} */ MemberRole: "Alien" | "Member" | "Owner"; /** @enum {string} */ MembershipStatus: "enabled" | "disabled"; /** @description The name of the metric to compute */ MetricName: | components["schemas"]["OrgMetricDiscriminants"] | components["schemas"]["TsQueryName"]; /** * @example { * "allowed_approvers": [ * "User#fabc3f88-04e0-471b-9657-0ae12a3cd73e", * "User#d796c369-9974-473b-ab9e-e4a2418d2d07" * ], * "count": 2, * "lifetime": 900 * } */ MfaPolicy: { /** * @description Users who are allowed to approve. If empty, the current user * will be inserted by default. */ allowed_approvers?: string[]; /** @description Allowed approval types. When omitted, defaults to any. */ allowed_mfa_types?: components["schemas"]["MfaType"][] | null; /** * Format: int32 * @description How many users must approve (defaults to 1). */ count?: number; lifetime?: components["schemas"]["Seconds"]; /** * Format: int32 * @description How many auth factors to require per user (defaults to 1). */ num_auth_factors?: number; request_comparer?: components["schemas"]["HttpRequestCmp"]; /** * @description CubeSigner operations to which this policy should apply. * When omitted, applies to all operations. */ restricted_operations?: components["schemas"]["OperationKind"][] | null; time_delay?: components["schemas"]["Seconds"]; }; /** * @description MFA-protected actions whose MFA requirements are configurable by org owners. * * Specifying the 'CubeSigner' MFA type is never allowed for any of these actions. * @enum {string} */ MfaProtectedAction: | "Default" | "RegisterMfa" | "Login" | "ExtendSession" | "AddIdentity" | "KeyExport"; /** @description Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). */ MfaRequestInfo: { created_at?: components["schemas"]["EpochDateTime"]; /** @description The session identity (user or role) that created this request. */ created_by: string; expires_at: components["schemas"]["EpochDateTime"]; /** @description Approval request ID. */ id: string; not_valid_until?: components["schemas"]["EpochDateTime"]; /** * @description MFA policy provenance * @enum {string} */ provenance: "Org" | "Key" | "KeyInRole" | "Role" | "User" | "EditPolicy"; receipt?: components["schemas"]["Receipt"] | null; /** @description The region this MFA request was created in. It can only be redeemed from the same region. */ region?: string; /** * @description If set, contains the IDs of all MFA requests (including this one!) that * were generated at once for the same CubeSigner operation. * * If not set, it means that this was the lone MFA request generated for `request`. * * This is useful so that a client can discover all the MFAs whose receipts must * be submitted together to carry out the original CubeSigner operation. */ related_ids?: string[]; request: components["schemas"]["HttpRequest"]; status: components["schemas"]["Status"]; }; MfaRequiredArgs: { /** @description Always set to first MFA id from `Self::ids` */ id: string; /** @description Non-empty MFA request IDs or [`PendingOpPolicyRef`]-form refs */ ids: string[]; /** @description Organization id */ org_id: string; /** @description Optional policy evaluation tree (included in signer responses, when requested) */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; session?: components["schemas"]["NewSessionResponse"] | null; }; /** @description Org-wide MFA requirements. */ MfaRequirements: { alien_login_requirement?: components["schemas"]["SecondFactorRequirement"]; allowed_mfa_types?: components["schemas"]["AllowedMfaMap"]; key_export_requirement?: components["schemas"]["SecondFactorRequirement"]; member_login_requirement?: components["schemas"]["SecondFactorRequirement"]; }; MfaResetRequest: { /** * @description The id of the user you want to reset MFA for * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; /** * Format: 'CubeSigner' | 'Fido' | `FidoKey#${string}` | 'Totp' | 'EmailOtp' | `EmailOtp#${number}` * @description Different types that can be used to approve an MFA request */ MfaType: string; /** @enum {string} */ MfaVote: "approve" | "reject"; /** @description An individual item in a MigrateIdentityRequest */ MigrateIdentityItem: components["schemas"]["OidcIdentity"] & { /** @description The id of the user you want to operate on */ user_id: string; }; /** @description A request to add or remove an OIDC identities for an existing user */ MigrateIdentityRequest: components["schemas"]["MigrateIdentityItem"][]; /** @description A request to update an existing user. */ MigrateUpdateUserItem: { /** @description The id of the user you want to operate on */ user_id: string; /** * @description Override user's verified email in this org. Use an empty string to indicate that this user's * verified email should be cleared (and fallback to their display email). */ verified_email?: string | null; }; MigrateUpdateUsersRequest: components["schemas"]["MigrateUpdateUserItem"][]; MmiMetadata: { /** @description Chain ID (not required when signing a personal message (EIP-191)) */ chainId?: string | null; /** @description If the custodian should publish the transaction */ custodianPublishesTransaction?: boolean | null; /** @description A note to be attached to the transaction which can be specified by the user */ note?: string | null; /** @description The web page/dapp where the transaction originated */ originUrl?: string | null; /** @description User's preferred RPC URL, and it should be the same as the RPC URL for the network corresponding to the Chain ID */ rpcUrl?: string | null; /** @description The category of transaction, as best can be determined by the wallet */ transactionCategory?: string | null; }; MmiRejectRequest: { /** @description Optional reason for rejecting. */ reason?: string | null; }; MmiStatus: { /** @description Short text to display to the user */ displayText: string; /** @description Whether the signed message has finished, e.g. it is completed, failed or cancelled */ finished: boolean; /** @description The reason for the signed message status */ reason?: string | null; /** @description Whether the message was signed */ signed: boolean; /** @description Whether the transaction was submitted to the blockchain */ submitted?: boolean; /** @description Whether the transaction was successful, i.e. it was included in a block and not reverted */ success: boolean; }; /** * @description Parameters for `cs_coinbaseMoveFunds`. * * Coinbase endpoint: `POST /api/v3/brokerage/portfolios/move_funds`. */ MoveFundsRequest: { funds: components["schemas"]["CoinbaseAmount"]; /** @description UUID of the portfolio the funds are debited from. */ source_portfolio_uuid: string; /** @description UUID of the portfolio the funds are credited to. */ target_portfolio_uuid: string; }; /** @description Information about a signed message */ MsgSignature: { /** @description The signature */ signature: string; }; /** @description A struct representing the pending message status */ MsgStatus: | { /** @enum {string} */ status: "Pending"; } | { /** @description Information about a signed message */ sig: { /** @description The signature */ signature: string; }; /** @enum {string} */ status: "Signed"; } | { reason: string; /** @enum {string} */ status: "Rejected"; }; /** * @description Network name ('mainnet', 'holesky') * @example holesky * @enum {string} */ Network: "mainnet" | "holesky" | "hoodi"; /** @description Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). */ NewSessionResponse: { /** * Format: int64 * @description Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. * @example 1701879640 */ expiration?: number; org_id: components["schemas"]["Id"]; /** @description Token that can be used to refresh this session. */ refresh_token: string; session_info: components["schemas"]["ClientSessionInfo"]; /** * @description New token to be used for authentication. Requests to signing endpoints * should include this value in the `Authorization` header. */ token: string; }; /** Format: binary */ NonceValue: string; /** @enum {string} */ NotFoundErrorCode: | "UriSegmentMissing" | "UriSegmentInvalid" | "TotpNotConfigured" | "FidoKeyNotFound" | "FidoChallengeNotFound" | "TotpChallengeNotFound" | "UserExportRequestNotFound" | "UserExportCiphertextNotFound" | "OrgExportCiphertextNotFound" | "UploadObjectNotFound" | "PolicySecretNotFound" | "BucketMetaNotFound" | "TimestreamDisabled" | "CustomChainNotFound" | "InvitationNotFound" | "TransactionNotFound" | "EmailConfigNotFound"; /** @description The configuration and status of a notification endpoint */ NotificationEndpoint: components["schemas"]["NotificationEndpointSubscription"] & { status: components["schemas"]["SubscriptionStatus"]; }; /** @description The configuration for an org event endpoint */ NotificationEndpointConfiguration: { filter?: components["schemas"]["OrgEventFilter"]; /** @description URL of the endpoint */ url: string; }; /** @description A notification endpoint subscription */ NotificationEndpointSubscription: { /** @description The ARN of the subscription */ arn: string; config: components["schemas"]["NotificationEndpointConfiguration"]; }; /** @description Represents the data extracted from the OIDC token */ OidcClaims: components["schemas"]["OidcUserInfo"] & components["schemas"]["OidcIdentity"] & { /** * @description Audience(s) that this ID Token is intended for. It MUST contain the * OAuth 2.0 client_id of the Relying Party as an audience value. It MAY * also contain identifiers for other audiences. * This value is opaque according to the OIDC spec, but for example Google * audiences look like `1234987819200.apps.googleusercontent.com` * @example 1234987819200.apps.googleusercontent.com */ aud: string; /** @description An optional restriction on the set of scopes allowed with this token */ cubesigner_scope_ceiling?: components["schemas"]["Scope"][] | null; }; /** * @description Represents a globally unique OIDC-authorized user by expressing the full "path" to a user. That is: * * (iss) (sub) * Issuer -> Subresource */ OidcIdentity: { /** * @description The root-level issuer who administrates this user. From the OIDC spec: * Issuer Identifier for the Issuer of the response. The iss * value is a case sensitive URL using the https scheme that contains * scheme, host, and optionally, port number and path components and * no query or fragment components. * @example https://accounts.google.com */ iss: string; /** * @description From the OIDC spec: * * A locally unique and never reassigned identifier within the Issuer for * the End-User, which is intended to be consumed by the Client, e.g., * 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed * 255 ASCII characters in length. The sub value is a case sensitive * string. * @example 10769150350006150715113082367 */ sub: string; }; /** @description Information about an explicitly configured (allowlisted) OpenID provider for an org */ OidcIssuerInfo: { /** @description Intended audiences (client IDs) */ audiences: string[]; /** @description Issuer URL */ issuer: string; /** @description Optional issuer nickname */ nickname?: string | null; /** @description The user roles allowed to use this IDP */ users: components["schemas"]["MemberRole"][]; }; OidcLoginDimensions: { /** @description The OIDC issuer (provider) */ issuer: string; /** @description All metrics must include 'org_id' as a dimension. */ org_id: string; }; /** @description OIDC login request */ OidcLoginRequest: components["schemas"]["ClientSessionMetadata"] & { /** @description A human readable description of the purpose of the session */ purpose?: string | null; /** * @description Controls what capabilities this session will have. * @example [ * "sign:*" * ] */ scopes: components["schemas"]["Scope"][]; tokens?: components["schemas"]["RatchetConfig"]; }; OidcUserInfo: { /** * @description The email associated with the user * @example user@email.com */ email?: string | null; /** * @description The user name (if any) associated with the user * @example dril */ preferred_username?: string | null; }; /** * @description All different kinds of sensitive operations * @enum {string} */ OperationKind: | "AvaSign" | "AvaChainTxSign" | "BabylonCovSign" | "BabylonRegistration" | "BabylonStaking" | "BinanceSubToMaster" | "BinanceSubToSub" | "BinanceUniversalTransfer" | "BinanceSubAccountAssets" | "BinanceAccountInfo" | "BinanceSubAccountTransferHistory" | "BinanceUniversalTransferHistory" | "BinanceWithdraw" | "BinanceWithdrawHistory" | "BinanceDeposit" | "BinanceDepositHistory" | "BinanceListSubAccounts" | "BinanceCoinInfo" | "BinanceSubAccountDepositAddress" | "BinanceSubAccountDepositHistory" | "BlobSign" | "BtcMessageSign" | "BtcSign" | "BybitQueryUser" | "BybitQuerySubMembers" | "BybitQueryCoinsBalance" | "BybitQueryDepositAddress" | "BybitUniversalTransfer" | "BybitWithdraw" | "BybitWithdrawals" | "BybitQueryCoinInfo" | "BybitDepositHistory" | "BybitSubDepositHistory" | "BybitUniversalTransferHistory" | "BybitQueryWithdrawAddress" | "BybitQuerySubDepositAddress" | "CoinbaseListAccounts" | "CoinbaseListPortfolios" | "CoinbaseMoveFunds" | "DiffieHellman" | "PsbtSign" | "TaprootSign" | "Eip191Sign" | "Eip712Sign" | "Eip7702Sign" | "EotsNonces" | "EotsSign" | "Eth1Sign" | "Eth2Sign" | "Eth2Stake" | "Eth2Unstake" | "SolanaSign" | "SuiSign" | "TendermintSign" | "RoleUpdate"; OrgAlertsPrefs: { /** @description Recipient users for org-level alerts */ alert_recipients?: components["schemas"]["Id"][] | null; /** @description Org-level alerts to send emails for */ subscribed_alerts?: components["schemas"]["AlertKind"][] | null; }; OrgData: { /** * @description The id of the org * @example Org#123... */ org_id: string; /** * @description The human-readable name for the org * @example my_org_name */ org_name?: string | null; }; OrgEventArgs: { org_event: "OrgEventArgs"; } & Omit & { /** @description The identity that triggered the event */ triggered_by: string; }; /** @description Org-level events that we notify our customers about */ OrgEventData: | { billing_event: components["schemas"]["BillingEvent"]; key?: components["schemas"]["Id"] | null; /** @enum {string} */ org_event: "Billing"; role?: components["schemas"]["Id"] | null; user?: components["schemas"]["Id"] | null; } | { /** * Format: int64 * @description The duration of the request in milliseconds */ duration_ms: number; /** @description The HTTP request method */ method: string; operation: components["schemas"]["BillingEvent"]; /** @enum {string} */ org_event: "Response"; /** * Format: int32 * @description The HTTP response status */ status: number; /** @description The HTTP request path + query parameters */ uri: string; } | { membership: components["schemas"]["MemberRole"]; /** @enum {string} */ org_event: "OidcAuth"; purpose?: string | null; scopes: components["schemas"]["Scope"][]; user_info: components["schemas"]["OidcClaims"]; } | { /** @description The material id (address) of the key used for signing */ key_material_id: string; key_type: components["schemas"]["KeyType"]; operation: components["schemas"]["OperationKind"]; /** @enum {string} */ org_event: "Signed"; } | { chain_id: components["schemas"]["Id"]; key_id: components["schemas"]["Id"]; /** @enum {string} */ org_event: "BabylonEotsConcurrentSigning"; /** Format: int64 */ prev_block_height: number; prev_signing_hash: string; /** Format: int64 */ req_block_height: number; req_signing_hash: string; } | { attestation: { /** @description The hash that was signed */ signing_root: string; /** * Format: int64 * @description The attestation.data.source.epoch of the signed attestation */ source_epoch: number; /** * Format: int64 * @description The attestation.data.target.epoch of the signed attestation */ target_epoch: number; }; key: components["schemas"]["Id"]; material_id?: string | null; /** @enum {string} */ org_event: "Eth2ConcurrentAttestationSigning"; } | { block: { /** @description The hash that was signed */ signing_root: string; /** * Format: int64 * @description The slot number of the block that was signed */ slot: number; }; key: components["schemas"]["Id"]; material_id?: string | null; /** @enum {string} */ org_event: "Eth2ConcurrentBlockSigning"; } | { enforced: boolean; last_signing_root: string; /** Format: int64 */ last_slot: number; /** @enum {string} */ org_event: "Eth2InvalidBlockProposerSlotTooLow"; signing_root: string; /** Format: int64 */ slot: number; } | { enforced: boolean; last_signing_root: string; /** Format: int64 */ last_target_epoch: number; /** @enum {string} */ org_event: "Eth2InvalidAttestationSourceEpochTooLow"; signing_root: string; /** Format: int64 */ source_epoch: number; } | { enforced: boolean; last_signing_root: string; /** Format: int64 */ last_target_epoch: number; /** @enum {string} */ org_event: "Eth2InvalidAttestationTargetEpochTooLow"; signing_root: string; /** Format: int64 */ target_epoch: number; } | { /** Format: int32 */ daily_unstake_count: number; key_id: components["schemas"]["Id"]; /** @enum {string} */ org_event: "Eth2Unstake"; pubkey: string; /** Format: int64 */ validator_index: number; } | { date: unknown; /** Format: int32 */ max: number; /** @enum {string} */ org_event: "Eth2ExceededMaxUnstake"; } | { /** @description Key ids */ key_ids: string[]; key_type: components["schemas"]["KeyType"]; /** @enum {string} */ org_event: "KeyCreated"; owner_id: components["schemas"]["Id"]; } | { approved_with_mfa_type: components["schemas"]["MfaType"]; mfa_request: components["schemas"]["MfaRequestInfo"]; /** @enum {string} */ org_event: "MfaApproved"; } | { mfa_request: components["schemas"]["MfaRequestInfo"]; /** @enum {string} */ org_event: "MfaRejected"; rejected_by: components["schemas"]["Id"]; rejected_mfa_id?: components["schemas"]["Id"] | null; rejected_with_mfa_type: components["schemas"]["MfaType"]; } | { changed_by: components["schemas"]["Id"]; /** @description The new policy */ new_policy: unknown[]; /** @enum {string} */ org_event: "PolicyChanged"; } | { /** @description Chain id */ chain_id: string; /** @description The state of the current request */ current_state: unknown; key_id: components["schemas"]["Id"]; /** @description The state of the last signed message */ last_state: unknown; /** @enum {string} */ org_event: "TendermintConcurrentSigning"; } | { /** @description The email address of the invited user */ email: string; /** @enum {string} */ org_event: "InvitationCreated"; role: components["schemas"]["MemberRole"]; } | { /** @description The email address whose invitation was canceled */ email: string; /** @enum {string} */ org_event: "InvitationCanceled"; } | { key_id: components["schemas"]["Id"]; /** @enum {string} */ org_event: "UserExportInit"; valid_epoch: components["schemas"]["EpochDateTime"]; } | { key_id: components["schemas"]["Id"]; /** @enum {string} */ org_event: "UserExportComplete"; } | { /** @description The error from the policy engine (when response is equal to 'Error') */ error?: string | null; key_id?: components["schemas"]["Id"] | null; /** @enum {string} */ org_event: "WasmPolicyExecuted"; /** @description Policy name or id */ policy: string; /** @description Policy hash */ policy_hash: string; /** @description The reason for the denial (when response is equal to 'Deny') */ reason?: string | null; /** * @description Auto-generated discriminant enum variants * @enum {string} */ response: "Allow" | "Deny" | "Error"; /** * @description The source of a policy execution, i.e. the reason it was executed. * @enum {string} */ source: "SignRequest" | "UserInvocation"; /** @description Policy error output */ stderr: string; /** @description Policy standard output */ stdout: string; }; /** * @description Auto-generated discriminant enum variants * @enum {string} */ OrgEventDiscriminants: | "Billing" | "Response" | "OidcAuth" | "Signed" | "BabylonEotsConcurrentSigning" | "Eth2ConcurrentAttestationSigning" | "Eth2ConcurrentBlockSigning" | "Eth2InvalidBlockProposerSlotTooLow" | "Eth2InvalidAttestationSourceEpochTooLow" | "Eth2InvalidAttestationTargetEpochTooLow" | "Eth2Unstake" | "Eth2ExceededMaxUnstake" | "KeyCreated" | "MfaApproved" | "MfaRejected" | "PolicyChanged" | "TendermintConcurrentSigning" | "InvitationCreated" | "InvitationCanceled" | "UserExportInit" | "UserExportComplete" | "WasmPolicyExecuted"; /** @description Filter for org events */ OrgEventFilter: OneOf< [ "All", { /** @description Accepts all org events other than the ones listed */ AllExcept: components["schemas"]["OrgEventDiscriminants"][]; }, { /** @description Only accepts org events that are one of the listed events */ OneOf: components["schemas"]["OrgEventDiscriminants"][]; }, ] >; /** @description An org-export ciphertext retrieved via the org-export API. */ OrgExportResponse: { /** @description A base64-encoded export ciphertext. */ ciphertext: string; }; OrgInfo: components["schemas"]["MfaRequirements"] & components["schemas"]["CommonFields"] & { access_model: components["schemas"]["AccessModel"]; custom_chains?: components["schemas"]["CustomChainsData"] | null; default_invite_kind?: components["schemas"]["InviteKind"]; email_preferences?: components["schemas"]["EmailPreferences"]; /** @description When false, all cryptographic operations involving keys in this org are disabled. */ enabled: boolean; ext_data?: | ({ /** * Format: int32 * @description Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users. * * This setting is checked only when an alien user requests to create or import a new key. * In other words, org admins can still assign unlimited number of keys to their alien users. */ alien_key_count_threshold?: number | null; /** * @description Whether alien users are allowed to update their own key policies. * Defaults to 'false'. */ aliens_can_update_key_policy?: boolean | null; } & { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & Record) | null; historical_data_configuration?: components["schemas"]["HistoricalDataConfiguration"]; idp_configuration?: components["schemas"]["IdpConfig"]; /** @description Deprecated: this field should be ignored. */ key_import_key?: string | null; /** * @description The organization's universally unique key-wrapping-key identifier. * This value is required when setting up key export. * @example mrk-fce09525e81587d23520f11e07e2e9d9 */ kwk_id: string; /** * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none. * @example TODO */ last_unstake: string; /** * Format: int32 * @description How many 'unstake' calls happened on the day when `last_unstake` was performed. */ last_unstake_day_count: number; /** * @description The human-readable name for the org * @example my_org_name */ name?: string | null; /** * @description The organization's notification endpoints, which are HTTPS URLs are notified about a * configurable set of events in an organization. For each event, CubeSigner sends a POST * request with a JSON-formatted body that contains the event details. * @example [ * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001", * "config": { * "url": "https://example.com/endpoint1" * }, * "status": "Confirmed" * }, * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002", * "config": { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url": "https://example.com/endpoint2" * }, * "status": "Pending" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpoint"][]; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; passkey_configuration?: components["schemas"]["PasskeyConfig"]; /** * @description Org-wide policies that are checked before a key is used for signing * @example [ * { * "MaxDailyUnstake": 5 * } * ] */ policy?: Record[]; policy_engine_configuration?: components["schemas"]["PolicyEngineConfiguration"]; /** * @description Global sign policy that applies to every sign operation (every key, every role) in the org * @example [ * { * "TxReceiver": "0x0000000000000000000000000000000000000000" * } * ] */ sign_policy?: Record[]; /** * Format: int32 * @description The organization's currently configured TOTP failure limit, i.e., the number * of times a user can provide an incorrect TOTP code before being rate limited. * This value can be between 1 and 5 (inclusive). */ totp_failure_limit: number; /** * Format: int64 * @description The organization's currently configured user-export delay, i.e., the minimum * amount of time (in seconds) between when a user-export is initiated and when * it may be completed. (This value is meaningless for organizations that use * org-wide export.) */ user_export_delay: number; /** @description Whether user export is disabled */ user_export_disabled?: boolean; /** * Format: int64 * @description The organization's currently configured user-export window, i.e., the amount * of time (in seconds) between when the user-export delay is completed and when * the user export request has expired and can no longer be completed. (This value * is meaningless for organizations that use org-wide export.) */ user_export_window: number; webapp_enabled?: components["schemas"]["WebappEnabled"]; }; /** @description Supported org metrics. */ OrgMetric: OneOf< [ { BillingEvent: components["schemas"]["BillingDimensions"]; }, { OidcLoginEvent: components["schemas"]["OidcLoginDimensions"]; }, { SignEvent: components["schemas"]["SignDimensions"]; }, { UserCount: components["schemas"]["UserCountDimensions"]; }, { KeyCount: components["schemas"]["KeyCountDimensions"]; }, ] >; OrgMetricData: { /** @description The data points, one for each time period (time periods for which the value is 0 are omitted). */ data: { [key: string]: number; }; /** @description The metric dimensions. */ dimensions: { [key: string]: string; }; }; /** * @description Auto-generated discriminant enum variants * @enum {string} */ OrgMetricDiscriminants: | "BillingEvent" | "OidcLoginEvent" | "SignEvent" | "UserCount" | "KeyCount"; /** * @description Available statistics to compute * @enum {string} */ OrgMetricStat: "Sum" | "Average"; /** @description OS information set in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`] */ OsInfo: { /** @example arm64 */ architecture?: string | null; /** @example Mac OS */ name?: string | null; /** @example 14.5.0 */ version?: string | null; /** @example 64-bit */ word_size?: string | null; }; /** * @description The rocket query parameter representing the page from which to start a paginated query. * * MUST be named `` in rocket url spec so that 'serde(rename = "page.*")' below continues to work */ Page: { /** * Format: int32 * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedAuditLogResponse: { /** @description Audit log entries */ entries: components["schemas"]["AuditLogEntry"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedGetUsersInOrgResponse: { /** @description The list of users in the org */ users: components["schemas"]["UserInOrgInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListBucketsResponse: { /** @description The buckets in the organization. */ buckets: components["schemas"]["BucketInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListContactsResponse: { /** @description A list of contacts in the organization, matching any provided queries. */ contacts: components["schemas"]["ContactInfoResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListHistoricalTxResponse: { /** @description Historical transactions signed with the requested key, sorted from most to least recent. */ txs: components["schemas"]["HistoricalTx"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListInvitationsResponse: { /** @description Pending invitations */ invitations: components["schemas"]["InvitationInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListKeyRolesResponse: { /** @description All roles the key is in */ roles: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListKeysResponse: { keys: components["schemas"]["KeyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListMfaResponse: { /** @description All pending MFA requests */ mfa_requests: components["schemas"]["MfaRequestInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListPoliciesResponse: { /** @description The Org's named policies. */ policies: components["schemas"]["PolicyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRoleKeysResponse: { /** @description All keys in a role */ keys: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRoleUsersResponse: { /** @description All users in a role */ users: components["schemas"]["UserInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedListRolesResponse: { /** @description All roles in an organization. */ roles: components["schemas"]["RoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedPolicyLogsResponse: { /** @description The policy execution logs */ logs: { [key: string]: string; }[]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedQueryMetricsResponse: { /** @description Advisory messages (e.g., if max number of results is reached). */ messages?: string[]; /** * Format: int64 * @description The period for which the statistic is computed, if any (not all metrics support splitting the requested time range into bins). * If set, equals to the value from the request rounded up to the closest multiple of 60. */ period?: number; /** @description Some metrics can optionally return the raw data, when requested. */ raw_data: { [key: string]: string; }[]; /** @description Computed data points. */ results: { /** @description The data points, one for each time period (time periods for which the value is 0 are omitted). */ data: { [key: string]: number; }; /** @description The metric dimensions. */ dimensions: { [key: string]: string; }; }[]; stat?: components["schemas"]["OrgMetricStat"] | null; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedSessionsResponse: { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** * @description Response type that wraps another type and adds base64url-encoded encrypted `last_evaluated_key` * value (which can the user pass back to use as a url query parameter to continue pagination). */ PaginatedUserExportListResponse: { export_requests: components["schemas"]["UserExportInitResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; /** @description Sent from the client to the server to answer a fido challenge */ PasskeyAssertAnswer: { /** @description The ID of the challenge that was returned from the POST endpoint */ challenge_id: string; credential: components["schemas"]["PublicKeyCredential"]; }; PasskeyAssertChallenge: (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; /** @description Org-level passkey configuration */ PasskeyConfig: { /** @description Enable passkey login for certain user roles (disabled for everyone by default) */ users?: components["schemas"]["MemberRole"][]; }; PasswordResetConfirmRequest: { /** @description The new password to set. */ new_password: string; /** * @description Invitation token, constructed by concatenating the "partial token" * (i.e., `{header}.{payload}.`) returned by the `idp_password_reset_request` endpoint * and the signature sent to the user's email. */ token: string; }; /** @description The request body for the idp password reset endpoint */ PasswordResetRequest: { /** * @description The email address of the user requesting to reset their password * @example alice@example.com */ email: string; }; /** @description Extended information about an existing MMI request. */ PendingMessageInfo: { metadata: components["schemas"]["MmiMetadata"]; signedMessage?: components["schemas"]["SignedMessage"] | null; transaction?: components["schemas"]["TransactionAndStatus"] | null; } & { created_at: components["schemas"]["EpochDateTime"]; expires_at: components["schemas"]["EpochDateTime"]; /** @description The ID of the pending message */ id: string; /** @description The identity (a user or a role id) which created this message. */ identity: string; message_eip191?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; /** @description Hex-encoded (including a '0x' prefix) message to sign. */ message: string; } | null; message_eip712?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; data: components["schemas"]["TypedData"]; /** @enum {string} */ version: "v3" | "v4"; } | null; message_tx?: components["schemas"]["TypedTransaction"] | null; }; /** @description Extended information about an existing MMI message, including the signature. */ PendingMessageSignResponse: ({ metadata: components["schemas"]["MmiMetadata"]; signedMessage?: components["schemas"]["SignedMessage"] | null; transaction?: components["schemas"]["TransactionAndStatus"] | null; } & { created_at: components["schemas"]["EpochDateTime"]; expires_at: components["schemas"]["EpochDateTime"]; /** @description The ID of the pending message */ id: string; /** @description The identity (a user or a role id) which created this message. */ identity: string; message_eip191?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; /** @description Hex-encoded (including a '0x' prefix) message to sign. */ message: string; } | null; message_eip712?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; data: components["schemas"]["TypedData"]; /** @enum {string} */ version: "v3" | "v4"; } | null; message_tx?: components["schemas"]["TypedTransaction"] | null; }) & Record; /** @description Different kinds of evidence policy checkers can return to support their decision. */ PermitEvidence: | { /** @enum {string} */ kind: "ExplicitlyPermitted"; /** @description Optional message */ message?: string | null; } | { approvals: { [key: string]: { [key: string]: components["schemas"]["ApprovalInfo"]; }; }; /** @enum {string} */ kind: "MfaApproved"; policy: components["schemas"]["MfaPolicy"]; } | { /** @enum {string} */ kind: "BabylonStaking"; } | { /** @enum {string} */ kind: "BtcReceivers"; /** @description The actual receivers of a Bitcoin transaction */ receivers: string[]; } | { /** @enum {string} */ kind: "BtcValueLimit"; /** * Format: int64 * @description The new total (in SAT), including the current transaction */ new_total: number; /** * Format: int64 * @description The limit (in SAT) specified by the policy */ policy_limit: number; } | { /** * Format: int64 * @description Actual EVM chain */ chain_id: number; /** @enum {string} */ kind: "EvmChainDoesNotApply"; } | { /** @enum {string} */ kind: "EvmTransferOnly"; } | { /** @enum {string} */ kind: "EvmNotErc20"; } | { /** @enum {string} */ kind: "EvmErc20"; } | { /** @description The address of the contract being called */ address?: string | null; /** @description The name of the contract method being called */ function: string; /** @enum {string} */ kind: "EvmContractCall"; } | { /** @description The arguments of the contract method being called */ args: string[][]; /** @description The name of the contract method being called */ function: string; /** @enum {string} */ kind: "EvmAbiConstrainedFunction"; } | { /** @enum {string} */ kind: "EvmGasCostLimit"; /** @description The policy gas cost limit (in WEI) */ policy_gas_cost_limit: string; /** @description The transaction max gas cost (in WEI) */ tx_max_gas_cost: string; } | { /** @enum {string} */ kind: "EvmValueLimit"; /** @description The new total (in WEI), including the current transaction */ new_total: string; /** @description The limit (in WEI) specified by the policy */ policy_limit: string; } | { /** @enum {string} */ kind: "EvmDeposit"; /** @description The details of the deposit transaction */ spec: Record; } | { /** @enum {string} */ kind: "EvmReceiver"; /** @description The actual receiver of an EVM transaction */ receiver?: string | null; } | { /** @description The actual chain id of an EVM transaction or EIP-7702 authorization request */ chain_id: string; /** @enum {string} */ kind: "EvmChainId"; } | { /** @description The contract address EIP-7702 delegates authorization to */ address: string; /** @enum {string} */ kind: "Eip7702DelegationTarget"; } | { /** @enum {string} */ kind: "RoleSession"; /** @description The session identity role */ role_id: string; } | { /** @enum {string} */ kind: "SolanaTx"; } | { /** @description Actual Sui receivers */ actual_receivers: string[]; /** @enum {string} */ kind: "SuiReceivers"; } | (components["schemas"]["SourceIp"] & { /** @enum {string} */ kind: "SourceIpAllowlisted"; }) | { /** @enum {string} */ kind: "CelPolicyMatched"; /** @description The CEL program that was evaluated */ program: string; } | { /** @enum {string} */ kind: "OperationAllowlisted"; operation: components["schemas"]["OperationKind"]; } | { /** @enum {string} */ kind: "TaprootValueLimit"; /** * Format: int64 * @description The limit (in SAT) specified by the policy */ policy_limit: number; /** * Format: int64 * @description The transaction value (in SAT) */ transaction_value: number; } | { /** @description The size (in bytes) of the full stderr */ full_stderr_length: number; /** @description The size (in bytes) of the full stdout */ full_stdout_length: number; /** @enum {string} */ kind: "WasmResult"; /** @description Standard error of the wasm policy execution, truncated to 1024 bytes */ stderr: string; /** @description Standard output of the wasm policy execution, truncated to 1024 bytes */ stdout: string; } | (components["schemas"]["CallWebhookResult"] & { /** @enum {string} */ kind: "WebhookResult"; }) | { current_time: components["schemas"]["EpochDateTime"]; /** @enum {string} */ kind: "TimeLockExpired"; lock_until: components["schemas"]["EpochDateTime"]; }; /** * @description The access-controlled actions that can be performed on a named policy. * @enum {string} */ PolicyAction: | "read:*" | "read" | "read:policy" | "read:logs" | "update:*" | "update" | "update:name" | "update:rules" | "update:metadata" | "update:editPolicy" | "update:owner" | "update:acl" | "delete" | "attach" | "sign" | "invoke"; /** * @description MFA policy provenance * @enum {string} */ PolicyAttachedTo: "Org" | "Key" | "KeyInRole" | "Role" | "User" | "EditPolicy"; /** @description The id for attaching a named policy to a key, role, or key in role. */ PolicyAttachedToId: OneOf< [ { /** * @description The id of the key in the role the policy should be attached to. * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; /** * @description The id of the role the key is in. * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }, { /** * @description The id of the key the policy should be attached to. * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; }, { /** * @description The id of the role the policy should be attached to. * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }, { /** * @description The id of the org the policy should be attached to. * @example Org#b0156abd-53bd-4043-8e55-57f7af9512d5 */ org_id: string; }, ] >; /** @description A struct containing Org-level configurations for the workings of the Policy Engine. */ PolicyEngineConfiguration: { /** * @description Allowed domains for HTTP requests * @example [ * "cubist.dev:443" * ] */ allowed_http_authorities: string[]; /** @description The maximum number of policy secrets for the Org. */ org_secrets_limit?: number | null; }; PolicyErrorCode: | components["schemas"]["PolicyErrorOwnCodes"] | components["schemas"]["EvmTxDepositErrorCode"]; /** @enum {string} */ PolicyErrorOwnCodes: | "MfaHttpRequestMismatch" | "MfaExpired" | "Inapplicable" | "SuiTxReceiversDisallowedTransactionKind" | "SuiTxReceiversDisallowedTransferAddress" | "SuiTxReceiversDisallowedCommand" | "BtcTxDisallowedOutputs" | "BtcSignatureExceededValue" | "BtcValueOverflow" | "BtcSighashTypeDisallowed" | "Eip7702AddressMismatch" | "EvmTxReceiverMismatch" | "EvmTxChainIdMismatch" | "EvmTxSenderMismatch" | "EvmTxExceededValue" | "EvmTxExceededGasCost" | "EvmTxGasCostUndefined" | "EvmDataDisallowed" | "Erc20DataInvalid" | "EvmContractAddressUndefined" | "EvmContractChainIdUndefined" | "EvmDataNotDefined" | "EvmDataInvalid" | "EvmContractNotInAllowlist" | "Erc20ExceededTransferLimit" | "Erc20ReceiverMismatch" | "Erc20ExceededApproveLimit" | "Erc20SpenderMismatch" | "EvmFunctionNotInAllowlist" | "EvmFunctionCallInvalid" | "EvmFunctionCallDisallowedArg" | "PolicyDisjunctionError" | "PolicyNegationError" | "Eth2ExceededMaxUnstake" | "Eth2ConcurrentUnstaking" | "NotInIpv4Allowlist" | "NotInOriginAllowlist" | "NotInOperationAllowlist" | "InvalidSourceIp" | "RawSigningNotAllowed" | "DiffieHellmanExchangeNotAllowed" | "Eip712SigningNotAllowed" | "OidcSourceNotAllowed" | "NoOidcAuthSourcesDefined" | "AddKeyToRoleDisallowed" | "KeysAlreadyInRole" | "KeyInMultipleRoles" | "KeyAccessError" | "RequireRoleSessionKeyAccessError" | "BtcMessageSigningNotAllowed" | "Eip191SigningNotAllowed" | "Eip7702SigningNotAllowed" | "TaprootSigningDisallowed" | "SegwitSigningDisallowed" | "PsbtSigningDisallowed" | "BabylonStakingDisallowed" | "TimeLocked" | "CelPolicyDenied" | "BabylonStakingNetwork" | "BabylonStakingParamsVersion" | "BabylonStakingExplicitParams" | "BabylonStakingStakerPk" | "BabylonStakingFinalityProviderPk" | "BabylonStakingLockTime" | "BabylonStakingValue" | "BabylonStakingChangeAddress" | "BabylonStakingFee" | "BabylonStakingWithdrawalAddress" | "BabylonStakingBbnAddress" | "SolanaInstructionCountLow" | "SolanaInstructionCountHigh" | "SolanaNotInInstructionAllowlist" | "SolanaInstructionMismatch" | "WasmPoliciesDisabled" | "WasmPolicyDenied" | "WasmPolicyFailed" | "WebhookPoliciesDisabled" | "DeniedByWebhook" | "MfaApprovalsNotYetValid" | "ExplicitlyDenied"; /** @description Evaluation tree for a policy rule. */ PolicyEvalTree: | { Leaf: components["schemas"]["LeafProps"]; } | { /** @description Evaluation of a negation (i.e., [Deny::Not]) */ Not: { child: components["schemas"]["PolicyEvalTree"]; outcome: components["schemas"]["EvalOutcome"]; }; } | { /** @description Evaluation of a [Deny::IfThenElse] policy */ IfThenElse: { /** @description Evaluated conditionals */ children: components["schemas"]["Conditional"][]; else?: components["schemas"]["PolicyEvalTree"] | null; outcome: components["schemas"]["EvalOutcome"]; }; } | { /** @description Evaluation of a list of policy rules */ Concat: { /** @description Evaluation trees of each evaluated policy */ children: components["schemas"]["PolicyEvalTree"][]; outcome: components["schemas"]["EvalOutcome"]; }; } | { /** @description Evaluation of a conjunction (i.e., [Deny::And]). */ And: { /** @description Evaluation trees of each evaluated conjunct */ children: components["schemas"]["PolicyEvalTree"][]; outcome: components["schemas"]["EvalOutcome"]; }; } | { /** @description Evaluation of a disjunction (i.e., [Deny::Or]). */ Or: { /** @description Evaluation trees of each evaluated disjunct */ children: components["schemas"]["PolicyEvalTree"][]; outcome: components["schemas"]["EvalOutcome"]; }; }; /** @description A struct containing all the information about a specific version of a policy. */ PolicyInfo: { /** @description The access-control entries for the policy. */ acl?: unknown[] | null; /** @description A list of entities (keys, roles, etc.) the policy is attached to. */ attached_to: components["schemas"]["PolicyAttachedToId"][]; created: components["schemas"]["EpochDateTime"]; edit_policy?: components["schemas"]["EditPolicy"]; /** @description User-defined metadata for the named policy. */ metadata?: unknown; /** @description The name of the policy. */ name: string; owner: components["schemas"]["Id"]; /** @description The policy id */ policy_id: string; policy_type: components["schemas"]["PolicyType"]; /** @description The policy rule. */ rules: unknown[]; /** * Format: int64 * @description The policy rule's version. */ version: number; }; /** @description A request for querying Wasm policy logs. */ PolicyLogsRequest: { /** * Format: int64 * @description End time in seconds since unix epoch. If omitted, defaults to 'now'. */ end_time?: number | null; /** * Format: int64 * @description Start time in seconds since unix epoch. If omitted, defaults to 24 hours ago. */ start_time?: number | null; /** * @description The version of the policy to get the logs for. * If omitted, all policy logs are retrieved. */ version?: string | null; }; /** * @description PolicyResultResponse is a wrapper on PolicyResult with two important * properties: * * derives OkToLogResponse, so that it can be used in the rocket handler. * * derives ToSchema and ToResponse, with the `val` field with value_type * Object, so that we don't have to provide all of the OpenAPI type * descriptions of a PolicyResult. * * The PolicyResult includes enums and other standard types (e.g. * std::time::Interval) which are nontrivial to represent in OpenAPI. Since * this endpoint is just for testing, we don't really care about how accurate * the schema is, and can lean on serde_json when decoding this response to a * PolicyResult in a client. Note that there is a bug in utoipa where the * value_type annotation will not work for a tuple-struct, only a struct with * fields. */ PolicyResultResponse: { val: Record; }; /** @description A struct containing all non-secret information about policy secrets. */ PolicySecretsInfo: components["schemas"]["CommonFields"] & { /** * @deprecated * @description The names of the secrets. */ names: string[]; /** @description The policy secrets. */ secrets: components["schemas"]["SecretInfo"][]; }; /** * @description The type of a [NamedPolicy]. * * The type of a policy is set at creation time, and is used to offer guarantees * about the current and all future versions of a [NamedPolicy]. * @enum {string} */ PolicyType: "Key" | "Role" | "Wasm"; PreconditionErrorCode: | components["schemas"]["PreconditionErrorOwnCodes"] | components["schemas"]["PolicyErrorCode"]; /** @enum {string} */ PreconditionErrorOwnCodes: | "FailOnMfaRequired" | "KeyRegionLocked" | "KeyRegionChangedRecently" | "MfaRegionLocked" | "Eth2ProposerSlotTooLow" | "Eth2AttestationSourceEpochTooLow" | "Eth2AttestationTargetEpochTooLow" | "Eth2ConcurrentBlockSigning" | "Eth2ConcurrentAttestationSigning" | "Eth2MultiDepositToNonGeneratedKey" | "Eth2MultiDepositUnknownInitialDeposit" | "Eth2MultiDepositWithdrawalAddressMismatch" | "ConcurrentSigningWhenTimeLimitPolicyIsDefined" | "BabylonEotsConcurrentSigning" | "TendermintStateError" | "TendermintConcurrentSigning"; /** @description Contains outputs of previous transactions. */ PrevOutputs: OneOf< [ { /** * @description `One` variant allows provision of the single previous output needed. It's useful, * for example, when modifier `SIGHASH_ANYONECANPAY` is provided, only previous output * of the current input is needed. The first `index` argument is the input index * this output is referring to. */ One: { index: number; tx_out: components["schemas"]["BtcTxOut"]; }; }, { /** * @description When `SIGHASH_ANYONECANPAY` is not provided, or when the caller is giving all * previous outputs so the same variable can be used for multiple inputs. */ All: components["schemas"]["BtcTxOut"][]; }, ] >; /** @description A request to sign a PSBT */ PsbtSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description A hex-serialized PSBT (version 0), with or without leading 0x prefix. * This PSBT must contain the transaction inputs and outputs, plus all * information needed to sign (e.g., taproot path and leaf information). */ psbt: string; /** * @description When true, unconditionally sign every input to the PSBT controlled by a script * spend. Otherwise (false, the default), this endpoint uses a heuristic to decide * whether the script controlling a given UTXO requires a signature from this key. */ sign_all_scripts?: boolean; }; /** @description Response to a PSBT signing request */ PsbtSignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The PSBT in standard hex serialization, without leading "0x". * @example 70736274ff01005e... */ psbt: string; }; /** * @description This type represents a wire-encodable form of the PublicKeyCredential interface * Clients may need to manually encode into this format to communicate with the server * * The PublicKeyCredential interface inherits from Credential * [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to * the caller when a new credential is created, or a new assertion is * requested. * * https://www.w3.org/TR/webauthn-2/#iface-pkcredential */ PublicKeyCredential: { /** * @description This internal slot contains the results of processing client extensions * requested by the Relying Party upon the Relying Party's invocation of * either navigator.credentials.create() or navigator.credentials.get(). * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-clientextensionsresults-slot * * IMPLEMENTATION NOTE: The type for this field comes from the type of getClientExtensionResults() which as the following doc: * * This operation returns the value of [[clientExtensionsResults]], which is a map containing extension identifier → client extension output entries produced by the extension’s client extension processing. * https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredential-getclientextensionresults */ clientExtensionResults?: Record | null; /** * @description This internal slot contains the credential ID, chosen by the * authenticator. The credential ID is used to look up credentials for use, * and is therefore expected to be globally unique with high probability * across all credentials of the same type, across all authenticators. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredential-identifier-slot */ id: string; /** @description Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse interface */ response: | components["schemas"]["AuthenticatorAttestationResponse"] | components["schemas"]["AuthenticatorAssertionResponse"]; }; /** * @description Defines the parameters for the creation of a new public key credential * * https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialcreationoptions */ PublicKeyCredentialCreationOptions: { attestation?: components["schemas"]["AttestationConveyancePreference"]; authenticatorSelection?: components["schemas"]["AuthenticatorSelectionCriteria"] | null; /** * @description This member contains a challenge intended to be used for generating the * newly created credential’s attestation object. See the § 13.4.3 * Cryptographic Challenges security consideration. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-challenge */ challenge: string; /** * @description This member is intended for use by Relying Parties that wish to limit * the creation of multiple credentials for the same account on a single * authenticator. The client is requested to return an error if the new * credential would be created on an authenticator that also contains one * of the credentials enumerated in this parameter. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-excludecredentials */ excludeCredentials?: components["schemas"]["PublicKeyCredentialDescriptor"][]; /** * @description This member contains additional parameters requesting additional * processing by the client and authenticator. For example, the caller may * request that only authenticators with certain capabilities be used to * create the credential, or that particular information be returned in the * attestation object. Some extensions are defined in § 9 WebAuthn * Extensions; consult the IANA "WebAuthn Extension Identifiers" registry * [IANA-WebAuthn-Registries] established by [RFC8809] for an up-to-date * list of registered WebAuthn Extensions. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-extensions */ extensions?: Record | null; /** * @description This member contains information about the desired properties of the * credential to be created. The sequence is ordered from most preferred to * least preferred. The client makes a best-effort to create the most * preferred credential that it can. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-pubkeycredparams */ pubKeyCredParams: components["schemas"]["PublicKeyCredentialParameters"][]; rp: components["schemas"]["PublicKeyCredentialRpEntity"]; /** * Format: int32 * @description This member specifies a time, in milliseconds, that the caller is * willing to wait for the call to complete. This is treated as a hint, and * MAY be overridden by the client. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-timeout */ timeout?: number | null; user: components["schemas"]["PublicKeyCredentialUserEntity"]; }; /** * @description This dictionary contains the attributes that are specified by a caller when * referring to a public key credential as an input parameter to the create() * or get() methods. It mirrors the fields of the PublicKeyCredential object * returned by the latter methods. * * https://www.w3.org/TR/webauthn-2/#dictionary-credential-descriptor */ PublicKeyCredentialDescriptor: { /** * @description This member contains the credential ID of the public key credential the caller is referring to. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialdescriptor-id */ id: string; /** * @description This OPTIONAL member contains a hint as to how the client might * communicate with the managing authenticator of the public key credential * the caller is referring to. The values SHOULD be members of * AuthenticatorTransport but client platforms MUST ignore unknown values. * * The getTransports() operation can provide suitable values for this * member. When registering a new credential, the Relying Party SHOULD * store the value returned from getTransports(). When creating a * PublicKeyCredentialDescriptor for that credential, the Relying Party * SHOULD retrieve that stored value and set it as the value of the * transports member. */ transports?: components["schemas"]["AuthenticatorTransport"][] | null; type: components["schemas"]["PublicKeyCredentialType"]; }; /** * @description This dictionary is used to supply additional parameters when creating a new * credential. * * https://www.w3.org/TR/webauthn-2/#dictionary-credential-params */ PublicKeyCredentialParameters: { /** * Format: int64 * @description This member specifies the cryptographic signature algorithm with which * the newly generated credential will be used, and thus also the type of * asymmetric key pair to be generated, e.g., RSA or Elliptic Curve. */ alg: number; type: components["schemas"]["PublicKeyCredentialType"]; }; /** * @description The `PublicKeyCredentialRequestOptions` dictionary supplies get() with the * data it needs to generate an assertion. Its challenge member MUST be * present, while its other members are OPTIONAL. * * This struct is also used as part of the verification procedure for assertions */ PublicKeyCredentialRequestOptions: { /** * @description This OPTIONAL member contains a list of PublicKeyCredentialDescriptor * objects representing public key credentials acceptable to the caller, in * descending order of the caller’s preference (the first item in the list * is the most preferred credential, and so on down the list). * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-allowcredentials */ allowCredentials?: components["schemas"]["PublicKeyCredentialDescriptor"][]; /** * @description This member represents a challenge that the selected authenticator * signs, along with other data, when producing an authentication * assertion. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-challenge */ challenge: string; extensions?: Record | null; /** * @description This OPTIONAL member specifies the relying party identifier claimed by * the caller. If omitted, its value will be the CredentialsContainer * object’s relevant settings object's origin's effective domain. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-rpid */ rpId?: string | null; /** * Format: int32 * @description This OPTIONAL member specifies a time, in milliseconds, that the caller * is willing to wait for the call to complete. The value is treated as a * hint, and MAY be overridden by the client. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-timeout */ timeout?: number | null; userVerification?: components["schemas"]["UserVerificationRequirement"]; }; /** * @description The PublicKeyCredentialRpEntity dictionary is used to supply additional * Relying Party attributes when creating a new credential. * * https://www.w3.org/TR/webauthn-2/#dictionary-rp-credential-params */ PublicKeyCredentialRpEntity: { /** * @description A unique identifier for the Relying Party entity, which sets the RP ID. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrpentity-id */ id?: string | null; /** * @description A human-palatable name for the entity. Its function depends on what the * PublicKeyCredentialEntity represents: When inherited by * PublicKeyCredentialRpEntity it is a human-palatable identifier for the * Relying Party, intended only for display. For example, "ACME * Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех". * * Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3 * of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], when setting name's value, or displaying the value to the * user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. */ name: string; }; /** * @description This enumeration defines the valid credential types. It is an extension * point; values can be added to it in the future, as more credential types are * defined. The values of this enumeration are used for versioning the * Authentication Assertion and attestation structures according to the type of * the authenticator. Currently one credential type is defined, namely * "public-key". * * https://www.w3.org/TR/webauthn-2/#enumdef-publickeycredentialtype * @enum {string} */ PublicKeyCredentialType: "public-key"; /** * @description The PublicKeyCredentialUserEntity dictionary is used to supply additional * user account attributes when creating a new credential. */ PublicKeyCredentialUserEntity: { /** * @description A human-palatable name for the user account, intended only for display. * For example, "Alex Müller" or "田中倫". The Relying Party SHOULD let the * user choose this, and SHOULD NOT restrict the choice more than * necessary. * * Relying Parties SHOULD perform enforcement, as prescribed in Section 2.3 * of [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], when setting displayName's value, or displaying the value to * the user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. * * Clients SHOULD perform enforcement, as prescribed in Section 2.3 of * [RFC8266] for the Nickname Profile of the PRECIS FreeformClass * [RFC8264], on displayName's value prior to displaying the value to the * user or including the value as a parameter of the * authenticatorMakeCredential operation. * * When clients, client platforms, or authenticators display a * displayName's value, they should always use UI elements to provide a * clear boundary around the displayed value, and not allow overflow into * other elements [css-overflow-3]. * * Authenticators MUST accept and store a 64-byte minimum length for a * displayName member’s value. Authenticators MAY truncate a displayName * member’s value so that it fits within 64 bytes. See § 6.4.1 String * Truncation about truncation and other considerations. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-displayname */ displayName: string; /** * @description The user handle of the user account entity. A user handle is an opaque * byte sequence with a maximum size of 64 bytes, and is not meant to be * displayed to the user. * * To ensure secure operation, authentication and authorization decisions * MUST be made on the basis of this id member, not the displayName nor * name members. See Section 6.1 of [RFC8266]. * * The user handle MUST NOT contain personally identifying information * about the user, such as a username or e-mail address; see § 14.6.1 User * Handle Contents for details. The user handle MUST NOT be empty, though * it MAY be null. * * Note: the user handle ought not be a constant value across different * accounts, even for non-discoverable credentials, because some * authenticators always create discoverable credentials. Thus a constant * user handle would prevent a user from using such an authenticator with * more than one account at the Relying Party. * * https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-id */ id: string; /** * @description When inherited by PublicKeyCredentialUserEntity, it is a human-palatable * identifier for a user account. It is intended only for display, i.e., * aiding the user in determining the difference between user accounts with * similar displayNames. For example, "alexm", "alex.mueller@example.com" * or "+14255551234". * * The Relying Party MAY let the user choose this value. The Relying Party * SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265] * for the UsernameCasePreserved Profile of the PRECIS IdentifierClass * [RFC8264], when setting name's value, or displaying the value to the * user. * * This string MAY contain language and direction metadata. Relying Parties * SHOULD consider providing this information. See § 6.4.2 Language and * Direction Encoding about how this metadata is encoded. * * Clients SHOULD perform enforcement, as prescribed in Section 3.4.3 of [RFC8265] for the UsernameCasePreserved Profile of the PRECIS IdentifierClass [RFC8264], on name's value prior to displaying the value to the user or including the value as a parameter of the authenticatorMakeCredential operation. */ name: string; }; /** @description Public information about an organization. */ PublicOrgInfo: { /** @description Explicitly configured (allowlisted) OpenID providers for an org */ oidc_issuers: { /** @description Intended audiences (client IDs) */ audiences: string[]; /** @description Issuer URL */ issuer: string; /** @description Optional issuer nickname */ nickname?: string | null; /** @description The user roles allowed to use this IDP */ users: components["schemas"]["MemberRole"][]; }[]; /** * @description Org identifier * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Whether logging in with just a passkey is allowed */ passkey_login_enabled: boolean; }; /** @enum {string} */ Purpose: | "otp" | "mfa_reset" | "otp_mfa" | "alien_password_reset" | "member_password_reset" | "alien_invite" | "member_invite" | "welcome"; /** @description The request type for querying metrics. */ QueryMetricsRequest: { /** * Format: int64 * @description End time in seconds since unix epoch. If omitted, defaults to 'now'. */ end_time?: number | null; /** * Format: int64 * @description The granularity, in seconds, of the returned data points. * * This value is automatically rounded up to a multiple of 3600 (i.e., 1 hour). * If omitted, defaults to the duration between `end_time` and `start_time`. * Must be no less than 1 hour (3600 seconds) for "event" metrics, and 1 day * (86400 seconds) for "count" metrics. Also, this period must not * divide the `end_time - start_time` period into more than 100 data points. */ period?: number | null; /** * @description Return the raw data instead of computing the metric values * (not supported by all metrics). */ raw_data?: boolean; /** * Format: int64 * @description Start time in seconds since unix epoch. */ start_time: number; } & { metric_name: components["schemas"]["MetricName"]; }; /** @description The metric data points. */ QueryMetricsResponse: { /** @description Advisory messages (e.g., if max number of results is reached). */ messages?: string[]; /** * Format: int64 * @description The period for which the statistic is computed, if any (not all metrics support splitting the requested time range into bins). * If set, equals to the value from the request rounded up to the closest multiple of 60. */ period?: number; /** @description Some metrics can optionally return the raw data, when requested. */ raw_data: { [key: string]: string; }[]; /** @description Computed data points. */ results: { /** @description The data points, one for each time period (time periods for which the value is 0 are omitted). */ data: { [key: string]: number; }; /** @description The metric dimensions. */ dimensions: { [key: string]: string; }; }[]; stat?: components["schemas"]["OrgMetricStat"] | null; }; RatchetConfig: { /** * Format: int64 * @description The lifetime (in seconds) of auth tokens for this session. * Auth tokens can be refreshed (renewed) using a valid (unexpired) * refresh token, but not beyond the session lifetime. * @default 300 * @example 3600 */ auth_lifetime?: number; /** * Format: int64 * @description The amount of time (in seconds) that an auth token for this session remains * valid after it has been refreshed and a new auth token has been issued. This * helps to address concurrency hazards, for example, if one thread makes requests * with auth token while another refreshes it. * @default 30 * @example 30 */ grace_lifetime?: number; /** * Format: int64 * @description The lifetime (in seconds) of refresh tokens for this session. * If this value is shorter than the session lifetime, inactive sessions * will become invalid once the auth and refresh tokens have both expired. * @default 86400 * @example 43200 */ refresh_lifetime?: number; /** * Format: int64 * @description The lifetime (in seconds) of the session. * The session cannot be extended beyond its original lifetime. * @default 31536000 * @example 86400 */ session_lifetime?: number; }; /** @description Receipt that an MFA request was approved. */ Receipt: { /** * @description Confirmation code the user needs to present when resuming the original request. * @example ba1d75dd-d999-4c1b-944d-25c25440c8af */ confirmation: string; /** @description The ID of the logged-in user whose action created this approval. */ final_approver: string; timestamp: components["schemas"]["EpochDateTime"]; }; /** @enum {string} */ RefreshGrantType: "refresh_token"; /** @description JSON-RPC request object */ Request: { /** @description Request ID */ id?: unknown; /** @description JSON-RPC version. */ jsonrpc: string; /** @description Name of the method to be invoked. */ method: string; /** @description Parameter values of the request. */ params?: unknown; }; /** * @description An extended form of `PublicKeyCredentialRequestOptions` that allows clients to derive the WebAuthn challenge * from a structured preimage. * * This ensures that the webuathn signature can only be used for a specific purpose */ RequestOptionsWithHash: components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }; /** * @description This enumeration’s values describe the Relying Party's requirements for * client-side discoverable credentials (formerly known as resident credentials * or resident keys): * * https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement * @enum {string} */ ResidentKeyRequirement: "discouraged" | "preferred" | "required"; /** @description JSON-RPC response object */ Response: { error?: components["schemas"]["ErrorObj"] | null; /** @description ID from the corresponding request */ id?: unknown; /** @description Constant "2.0" */ jsonrpc: string; /** @description Result, if success */ result?: Record | null; }; /** @description A map of actions to sets of membership roles */ RestrictedActionsMap: { [key: string]: components["schemas"]["MemberRole"][]; }; /** @description Parameters for the [`cs_transactionRetry`](RpcMethod::RetryTransaction) method. */ RetryTransactionRequest: components["schemas"]["EvmTxCustomization"] & { /** @description The transaction id. */ id: string; }; /** * @description List of role actions that can be restricted to a set of member roles * @enum {string} */ RoleAction: "CreateToken" | "GetKey"; RoleAttestationClaims: { exp: components["schemas"]["EpochDateTime"]; iat: components["schemas"]["EpochDateTime"]; query: components["schemas"]["RoleAttestationQuery"]; role_info: components["schemas"]["RoleInfo"]; /** @description The information about the keys currently in this role. */ role_keys?: components["schemas"]["KeyInRoleInfo"][] | null; /** @description The IDs of the users who are currently in this role. */ role_users: string[]; }; RoleAttestationQuery: { key_filter?: components["schemas"]["Id"] | null; verbosity?: components["schemas"]["RoleAttestationVerbosity"]; }; /** * @description Specifies which role properties to include in an attestation * @enum {string} */ RoleAttestationVerbosity: "Summary" | "WithKeys" | "Full"; RoleInfo: components["schemas"]["CommonFields"] & { /** * @description Whether the role is enabled * @example true */ enabled: boolean; /** @description Deprecated. The CubeSigner IDs of at most 100 keys associated with this role. */ keys?: components["schemas"]["KeyInRoleInfo"][] | null; /** * @description Whether the current user is a member of the role. This is always true, * except for owners who can see roles they are not members of. */ member: boolean; /** * @description The human-readable name for the role (must be alphanumeric) * @example my_role */ name?: string | null; /** * @description Policy that is checked whenever a key is accessed for signing via this role. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * }, * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: Record[]; restricted_actions: components["schemas"]["RestrictedActionsMap"]; /** * @description The ID of the role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; /** @description Deprecated. The list of at most 100 users with access to the role. */ users?: string[] | null; }; /** @description Response returned when requesting a role attestation. */ RoleInfoJwt: { /** @description A JSON Web Token whose claims contain the `RoleInfo` structure. */ jwt: string; }; RpcApiErrorCode: | components["schemas"]["RpcApiErrorOwnCodes"] | components["schemas"]["SignerClientErrorCode"] | components["schemas"]["RpcEvmErrorCode"]; /** @enum {string} */ RpcApiErrorOwnCodes: "MfaRequired" | "ConcurrentTransactionFailed" | "InvalidTxStatus"; /** @enum {string} */ RpcEvmErrorCode: "SubmissionFailed" | "FailedToReserveNonce" | "MissingTxField" | "Signer"; /** * @description The RPC API method and matching parameters. * * Top-level dispatch. Wire format is preserved by `#[serde(untagged)]`: each * inbound request is matched against one of the internally-tagged inner enums * ([`CsRpc`] for the core methods, [`BinanceRpc`] for the Binance family, * [`BybitRpc`] for the Bybit family, [`CoinbaseRpc`] for the Coinbase family). */ RpcMethod: | components["schemas"]["CsRpc"] | components["schemas"]["BinanceRpc"] | components["schemas"]["BybitRpc"] | components["schemas"]["CoinbaseRpc"]; /** @description A transaction created by the RPC API. */ RpcTransaction: { status: "RpcTransaction"; } & Omit & Omit & components["schemas"]["VersioningFields"] & { /** @description The session identity that created the transaction. */ owner: string; }; /** @description Information about an existing transaction created by the RPC API. */ RpcTransactionInfo: components["schemas"]["RpcTransaction"] & { /** @description The transaction id. */ id: string; }; /** @description The status of the transaction. */ RpcTxStatus: | { mfa_ids: string[]; /** @enum {string} */ status: "MfaRequired"; } | { /** @enum {string} */ status: "Signed"; } | { /** @enum {string} */ status: "Submitted"; } | { /** @enum {string} */ status: "Canceled"; } | { error: components["schemas"]["ErrorObj"]; /** @enum {string} */ status: "Failed"; }; /** @description All scopes for accessing CubeSigner APIs */ Scope: components["schemas"]["ExplicitScope"] | string; /** @description A set of scopes. */ ScopeSet: OneOf< [ "All", { /** @description All scopes except these (including those transitively implied). */ AllExcept: components["schemas"]["Scope"][]; }, { /** @description All of these scopes (including those transitively implied). */ AllOf: components["schemas"]["Scope"][]; }, ] >; /** * @description Represents the number of MFA approvals required for a given operation * (e.g. login). Can be used to produce a concrete policy for a given user * @enum {string} */ SecondFactorRequirement: "none" | "if_registered" | "required"; /** * Format: int64 * @description Duration measured in seconds * A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds. */ Seconds: number; /** * SecretAction * @description The access-controlled actions that can be performed on an individual policy secret. * @example read:secret * @enum {string} */ SecretAction: | "read:*" | "read:info" | "read:secret" | "update:*" | "update:secret" | "update:acl" | "delete"; /** @description Information about a specific secret. */ SecretInfo: { /** @description The access-control entries for this secret. */ acl?: unknown[] | null; /** @description The name of the secret. */ name: string; provenance: components["schemas"]["SecretProvenance"]; }; /** * @description Where a policy secret's value came from. * @enum {string} */ SecretProvenance: "Imported" | "Generated"; /** @description The value of a policy secret. */ SecretValue: OneOf< [ string, { /** * @description The client's ephemeral public key used to derive a shared key. * This is a base64-encoded, SEC1-encoded P384 public key. */ client_public_key: string; /** * @description The encrypted secret value. * This is a base64-encoded ciphertext. */ encrypted_value: string; /** * @description A salt value used to derive a shared key for AES-GCM. * This is a base64-encoded byte string. */ salt: string; }, { /** * @description The number of random bytes to generate. * The secret value is the base64 encoding of those bytes, so it is * `4 * ceil(generate_random_bytes / 3)` characters long. * * Must be between 1 and * [MAX_RANDOM_SECRET_BYTES](secrets::MAX_RANDOM_SECRET_BYTES). */ generate_random_bytes: number; }, ] >; SessionInfo: components["schemas"]["SessionMetadata"] & { /** * Format: int64 * @description Creation date (in seconds since unix epoch) */ created_at: number; /** * Format: int64 * @description Expiration date (in seconds since unix epoch) */ exp: number; last_used?: components["schemas"]["WhereAndWhen"] | null; lifetimes?: components["schemas"]["RatchetConfig"]; /** * @description A human-readable description for the session * @example OIDC login session */ purpose: string; /** * @description Lists user permission and access for the session * @example [ * "sign:*", * "manage:mfa:vote:cs" * ] */ scopes?: components["schemas"]["Scope"][]; /** * @description Session ID. Uniquely identifies the session, but cannot be used for auth. * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; /** * @description Collection of attributes related to a Session. * This is the backend variant of [`ClientSessionMetadata`] and works in tandem with its frontend counterpart. */ SessionMetadata: { client?: components["schemas"]["ClientProfile"]; /** * @description The id of the user who created the session. * @example User#ef4136dd-d22f-45bc-a65c-12b4baa729d4 */ created_by?: string; /** @description OS String for backwards compatibility, see os_info instead. */ os?: string | null; os_info?: components["schemas"]["OsInfo"]; source_ip?: components["schemas"]["SourceIp"]; /** * @description User agent that created the session. * @example Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0 */ user_agent?: string | null; }; /** @description The response from any operation operating on multiple sessions */ SessionsResponse: { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; }; /** * @description A request for setting an Org-level policy secret. * * Either `value` or `acl` must be provided. */ SetPolicySecretRequest: { /** * @description The secret's access-control entries. * Can be `None` if the request is creating a secret without ACL or updating an * existing secret's value. */ acl?: unknown; import_key?: components["schemas"]["KeyImportKey"] | null; value?: components["schemas"]["SecretValue"] | null; }; SignDimensions: { /** @description The sign operation */ operation: string; /** @description All metrics must include 'org_id' as a dimension. */ org_id: string; }; SignDryRunArgs: { /** @description Whether MFA is required */ mfa_requests: components["schemas"]["MfaRequestInfo"][]; /** @description Optional policy evaluation tree, if requested */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; }; /** * @description The structured input to a Sign-In With Solana request (`SolanaSignInInput` in the spec). * * The relying party fills in `domain`/`address`/`uri`/... and the wallet renders it into the * human-readable message (see [SignInInput::to_message_text]) that it signs. */ SignInInput: { /** @description The base58-encoded Solana (ed25519) public key performing the sign-in. */ address: string; chainId?: components["schemas"]["SolanaNetwork"] | null; /** @description The RFC 3986 authority that is requesting the sign-in. */ domain: string; /** @description The ISO 8601 datetime string after which the signed message is no longer valid. */ expirationTime?: string | null; /** @description The ISO 8601 datetime string of the time the message was issued. */ issuedAt?: string | null; /** @description A randomized token used to prevent replay attacks; at least 8 alphanumeric characters. */ nonce?: string | null; /** @description The ISO 8601 datetime string before which the signed message is not yet valid. */ notBefore?: string | null; /** @description A system-specific identifier that may be used to uniquely refer to the sign-in request. */ requestId?: string | null; /** @description A list of RFC 3986 URIs the user wishes to have resolved as part of the authentication. */ resources?: string[] | null; /** @description A human-readable ASCII assertion that the user will sign; must not contain a newline. */ statement?: string | null; /** @description An RFC 3986 URI referring to the resource that is the subject of the sign-in. */ uri?: string | null; /** @description The version of the message (currently always `1`). */ version?: string | null; }; SignResponse: { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** @description The hex-encoded resulting signature. */ signature: string; }; /** @enum {string} */ SignatureVersion: "eip_712_v3" | "eip_712_v4" | "personal_sign"; SignedMessage: { /** * @description The address of the signer, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; /** @description The ID of the request record. */ id: string; /** @description The signature, hex encoded, with leading '0x' */ signature?: string | null; signatureVersion: components["schemas"]["SignatureVersion"]; status: components["schemas"]["MmiStatus"]; }; SignerClientErrorCode: | components["schemas"]["SignerClientErrorOwnCodes"] | components["schemas"]["SignerClientInternalErrorCode"]; /** @enum {string} */ SignerClientErrorOwnCodes: "SignerResponseError" | "LegacySessionNotSupported"; /** @enum {string} */ SignerClientInternalErrorCode: | "InvalidSignerEnvironment" | "InvalidSessionHeaders" | "InvalidHeader" | "LambdaInvokeError" | "LambdaResponseError" | "LambdaProxyInvalidResponse" | "Reqwest" | "Serde" | "Io"; SignerErrorCode: | components["schemas"]["SignerErrorOwnCodes"] | components["schemas"]["AcceptedValueCode"] | components["schemas"]["BadRequestErrorCode"] | components["schemas"]["BadGatewayErrorCode"] | components["schemas"]["NotFoundErrorCode"] | components["schemas"]["ForbiddenErrorCode"] | components["schemas"]["UnauthorizedErrorCode"] | components["schemas"]["PreconditionErrorCode"] | components["schemas"]["TimeoutErrorCode"] | components["schemas"]["ConflictErrorCode"] | components["schemas"]["InternalErrorCode"]; /** @enum {string} */ SignerErrorOwnCodes: | "PreComputed" | "StatusCodeWithMessage" | "JrpcError" | "UnhandledError" | "ProxyStartError" | "EnclaveError" | "PolicyErrorWithEvalTree" | "RpcApi"; /** @description Answer to a Sign-in with Ethereum challenge. */ SiweCompleteRequest: { challenge_id: components["schemas"]["Id"]; /** @description The hex-encoded EIP-191 signature of the message returned by the corresponding POST ('init') endpoint */ signature: string; }; /** @description Returned upon a successful SIWE authentication. */ SiweCompleteResponse: { /** @description The OIDC token corresponding to the user with the requested SIWE identity. */ id_token: string; }; /** * @description Initialize the request to sign in with ethereum. The response will * contain a SIWE message that the client has to sign and submit via the * corresponding PATCH endpoint within 5 minutes. */ SiweInitRequest: { /** @description The Ethereum address performing the signing conformant to capitalization encoded checksum specified in EIP-55. */ address: string; /** @description The RFC 3986 authority that is requesting the signing. */ domain: string; /** @description The ISO 8601 datetime string that, if present, indicates when the signed authentication message is no longer valid. */ expiration_time?: string | null; /** @description The ISO 8601 datetime string that, if present, indicates when the signed authentication message will become valid. */ not_before?: string | null; /** @description A system-specific identifier that may be used to uniquely refer to the sign-in request. */ request_id?: string | null; /** @description A list of information or references to information the user wishes to have resolved as part of authentication by the relying party. They are expressed as RFC 3986 URIs separated by "\n- " where \n is the byte 0x0a. */ resources?: string[]; /** @description A human-readable ASCII assertion that the user will sign, and it must not contain '\n' (the byte 0x0a). */ statement?: string | null; /** @description An RFC 3986 URI referring to the resource that is the subject of the signing (as in the subject of a claim). */ uri: string; }; /** * @description A challenge returned in response to a Sign-In with Ethereum request. * * Contains a message that the client must sign following EIP-191 * with the requested key in order to complete authentication. * * The client has until the message expires (but no more than 5 minutes) to complete the challenge. */ SiweInitResponse: { /** @description The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) */ challenge_id: string; /** @description The message to sign following the EIP-191 standard. */ message: string; }; /** @description Answer to a Sign-in with Solana challenge. */ SiwsCompleteRequest: { challenge_id: components["schemas"]["Id"]; /** @description The base58-encoded ed25519 signature of the challenge's canonical message text (the rendered `SignInInput`). */ signature: string; }; /** @description Returned upon a successful SIWS authentication. */ SiwsCompleteResponse: { /** @description The OIDC token corresponding to the user with the requested SIWS identity. */ id_token: string; }; /** * @description Initialize the request to sign in with Solana. The response will contain a structured * `SignInInput` that the client must render to text, sign, and submit via the corresponding PATCH * endpoint within 5 minutes. */ SiwsInitRequest: { /** @description The base58-encoded Solana (ed25519) public key performing the signing. */ address: string; chain_id?: components["schemas"]["SolanaNetwork"] | null; /** @description The RFC 3986 authority that is requesting the signing. */ domain: string; /** @description The ISO 8601 datetime string that, if present, indicates when the signed authentication message is no longer valid. */ expiration_time?: string | null; /** @description The ISO 8601 datetime string that, if present, indicates when the signed authentication message will become valid. */ not_before?: string | null; /** @description A system-specific identifier that may be used to uniquely refer to the sign-in request. */ request_id?: string | null; /** @description A list of RFC 3986 URIs the user wishes to have resolved as part of authentication by the relying party. */ resources?: string[]; /** @description A human-readable ASCII assertion that the user will sign, and it must not contain '\n' (the byte 0x0a). */ statement?: string | null; /** @description An RFC 3986 URI referring to the resource that is the subject of the signing (as in the subject of a claim). */ uri?: string | null; }; /** * @description A challenge returned in response to a Sign-In with Solana request. * * Contains a structured [SignInInput] that the client must render to its canonical text and sign * (ed25519) with the requested key in order to complete authentication. * * The client has until the message expires (but no more than 5 minutes) to complete the challenge. */ SiwsInitResponse: { /** @description The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) */ challenge_id: string; sign_in_input: components["schemas"]["SignInInput"]; }; /** @description A Solana address and the cluster it is on. */ SolanaAddressInfo: { /** * @description The Solana address. * @example EPw4LsNwCYCYXace1BKvwLcd7oeZzRiYGuGE5zfPvoPy */ address: string; cluster: components["schemas"]["SolanaCluster"]; }; /** * @description Supported Solana clusters. * @enum {string} */ SolanaCluster: "mainnet" | "devnet"; /** * @description The Solana network a SIWS message is bound to (the `Chain ID` field). * @enum {string} */ SolanaNetwork: | "mainnet" | "testnet" | "devnet" | "localnet" | "solana:mainnet" | "solana:testnet" | "solana:devnet" | "solana:localnet"; /** * @description Solana signing request * @example { * "message_base64": "AQABA8OKVzLEjststN4xXr39kLKHT8d58eQY1QEs6MeXwEFBrxTAlULX1troLbWxuAXQqgbQofGi6z8fJi7KAAIf7YMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJK0tn39k28s+X86W47EvbRRKnYBVQ8Q/l2m1EbfT7+vAQICAAEMAgAAAGQAAAAAAAAA" * } */ SolanaSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** @description Solana base64-encoded serialized Message */ message_base64: string; }; SolanaTxCmp: { /** @description Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different. */ ignore_blockhash?: boolean; }; SourceIp: { /** @description The IP address of the caller. */ source_ip: string; }; StakeRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * Format: int64 * @description The chain on which we will deposit * @example 5 */ chain_id: number; deposit_type: components["schemas"]["DepositType"]; /** * Format: int64 * @description Optional staking amount in GWEI. * If not specified, defaults to 32_000_000_000 (32 ETH). * Must be between 1 ETH and 32 ETH. * Must not be different from the default value when 'deposit_type' is "Wrapper". */ staking_amount_gwei?: number; unsafe_conf?: components["schemas"]["UnsafeConf"] | null; /** * @description The validator BLS public key to use, or `None` to generate a fresh one. * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c */ validator_key?: string | null; /** * @description The ethereum address to which withdrawn funds go * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ withdrawal_addr: string; }; StakeResponse: ({ /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { deposit_tx: components["schemas"]["DepositTxn"]; }) & { /** * @description The validator key id ("Key#...") * @example Key#db1731f8-3659-45c0-885b-e11e1f5b7be2 */ created_validator_key_id: string; }; /** * @description Approval state for a [`MfaRequest`] in [`MfaRequestSource::Legacy`] mode: * the per-policy [`ApprovalConstraints`] plus an inline `approved_by` map. * Pooled MfaRequests carry only [`ApprovalConstraints`] — their approvals live * on the linked [`PendingOp`] — so the type system enforces "no pooled * MfaRequest has an `approved_by`." */ Status: { /** @description Users who are allowed to approve. Must be non-empty. */ allowed_approvers: string[]; /** @description Allowed approval types. When omitted, defaults to any. */ allowed_mfa_types?: components["schemas"]["MfaType"][] | null; /** * Format: int32 * @description How many users must approve (defaults to 1). */ count: number; /** * Format: int32 * @description How many auth factors to require per user (defaults to 1). */ num_auth_factors: number; request_comparer?: components["schemas"]["HttpRequestCmp"]; } & { /** @description Users who have already approved. */ approved_by: { [key: string]: { [key: string]: components["schemas"]["ApprovalInfo"]; }; }; }; /** * @description The `status` field carried by [`Empty`] responses. Always serializes as `"ok"`. * * Endpoints that used to return [`Empty`] and now return something richer must keep emitting * this field, because generated clients bind [`Empty`] to a struct with a *required* `status` * and would otherwise fail to deserialize a successful response. Use this type rather than a * bare `String` so the one acceptable value is not something anyone has to remember. * @enum {string} */ StatusOk: "ok"; /** * @description A single asset balance entry returned by [`SubAccountAssetsResponse`]. * * All balance fields are decimal strings (Binance preserves precision by not * converting to floats). */ SubAccountAsset: { /** @description Asset symbol (e.g. `"USDT"`, `"BTC"`). */ asset: string; /** @description Available balance. */ free: string; /** @description Balance frozen by Binance (e.g. due to compliance holds). */ freeze: string; /** @description Balance locked in open orders. */ locked: string; /** @description Balance currently being withdrawn. */ withdrawing: string; }; /** * @description Parameters for `GET /sapi/v4/sub-account/assets`. * * Queries the spot-wallet balances of a single sub-account. Must be called by * a master-account credential. */ SubAccountAssetsRequest: { /** @description Email address of the sub-account whose balances to fetch. */ email: string; }; /** @description Response returned by `cs_binanceSubAccountAssets`. */ SubAccountAssetsResponse: { /** * @description One entry per asset held in the sub-account's spot wallet. Binance * omits assets with all-zero balances. */ balances: components["schemas"]["SubAccountAsset"][]; }; /** * @description Parameters for `GET /sapi/v1/capital/deposit/subAddress`. * * Fetches the deposit address for `coin` on the sub-account identified by * `email`. Master-account keys only; use [`DepositRequest`] for the calling * account's own address. */ SubAccountDepositAddressRequest: { /** * @description Required only when `network` is `"LIGHTNING"`: the deposit amount that * the returned invoice should encode, as a decimal string. */ amount?: string | null; /** @description The asset symbol whose deposit address to fetch (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** @description Email of the sub-account whose deposit address to fetch. */ email: string; /** * @description Network identifier (e.g. `"BSC"`, `"ETH"`). If omitted, Binance returns * the address on the asset's default network. Valid values are the * networks listed by [`BinanceRpc::CoinInfo`]. */ network?: string | null; }; /** * @description Response returned by `cs_binanceSubAccountDepositAddress`. * * Same shape as [`DepositResponse`], but kept as a distinct type: `tag`/`url` * are modelled as optional here, and [`crate::response::JsonRpcResult`] is * `untagged` + `derive_more::From`, so two variants cannot share a payload * type. */ SubAccountDepositAddressResponse: { /** @description The sub-account's deposit address. */ address: string; /** @description Asset symbol (echoes the request's `coin` field). */ coin: string; /** * @description Secondary address identifier required by some assets (e.g. memo for * XRP, tag for XLM). Empty string when the asset does not use one. */ tag?: string | null; /** @description Blockchain explorer URL for `address`. */ url?: string | null; }; /** * @description Parameters for `GET /sapi/v1/capital/deposit/subHisrec`. * * Master-account keys only; use [`DepositHistoryRequest`] for the calling * account's own deposits. */ SubAccountDepositHistoryRequest: { /** @description Filter to a specific asset (e.g. `"USDT"`, `"BTC"`). */ coin?: string | null; /** * @description Email of the sub-account whose deposit history to fetch. Binance * requires this, so there is no "calling account" fallback here. */ email: string; /** * Format: int64 * @description Window end (ms since epoch). */ endTime?: number | null; /** * Format: int32 * @description Page size (Binance max: 200). Note that Binance defaults this to `1`, * not to a full page, so callers should always set it. */ limit?: number | null; /** * Format: int32 * @description Pagination offset (Binance default: 0). */ offset?: number | null; /** * Format: int64 * @description Window start (ms since epoch). Binance returns the most recent 90 days * when this and `end_time` are both omitted. */ startTime?: number | null; /** * Format: int32 * @description Filter by deposit status. Binance values: `0` = pending, `6` = credited * but cannot withdraw, `7` = wrong deposit, `8` = waiting user confirm, * `1` = success. Left as `u8` for forward compatibility. */ status?: number | null; /** @description Look up a specific deposit by its on-chain transaction hash. */ txId?: string | null; }; /** @description One sub-account entry in [`ListSubAccountsResponse`]. */ SubAccountInfo: { /** * Format: int64 * @description Sub-account creation time (ms since epoch). */ createTime: number; /** @description Sub-account email. */ email: string; /** @description `true` if this is an asset-management sub-account. */ isAssetManagementSubAccount: boolean; /** @description Whether the sub-account is currently frozen. */ isFreeze: boolean; /** @description `true` if this is a managed sub-account. */ isManagedSubAccount: boolean; }; /** @description One transfer entry in [`SubAccountTransferHistoryResponse`]. */ SubAccountTransferHistoryEntry: { /** @description Asset symbol (e.g. `"USDT"`). */ asset: string; /** @description Email of the counterparty account on the other side of the transfer. */ counterParty: string; /** * @description Email of the account this entry's API key authenticates as. Binance * returns this on each row even though it is the same for the whole page. */ email: string; /** * @description Wallet type debited on the source side (e.g. `"SPOT"`, * `"USDT_FUTURE"`). Left as `String` for forward compatibility. */ fromAccountType: string; /** @description Amount transferred, as a decimal string. */ qty: string; /** * @description Transfer status: `"PROCESS"`, `"SUCCESS"`, or `"FAILURE"`. Left as * `String` for forward compatibility. */ status: string; /** * Format: int64 * @description Time of the transfer (ms since epoch). */ time: number; /** @description Wallet type credited on the destination side. */ toAccountType: string; /** * Format: int64 * @description Transfer id. Matches the `txnId` returned by the original * [`SubAccountTransferResponse`]. */ tranId: number; /** * Format: int32 * @description `1` = transfer in, `2` = transfer out. */ type: number; }; /** * @description Parameters for `GET /sapi/v1/sub-account/transfer/subUserHistory`. * * Lists the transfer history of the calling sub-account. Covers both * sub-to-master and sub-to-sub transfers. All filters are optional; if * `start_time`/`end_time` are omitted, Binance returns the most recent 30 * days. If `r#type` is omitted, Binance defaults to `TransferOut` (`2`). */ SubAccountTransferHistoryRequest: { /** @description Filter to a specific asset (e.g. `"USDT"`). */ asset?: string | null; /** * Format: int64 * @description Window end (ms since epoch). */ endTime?: number | null; /** * Format: int32 * @description Page size (Binance default: 500). */ limit?: number | null; /** * @description If `true`, include failed transfers in the response. Binance defaults * to `false`. */ returnFailHistory?: boolean | null; /** * Format: int64 * @description Window start (ms since epoch). */ startTime?: number | null; /** * Format: int32 * @description Direction filter (`1` = transfer in, `2` = transfer out). */ type?: number | null; }; /** * @description Response returned by `cs_binanceSubAccountTransferHistory`. * * Binance returns a top-level JSON array; this newtype preserves that wire * format while giving the response a named type in the OpenAPI schema. */ SubAccountTransferHistoryResponse: components["schemas"]["SubAccountTransferHistoryEntry"][]; /** @description Response returned by `cs_binanceSubToMaster` and `cs_binanceSubToSub`. */ SubAccountTransferResponse: { /** Format: int64 */ txnId: number; }; /** * @description Parameters for `POST /sapi/v1/sub-account/transfer/subToMaster`. * * Transfers an asset from the caller's sub-account to the master account. */ SubToMasterRequest: { /** * @description The amount being transferred, formatted as a decimal string (e.g. `"0.1"`). * Sent verbatim: Binance is strict about decimal formatting. */ amount: string; /** @description The asset symbol being transferred (e.g. `"USDT"`, `"BTC"`). */ asset: string; }; /** * @description Parameters for `POST /sapi/v1/sub-account/transfer/subToSub`. * * Transfers an asset from the caller's sub-account to another sub-account * under the same master account. */ SubToSubRequest: { /** @description The amount being transferred, as a decimal string (e.g. `"0.1"`). */ amount: string; /** @description The asset symbol being transferred (e.g. `"USDT"`). */ asset: string; /** * @description Email address of the destination sub-account. Must be a sub-account of * the same master. */ toEmail: string; }; /** * @description The status of a subscription * @enum {string} */ SubscriptionStatus: "Confirmed" | "Pending"; /** @description A Sui address and its chain. */ SuiAddressInfo: { /** * @description The Sui address. * @example 0x4e8712e38b09b5467c10fdc40fa7865a65563983eeb74b246df981e61a66b98d */ address: string; chain: components["schemas"]["SuiChain"]; }; /** * @description Supported Sui chains. * @enum {string} */ SuiChain: "mainnet" | "devnet" | "testnet"; /** @description Request to sign a serialized SUI transaction */ SuiSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** * @description Base64-encoding of a BCS-serialized SUI transaction. * * When using the SUI TypeScript SDK, these bytes * are returned by the `Transaction.build()` method. */ tx: string; }; TaprootSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { sig_kind: components["schemas"]["TaprootSignatureKind"]; tx: components["schemas"]["BtcTx"]; }; TaprootSignatureKind: { /** @description Optional annex, as per BIP341 */ annex?: string | null; /** * @description Transaction input index * @example 0 */ input_index: number; leaf_hash_code_separator?: components["schemas"]["BtcLeafHashCodeSeparator"] | null; /** * @description If this field is not present or null, no tweak is applied. If the field is an * empty string, the key is tweaked with an unspendable script path per BIP0341. * Otherwise, this field must contain a base-64 string encoding 32 bytes that * represent the Merkle root with which to tweak the key before signing. * @example F41HAy2q5Gn8laF2CuMsZbRAQTmD+4Ob3VUMZ7TBGK4= */ merkle_root?: string | null; prevouts: components["schemas"]["PrevOutputs"]; /** * @description Hash type of an input's signature, encoded in the last byte of the signature. * Possible values: * - SIGHASH_ALL * - SIGHASH_ALL|SIGHASH_ANYONECANPAY * - SIGHASH_DEFAULT * - SIGHASH_NONE * - SIGHASH_NONE|SIGHASH_ANYONECANPAY * - SIGHASH_SINGLE * - SIGHASH_SINGLE|SIGHASH_ANYONECANPAY * @example SIGHASH_ALL */ sighash_type: string; }; TelegramAuthRequest: { /** @description The telegram bot ID */ bot_id: string; environment: components["schemas"]["TelegramEnvironment"]; /** @description The telegram webapp data (found in the `tgWebAppData` parameter encoded in the hash section of the URL) */ tg_web_app_data: string; }; TelegramAuthResponse: { /** @description The OIDC token corresponding to this telegram user */ id_token: string; }; /** * @description Telegram has two environments: production and test * Each one has an associated public key for verifying signatures, * and we assign each one a unique OIDC issuer * @enum {string} */ TelegramEnvironment: "production" | "test"; /** @description The request for using the Tendermint sign endpoint. */ TendermintSignRequest: { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & { /** @description The bytes of the protobuf-encoded message to sign as a BASE64 string. */ message_base64: string; }; /** @description Configuration object for a throttle which limits the number of entities within a given time window */ ThrottleConfig: { /** * Format: int32 * @description The number of entities allowed within the window */ threshold: number; window: components["schemas"]["Seconds"]; }; /** @enum {string} */ TimeoutErrorCode: "PolicyEngineTimeout" | "WasmPolicyExecutionTimeout"; TokenRequest: { grant_type: components["schemas"]["RefreshGrantType"]; /** @description The refresh token issued to the client. */ refresh_token: string; }; /** * @description OAuth2 standard Token Response. * * https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2 */ TokenResponse: { /** @description The access token issued by the authorization server. */ access_token: string; expires_in: components["schemas"]["Seconds"]; /** @description An OIDC token issued by Cubist, containing user information */ id_token?: string | null; /** @description The refresh token issued by the authorization server. */ refresh_token?: string | null; /** @description The type of the token issued. Value is case insensitive. */ token_type: string; [key: string]: unknown; } & Record; TotpApproveRequest: { /** @description TOTP verification code */ code: string; }; /** @description Sent from the client to the server to answer a TOTP challenge */ TotpChallengeAnswer: { /** @description The current TOTP code */ code: string; /** @description The ID of the challenge that was returned from the POST endpoint */ totp_id: string; }; TotpInfo: { /** * @description The ID of the TOTP challenge. * @example TotpChallenge#7892ebba-563e-485b-bb7d-e26267363286 */ totp_id: string; /** * @description Standard TOTP url which includes everything needed to initialize TOTP. * @example otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist */ totp_url: string; }; /** @description Result of registering (resetting) TOTP */ TotpRegisterResponse: { mfa?: components["schemas"]["MfaRequestInfo"]; status: components["schemas"]["StatusOk"]; }; /** @description Request to reset TOTP. */ TotpResetRequest: { /** * @description If set, the code answering this challenge additionally counts as an approving vote on * pending MFA request `mfa_id`. * * This exists so that a user who must register their first second factor in order to complete * an operation (most commonly logging in) does not have to enter two TOTP codes back to back: * one to confirm enrollment and another to immediately approve the pending request. Answering * the challenge already proves possession of the new secret. * * Requires the 'manage:mfa:vote:totp' scope in addition to 'manage:mfa:register:totp'. */ approve_mfa?: string | null; /** @description The name of the issuer; defaults to "Cubist". */ issuer?: string | null; }; Transaction: components["schemas"]["TypedTransaction"]; TransactionAndStatus: components["schemas"]["TypedTransaction"] & { /** @description The hash of the transaction that was signed */ hash?: string | null; /** @description The ID of the request record. */ id: string; /** @description The nonce (computed right before signing) */ nonce?: string | null; /** @description The signature */ signedRawTransaction?: string | null; status: components["schemas"]["MmiStatus"]; }; /** @description Chain-specific transaction details. */ TransactionDetails: components["schemas"]["EvmTransactionDetails"] & { /** @enum {string} */ chain: "Evm"; }; /** * @description Supported queries * @enum {string} */ TsQueryName: | "ActiveKeys" | "ActiveUsers" | "UniqueSignIns" | "UserCount" | "LatestUserCount" | "KeyCount" | "LatestKeyCount" | "BillingEvents" | "OidcLogins" | "SignEvents"; /** @description Information about a signed transaction */ TxSignature: { /** @description Keccak 256 Hash of the RLP encoding of the transaction */ hash: string; /** @description The nonce (either provided explicitly or computed right before signing) */ nonce: string; /** * @description The signed raw transaction * @example 0xdb33b03c2b8103e2a8c361d3b4f5abc67f96c6921df6e151d53087a5e12b1e4f */ signed_tx: string; }; /** @description A struct representing the pending message status */ TxStatus: | { /** @enum {string} */ status: "Pending"; } | { /** @description Information about a signed transaction */ sig: { /** @description Keccak 256 Hash of the RLP encoding of the transaction */ hash: string; /** @description The nonce (either provided explicitly or computed right before signing) */ nonce: string; /** * @description The signed raw transaction * @example 0xdb33b03c2b8103e2a8c361d3b4f5abc67f96c6921df6e151d53087a5e12b1e4f */ signed_tx: string; }; /** @enum {string} */ status: "Signed"; } | { reason: string; /** @enum {string} */ status: "Rejected"; }; /** * @description Represents the [EIP-712](https://eips.ethereum.org/EIPS/eip-712) typed data object. * * Typed data is a JSON object containing type information, domain separator parameters and the * message object. */ TypedData: { /** * @description Represents the [EIP-712](https://eips.ethereum.org/EIPS/eip-712) EIP712Domain object. * * EIP712Domain is a JSON object with one or more of the below fields. Protocol designers only need to include the fields that make sense for their signing domain. */ domain: { /** * @description The EIP-155 chain id. The user-agent should refuse signing if it does not match the * currently active chain. * @example 0x1 */ chainId?: string | null; /** * @description The user readable name of signing domain, i.e., the name of the DApp or the protocol. * @example Ether Mail */ name?: string | null; /** @description A disambiguating salt for the protocol. This can be used as a domain separator of last resort. Can be either a hex-encoded string or byte array */ salt?: string | number[]; /** * @description The address of the contract that will verify the signature. * @example 0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC */ verifyingContract?: string | null; /** * @description The current major version of the signing domain. Signatures from different versions are not * compatible. * @example 1 */ version?: string | null; }; /** @description The message to be signed. */ message: { [key: string]: unknown; }; /** @description The type of the message. */ primaryType: string; /** @description The custom types used by this message. */ types: { [key: string]: { /** @example name */ name: string; /** @example type */ type: string; }[]; }; }; /** @description EIP-2718 typed transaction, including EIP-1559 transactions (`{ "type": "0x02" ... }`), and legacy transactions (`{ "type": "0x00" ... }`). All values in the transaction are expected to be (0x-prefixed or not) hex strings or byte arrays. */ TypedTransaction: OneOf< [ { /** @example 0x01 */ data?: string; /** @example 0x4cf18a8a6a1ffe77fec600da2b90ec35ba050b07 */ from?: string; /** @example 0x1 */ gas?: string; /** @example 0x1 */ gasPrice?: string; /** @example 0x1 */ nonce?: string; /** @example 0x068bd529426f4f27e248baf36e4558e440738fbb */ to?: string; /** @example 0x00 */ type: string; /** @example 0x1 */ value?: string; }, { /** * @example [ * { * "address": "0x0000000000000000000000000000000000000000", * "storageKeys": [ * "0x0000000000000000000000000000000000000000000000000000000000000000" * ] * } * ] */ accessList?: { /** @example 0x0000000000000000000000000000000000000000 */ address?: string; /** * @example [ * "0x0000000000000000000000000000000000000000000000000000000000000000" * ] */ storageKeys?: string[]; }[]; /** @example 0x01 */ data?: string; /** @example 0x4cf18a8a7a1ffe77fec600da2b90ec35ba050b07 */ from?: string; /** @example 0x61a80 */ gas?: string; /** @example 0x9502f900 */ maxFeePerGas?: string; /** @example 0x9502f900 */ maxPriorityFeePerGas?: string; /** @example 0xb */ nonce?: string; /** @example 0x068bd539426f4f27e248baf36e4558e440738fbb */ to?: string; /** @example 0x02 */ type: string; /** @example 0x1 */ value?: string; }, ] >; /** @enum {string} */ UnauthorizedErrorCode: | "AuthorizationHeaderMissing" | "EndpointRequiresUserSession" | "RefreshTokenMissing"; /** @description One transfer entry in [`UniversalTransferHistoryResponse`]. */ UniversalTransferHistoryEntry: { /** @description Amount transferred, as a decimal string. */ amount: string; /** @description Asset symbol. */ asset: string; /** @description Client-supplied transfer id, if one was set on the original transfer. */ clientTranId?: string | null; /** * Format: int64 * @description Time of the transfer (ms since epoch). */ createTimeStamp: number; /** * @description Wallet type debited on the source side. Left as `String` for forward * compatibility. */ fromAccountType: string; /** @description Source sub-account email; absent when the source is the master. */ fromEmail?: string | null; /** @description Transfer status (e.g. `"SUCCESS"`). */ status: string; /** @description Wallet type credited on the destination side. */ toAccountType: string; /** @description Destination sub-account email; absent when the destination is master. */ toEmail?: string | null; /** * Format: int64 * @description Transfer id. Matches the `tranId` returned by the original * [`UniversalTransferResponse`]. */ tranId: number; }; /** * @description Parameters for `GET /sapi/v1/sub-account/universalTransfer`. * * Lists universal transfers initiated by the master account. All filters * are optional; if `start_time`/`end_time` are omitted, Binance returns the * most recent 30 days. Binance does not support filtering by `tran_id` * directly — use `client_tran_id` if you set one when initiating the * transfer, or page through the result and match the `tranId` client-side. */ UniversalTransferHistoryRequest: { /** @description Filter by client-supplied transfer id. */ clientTranId?: string | null; /** * Format: int64 * @description Window end (ms since epoch). */ endTime?: number | null; /** @description Filter to transfers originating from this sub-account email. */ fromEmail?: string | null; /** * Format: int32 * @description Page size (Binance default: 500, max: 500). */ limit?: number | null; /** * Format: int32 * @description 1-based page number (Binance default: 1). */ page?: number | null; /** * Format: int64 * @description Window start (ms since epoch). */ startTime?: number | null; /** @description Filter to transfers destined for this sub-account email. */ toEmail?: string | null; }; /** @description Response returned by `cs_binanceUniversalTransferHistory`. */ UniversalTransferHistoryResponse: { /** @description Transfers in the current page. */ result: components["schemas"]["UniversalTransferHistoryEntry"][]; /** * Format: int64 * @description Total number of transfers matching the filters across all pages. */ totalCount: number; }; /** * @description Parameters for `POST /sapi/v1/sub-account/universalTransfer`. * * Transfers an asset between any two accounts (master to/from sub, or sub * to/from sub) and between any two wallet types (spot, futures, margin, etc). * The signing credential (the API key + Ed25519 key pair) must belong to the * master account. */ UniversalTransferRequest: { /** @description The amount being transferred, as a decimal string. */ amount: string; /** @description The asset symbol being transferred (e.g. `"USDT"`). */ asset: string; /** * @description Optional client-supplied transfer id. If set, Binance echoes it back * as `client_tran_id` on the `UniversalTransferResponse` and lets it be * used as a filter on * [`UniversalTransferHistoryRequest::client_tran_id`]. */ clientTranId?: string | null; fromAccountType?: components["schemas"]["AccountType"]; /** @description Source sub-account email. If `None`, the source is the master account. */ fromEmail?: string | null; toAccountType?: components["schemas"]["AccountType"]; /** @description Destination sub-account email. If `None`, the destination is the master account. */ toEmail?: string | null; }; /** @description Response returned by `cs_binanceUniversalTransfer`. */ UniversalTransferResponse: { clientTranId?: string | null; /** Format: int64 */ tranId: number; }; /** @description Options that should be set only for local devnet testing. */ UnsafeConf: { /** * @description The hex-encoded address of the deposit contract. If omitted, inferred from `chain_id` * @example 0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b */ deposit_contract_addr?: string | null; /** * @description The hex-encoded 4-byte fork version * @example 0x00001020 */ genesis_fork_version?: string | null; }; UnstakeRequest: { epoch?: components["schemas"]["Epoch"] | null; fork: components["schemas"]["Fork"]; genesis_data: components["schemas"]["GenesisData"]; network: components["schemas"]["Network"]; /** * @description Validator index (`uint64`) to exit. You can get the validator index from the Beacon node's * `/eth/v1/beacon/states/head/validators/{pubkey}` end-point. This end point returns an * object that contains information about the validator (whose public key is `{pubkey}`), * including the validator index. The schema of this end-point is defined * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/getStateValidator). * @example 31337 */ validator_index: string; } & { /** @description Do not produce a valid signature, just evaluate attached policies. */ dry_run?: boolean; /** * @description Request additional information to be included in the response, explaining * the outcome (i.e., permitted vs. denied vs. MFA required) of the sign request. * Defaults to false. */ explain?: boolean; /** * @description If MFA is required, fail the request instead of returning 202 and creating * pending MFA request. Defaults to false. */ fail_on_mfa?: boolean; /** * @description Optional metadata. Passing additional information as metadata can be used to make reviewing * of pending MFA requests and/or historical key transactions more transparent. It can also be used e.g., to carry additional data to WebHook policies. */ metadata?: unknown; } & Record; /** @description A response to sign an eth2 unstake request. */ UnstakeResponse: { message: components["schemas"]["VoluntaryExit"]; /** * @description BLS signature. * @example 0x910c7cd537ed91cc8c4a82f3cbd832e9be8c24a22e9c86df479f7ce42025ea6a09619b418b666a060e260d2aae31b8e50e9d05ca3442c7eed3b507e5207e14674275f68c2ba84c4bf6b8dd364a304acac8cfab3681e2514b4400f9242bc61164 */ signature: string; } & { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & Record; /** @description The information needed to update a bucket. */ UpdateBucketRequest: { /** @description Access-control entries defining how the bucket can be accessed. */ acl?: unknown; /** * Format: int64 * @description If set, updating only succeeds if the current version matches this value. */ expected_version?: number | null; /** @description Optional metadata. */ metadata?: unknown; /** * @description Update the owner of the bucket * @example User#00000000-0000-0000-0000-000000000000 */ owner?: string | null; }; /** @description The information needed to update a Contact. */ UpdateContactRequest: { addresses?: components["schemas"]["AddressMap"] | null; edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description A new set of labels for the contact. * @example [ * "cubist:erc20_token" * ] */ labels?: components["schemas"]["ContactLabel"][] | null; /** @description A new value for the optional user-defined metadata about the contact. */ metadata?: unknown; /** * @description A new name for the contact. Must be a unique name among contacts in the * org. Name must consist of alphanumeric characters, spaces, `.` and `-`, * and cannot be longer than 50 characters. * @example Satoshi Nakamoto */ name?: string | null; owner?: components["schemas"]["Id"] | null; }; UpdateKeyRequest: components["schemas"]["CreateAndUpdateKeyProperties"] & { /** * @description If set, updates the key's `enabled` property to this value. * Once disabled, a key cannot be used for signing. */ enabled?: boolean | null; /** * @description If set, patch the key's structured [`KeyProperties`]. The patch's variant must * match the key's [`KeyType`] (e.g. `BinanceApi` properties are only allowed on * `Ed25519BinanceApi` keys). Each field in the patch is independent: missing * means leave alone, JSON `null` clears, a value sets. Sending JSON `null` for * the whole field clears all properties on the key. */ properties?: unknown; /** * @description If set, change the key's region affinity to this value. * * This is a region-locked operation, i.e., it can only be performed * from the region matching the key's current region affinity */ region?: string; /** * Format: int64 * @description If set, updating the metadata only succeeds if the version matches this value. */ version?: number | null; }; /** @description Policy Engine configurations. */ UpdateOrgPolicyEngineConfigs: { /** * @description Allowed domains for HTTP requests * @example [ * "cubist.dev:443" * ] */ allowed_http_authorities: string[]; }; UpdateOrgRequest: { alien_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description MFA types that are allowed to be used for implicitly security-sensitive * operations (like logging in, adding an MFA factor, exporting keys, etc.). * @example { * "Default": [ * "Fido", * "Totp", * "EmailOtp" * ], * "KeyExport": [ * "Fido" * ] * } */ allowed_mfa_types?: { [key: string]: components["schemas"]["MfaType"][]; } | null; custom_chains?: components["schemas"]["CustomChainsData"] | null; default_invite_kind?: components["schemas"]["InviteKind"] | null; edit_policy?: components["schemas"]["EditPolicy"] | null; email_preferences?: components["schemas"]["EmailPreferences"] | null; /** @description If set, update this org's `enabled` field to this value. */ enabled?: boolean | null; ext_props?: | ({ /** * Format: int32 * @description Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users. * * This setting is checked only when an alien user requests to create or import a new key. * In other words, org admins can still assign unlimited number of keys to their alien users. */ alien_key_count_threshold?: number | null; /** * @description Whether alien users are allowed to update their own key policies. * Defaults to 'false'. */ aliens_can_update_key_policy?: boolean | null; } & { /** * Format: int64 * @description If set, updating will succeed if the current version matches this value */ version?: number | null; }) | null; historical_data_configuration?: components["schemas"]["HistoricalDataConfiguration"] | null; idp_configuration?: components["schemas"]["IdpConfig"] | null; key_export_requirement?: components["schemas"]["SecondFactorRequirement"] | null; member_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description If set, update this org's notification endpoints. Notification endpoints are expected to be * HTTPS URLs, which accept POST requests. The body of the requests sent to these endpoints are * are formatted in JSON and have the following format: * * ```json * { * "org": "...", * "utc_timestamp": "...", * "org_event": "...", * ... * } * ``` * * `org` is the org id, `utc_timestamp` is the UTC timestamp of the event in milliseconds, and * `org_event` is a string identifying the type of event that has occurred. The rest of the * fields provide additional information related to the type of the event. * * Endpoints can optionally include filters to customize the org events that they are notified * about. Currently, the only supported filter type is `OneOf`, which expects a list of org * event types to send to the endpoint. If no filter is configured, the system sends all org * events to the endpoint. * @example [ * { * "url:": "https://example.com/endpoint1" * }, * { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url:": "https://example.com/endpoint2" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null; passkey_configuration?: components["schemas"]["PasskeyConfig"] | null; /** * @description If set, update this org's policies (old policies will be overwritten!). * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * }, * { * "SourceIpAllowlist": [ * "10.1.2.3/8", * "169.254.17.1/16" * ] * } * ] */ policy?: Record[] | null; policy_engine_configuration?: components["schemas"]["UpdateOrgPolicyEngineConfigs"] | null; /** * @description If set, all user logins will require the claim `cubesigner_scope_ceiling` to be present in * the user's token. This claim is an array of scopes (e.g. `[ "manage:keys:list", "sign:evm:tx" ]`), * which define a maximum set of scopes the user may request. If the user's token does not contain * this claim, the login will be rejected. * * Owners of the org are exempt from this requirement. */ require_scope_ceiling?: boolean | null; /** * @description If set, update this org's sign rule (old sign rules will be overwritten!). * Only "deny"-style rules may be set. * @example [ * { * "TxReceiver": [ * "0x0000000000000000000000000000000000000000" * ] * } * ] */ sign_policy?: unknown[] | null; /** * Format: int32 * @description If set, update this org's TOTP failure limit. After this many failures, * the user is rate limited until the next 30-second TOTP window. */ totp_failure_limit?: number | null; /** * Format: int64 * @description If set, update this org's user-export delay, i.e., the amount of time * (in seconds) between a user's initiating an export and the time when * export is allowed. For security, this delay cannot be set to less than * 172800, i.e., 2 days. */ user_export_delay?: number | null; /** @description If set, turn this org's user export off (by passing `true`) or on (by passing `false`). */ user_export_disabled?: boolean | null; /** * Format: int64 * @description If set, update this org's user-export window, i.e., the amount of time * (in seconds) that export is allowed after the user-export delay. After * this amount of time, the export is canceled and must be re-initiated. * For security, this window cannot be set to greater than 259200, i.e., * 3 days. */ user_export_window?: number | null; }; UpdateOrgResponse: { alien_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description MFA types that are allowed to be used for implicitly security-sensitive * operations (like logging in, adding an MFA factor, exporting keys, etc.). */ allowed_mfa_types?: { [key: string]: components["schemas"]["MfaType"][]; } | null; custom_chains?: components["schemas"]["CustomChainsData"] | null; default_invite_kind?: components["schemas"]["InviteKind"] | null; edit_policy?: components["schemas"]["EditPolicy"] | null; email_preferences?: components["schemas"]["EmailPreferences"] | null; /** @description The new value of the 'enabled' property */ enabled?: boolean | null; ext_data?: | ({ /** * Format: int32 * @description Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users. * * This setting is checked only when an alien user requests to create or import a new key. * In other words, org admins can still assign unlimited number of keys to their alien users. */ alien_key_count_threshold?: number | null; /** * @description Whether alien users are allowed to update their own key policies. * Defaults to 'false'. */ aliens_can_update_key_policy?: boolean | null; } & { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & Record) | null; historical_data_configuration?: components["schemas"]["HistoricalDataConfiguration"] | null; idp_configuration?: components["schemas"]["IdpConfig"] | null; key_export_requirement?: components["schemas"]["SecondFactorRequirement"] | null; member_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description The new human-readable name for the org (must be alphanumeric) * @example my_org_name */ name?: string | null; /** * @description The new notification endpoint configurations * @example [ * { * "url": "https://example.com/endpoint" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; passkey_configuration?: components["schemas"]["PasskeyConfig"] | null; /** * @description The new value of org-wide policies * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * } * ] */ policy?: Record[] | null; policy_engine_configuration?: components["schemas"]["PolicyEngineConfiguration"] | null; /** @description The new value of require_scope_ceiling */ require_scope_ceiling?: boolean | null; /** * @description The new value of the org-wide sign rules * @example [ * { * "TxReceiver": "0x0000000000000000000000000000000000000000" * } * ] */ sign_policy?: Record[] | null; /** * Format: int32 * @description The new value of the TOTP failure limit */ totp_failure_limit?: number | null; /** * Format: int64 * @description The new value of user-export delay */ user_export_delay?: number | null; /** @description The new value of user-export disabled */ user_export_disabled?: boolean | null; /** * Format: int64 * @description The new value of user-export window */ user_export_window?: number | null; /** * Format: int64 * @description New org version */ version: number; }; /** @description Request body for updating a named policy. */ UpdatePolicyRequest: { /** @description New Access-control entries. */ acl?: unknown; edit_policy?: components["schemas"]["EditPolicy"] | null; /** @description A new metadata. */ metadata?: unknown; /** @description A new name for the policy. */ name?: string | null; /** @description A new owner for the policy. */ owner?: string | null; /** @description New policy rules. */ rules?: unknown[] | null; }; /** @description A request for updating Org-level policy secrets */ UpdatePolicySecretsRequest: { edit_policy?: components["schemas"]["EditPolicy"] | null; }; UpdateRoleRequest: { edit_policy?: components["schemas"]["EditPolicy"] | null; /** * @description If set, updates the role's `enabled` property to this value. * Once disabled, a role cannot be used; and it's tokens cannot be used for signing. */ enabled?: boolean | null; /** * @description If set, update this role's key policies (old policies will be overwritten!). * Only "deny" style policies may be set. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * } * ] */ policy?: unknown[] | null; /** * @description If set, update this role's settings for restricting which member roles are allowed to * perform actions on this role. * @example { * "CreateToken": [ * "Owner" * ] * } */ restricted_actions?: { [key: string]: components["schemas"]["MemberRole"][]; } | null; }; /** @description Request to update an existing user */ UpdateUserMembershipRequest: { /** @description Enable or disable user */ disabled?: boolean | null; role?: components["schemas"]["MemberRole"] | null; }; /** * Format: binary * @description The SHA-256 hash of the object for an [UploadRequest]. */ UploadObjectHash: string; /** @description Request for uploading a wasm policy */ UploadWasmPolicyRequest: { hash: components["schemas"]["UploadObjectHash"]; }; /** @description The response to a request for uploading a wasm policy */ UploadWasmPolicyResponse: { /** @description A signed URL for uploading the requested wasm policy. */ signed_url: string; }; UserCountDimensions: { /** @description User's membership in the org */ membership: string; /** @description All metrics must include 'org_id' as a dimension. */ org_id: string; }; /** @description A request to complete a user export */ UserExportCompleteRequest: { /** * @description The id of the key to be exported. The key-id must correspond to the one in * the specified export request, and the caller must own this key. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description The NIST P-256 public key (base64-encoded SEC1 with or without compression) * to which the export will be encrypted. If a public key was provided when * `user_export_init` was called, this key must match that one. * @example AkpLT/3dXApJzXSduaPQ7apyT0ADBwqkt1es/aT0iWWf */ public_key: string; }; /** @description An encrypted user-export */ UserExportCompleteResponse: { /** * @description The exported key material, encrypted with AES-256-GCM under a key * derived from the public key supplied in the request via HPKE (RFC9180) * with DHKEM(P-256, HKDF-SHA256) and base64 encoded. */ encrypted_key_material: string; /** * @description The ephemeral public key used for HPKE key derivation as base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @description The user-id to which this key belongs. */ user_id: string; }; /** @description A request to initiate a user export */ UserExportInitRequest: { /** * @description The id of the key to be exported. This key must be owned by the caller. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description An optional NIST P-256 public key (base64-encoded SEC1 with or without * compression) to which the export will be encrypted. If provided, this * public key MUST be the one used to encrypt the export once the delay has * expired. Otherwise, the user can provide any public key when completing * the export request post delay. * * This option may provide extra security when the user has a secure hardware * device (e.g., a phone's secure element or a YubiKey) in which a NIST P-256 * secret key can be generated. Providing the corresponding public key here * ensures that only that specific device will be capable of decrypting * the export ciphertext. * * If no secure hardware device is available to store the secret key, this * option SHOULD NOT be used because of the risk of secret key theft during * the export delay period. * @example AkpLT/3dXApJzXSduaPQ7apyT0ADBwqkt1es/aT0iWWf */ public_key?: string | null; }; /** @description The response to a successful user-export init request */ UserExportInitResponse: components["schemas"]["UserExportRequest"] & { /** * @description The key-id being requested. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; }; /** @description Pending user-export request as stored in the database. */ UserExportRequest: { exp_epoch: components["schemas"]["EpochDateTime"]; /** * @description The org-id in which the key is housed. * @example Org#f361ed6b-5d19-4ccf-a4d5-eba935dc0b90 */ org_id: string; /** * @description The SHA-256 hash of the public key provided at export initiation, * if any. If a key was provided, only that key can be used to complete * the export procedure. Otherwise, any key can be used. * * IMPORTANT: if a public key is supplied at export initiation, it is * STRONGLY RECOMMENDED that the corresponding secret key be stored in * a secure hardware device, e.g., a YubiKey or a phone's secure element. * If no such hardware is available, supplying a public key at export * initiation is STRONGLY DISCOURAGED because of the risk of theft during * the export delay period. * * (See also the comment in the `public_key` field of `UserInitRequest`.) * @example df457a98d5538540f54d1316b597a0f39b8d96f488f10a2e31a955c146fdf1d3 */ public_key_hash?: string | null; valid_epoch: components["schemas"]["EpochDateTime"]; }; UserInOrgInfo: { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; verified_email?: components["schemas"]["VerifiedEmail"] | null; }; UserInOrgInfoWithIdentity: { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; verified_email?: components["schemas"]["VerifiedEmail"] | null; } & { /** @description Optional third-party identities via which the user was found */ identities?: components["schemas"]["IdentityInfo"][]; }; /** * @description Information about a user's membership in an organization * (without including any info about the user) */ UserInOrgMembership: { membership: components["schemas"]["MemberRole"]; /** * @description Organization id * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; status: components["schemas"]["MembershipStatus"]; }; UserInRoleInfo: { user_id: string; }; UserInfo: { /** * @description Optional email * @example alice@example.com */ email?: string | null; /** @description All multi-factor authentication methods configured for this user */ mfa: components["schemas"]["ConfiguredMfa"][]; mfa_policy?: components["schemas"]["MfaPolicy"] | null; /** * @description Optional name * @example Alice */ name?: string | null; /** * @deprecated * @description All organizations the user belongs to. Deprecated in favor of 'orgs'. * @example [ * "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a" * ] */ org_ids: string[]; /** @description All organizations the user belongs to, including the membership role in each. */ orgs: components["schemas"]["UserInOrgMembership"][]; /** * @description The id of the currently logged in user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; verified_email?: components["schemas"]["VerifiedEmail"] | null; }; /** @description The response to the user/orgs endpoint */ UserOrgsResponse: { /** @description The list of orgs this user is a member of */ orgs: components["schemas"]["OrgData"][]; }; /** * @description A WebAuthn Relying Party may require user verification for some of its * operations but not for others, and may use this type to express its needs. * * https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement * @enum {string} */ UserVerificationRequirement: "required" | "discouraged" | "preferred"; VerifiedEmail: { /** @description Email address */ email: string; /** * Format: int64 * @description Last time this record was updated (in seconds since unix epoch) */ updated_at: number; }; /** * @description Versioning fields (e.g., version number, creation time, and last modified times) * that are common to different types of resources. */ VersioningFields: { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; }; /** * @description An exit voluntarily submitted a validator who wishes to withdraw. * The schema for this message is defined * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit). */ VoluntaryExit: { epoch: components["schemas"]["Epoch"]; /** * @description Index of the exiting validator. * @example 256 */ validator_index: string; }; /** @description The response from invoking a Wasm policy. */ WasmPolicyResponse: | { /** @enum {string} */ response: "Allow"; } | { /** @description The reason for the denial. */ reason: string; /** @enum {string} */ response: "Deny"; } | { /** @description The error from the Policy Engine. */ error: string; /** @enum {string} */ response: "Error"; }; /** @description A wasm policy rule that can be executed in the wasm engine. */ WasmRule: { /** @description The SHA-256 hash of a wasm policy that can be used to look it up in the policy store. */ hash: string; /** @description The Id of the policy this wasm rule belongs to. */ policy_id: string; }; /** @description Whether the official webapp origin is automatically allowed. `"limited"` is treated the same as `true` by the back end, but reported as-is to clients */ WebappEnabled: boolean | "limited"; /** * @description Allowed webhook methods * @enum {string} */ WebhookMethod: "GET" | "POST"; /** * @description The payload that is sent to the webhook. * * The webhook should respond with HTTP status code 200 if the operation is permitted. * * All non-200 status codes imply that the operation is denied; any response body returned * by the webhook will be included in the error response sent back to the client. */ WebhookPayload: { /** @description The address (material id) of the key used to sign the request */ key_address: string; key_type: components["schemas"]["KeyType"]; operation: components["schemas"]["OperationKind"]; /** @description The payload (if any) of the sign operation */ request?: unknown; }; /** @description Parameters for the [Deny::Webhook] policy. */ WebhookPolicyParams: { /** @description Optional HTTP headers to set */ headers?: { [key: string]: string; }; /** @description Optional HTTP method to use. Defaults to POST. */ method?: string; /** * @description CubeSigner operations to which this policy should apply. * When omitted, applies to all operations. */ restricted_operations?: components["schemas"]["OperationKind"][] | null; /** * Format: int64 * @description Request execution timeout in seconds; must not exceed 5 seconds. */ timeout?: number; /** @description The url of the webhook */ url: string; }; WhereAndWhen: components["schemas"]["SourceIp"] & { time: components["schemas"]["EpochDateTime"]; }; /** @description One withdrawal entry in [`WithdrawHistoryResponse`]. */ WithdrawHistoryEntry: { /** @description Destination address. */ address: string; /** @description Withdrawal amount, as a decimal string. */ amount: string; /** * @description Time the withdrawal was requested (Binance returns a UTC string, * e.g. `"2019-09-24 12:43:45"`). */ applyTime: string; /** @description Asset symbol (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** * @description Time the withdrawal completed (UTC string), present once * `status == 6`. */ completeTime?: string | null; /** * Format: int32 * @description Number of on-chain confirmations. */ confirmNo?: number | null; /** * @description Binance-assigned withdrawal id. Matches the `id` returned by * [`WithdrawResponse`]. */ id: string; /** @description Failure reason when the withdrawal was rejected. */ info?: string | null; /** @description Blockchain network identifier (e.g. `"BSC"`, `"ETH"`). */ network?: string | null; /** * Format: int32 * @description Withdrawal status. Binance values: `0` = Email Sent, * `2` = Awaiting Approval, `3` = Rejected, `4` = Processing, * `6` = Completed. Left as `u8` for forward compatibility. */ status: number; /** @description Network fee charged for the withdrawal, as a decimal string. */ transactionFee: string; /** * Format: int32 * @description `0` = external transfer, `1` = internal (Binance↔Binance) transfer. */ transferType: number; /** * @description On-chain transaction hash, once Binance has broadcast the withdrawal. * May be empty until then. */ txId?: string | null; /** * Format: int32 * @description Source wallet: `0` = spot wallet, `1` = funding wallet. */ walletType: number; /** * @description Client-supplied withdrawal id, if one was set on the original * withdrawal call. */ withdrawOrderId?: string | null; }; /** * @description Parameters for `GET /sapi/v1/capital/withdraw/history`. * * Returns the master account's withdrawal history. All filters are * optional; if `start_time`/`end_time` are omitted, Binance returns the * most recent 90 days. Use `id_list` to look up specific withdrawals by * the `id` returned from [`BinanceRpc::Withdraw`], or `withdraw_order_id` * to look one up by its client-supplied id. */ WithdrawHistoryRequest: { /** @description Filter to a specific asset (e.g. `"USDT"`). */ coin?: string | null; /** * Format: int64 * @description Window end (ms since epoch). */ endTime?: number | null; /** * @description Comma-separated list of Binance-assigned withdrawal ids (the `id` * field of `WithdrawResponse`). Up to 45 ids per query, per Binance. */ idList?: string | null; /** * Format: int32 * @description Page size (Binance default and max: 1000). */ limit?: number | null; /** * Format: int32 * @description Pagination offset. */ offset?: number | null; /** * Format: int64 * @description Window start (ms since epoch). */ startTime?: number | null; /** * Format: int32 * @description Filter by withdrawal status. Binance values: * `0` = Email Sent, `2` = Awaiting Approval, `3` = Rejected, * `4` = Processing, `6` = Completed. Left as `u8` for forward * compatibility. */ status?: number | null; /** * @description Filter by the client-supplied withdrawal id originally passed to * [`WithdrawRequest::withdraw_order_id`]. */ withdrawOrderId?: string | null; }; /** * @description Response returned by `cs_binanceWithdrawHistory`. * * Binance returns a top-level JSON array; this newtype preserves that wire * format while giving the response a named type in the OpenAPI schema. */ WithdrawHistoryResponse: components["schemas"]["WithdrawHistoryEntry"][]; /** * @description Parameters for `POST /sapi/v1/capital/withdraw/apply`. * * Submits a withdrawal of `amount` of `coin` to the given external `address`. * The signing key's account must have withdrawal permissions enabled. */ WithdrawRequest: { /** @description Destination address. */ address: string; /** * @description Secondary address identifier required by some assets (e.g. memo for * XRP, tag for XLM). */ addressTag?: string | null; /** * @description The amount being withdrawn, formatted as a decimal string (e.g. `"0.1"`). * Sent verbatim: Binance is strict about decimal formatting. */ amount: string; /** @description The asset symbol being withdrawn (e.g. `"USDT"`, `"BTC"`). */ coin: string; /** @description Optional human-readable description for the withdrawal. */ name?: string | null; /** * @description Network identifier (e.g. `"BSC"`, `"ETH"`). If omitted, Binance picks * the default network for the asset. */ network?: string | null; /** * @description If `true`, the withdrawal fee is deducted from the destination amount; * if `false` (Binance default), it is deducted from the account balance * in addition to `amount`. */ transactionFeeFlag?: boolean | null; /** * Format: int32 * @description Source wallet: `0` = spot wallet (default), `1` = funding wallet. */ walletType?: number | null; /** * @description Client-supplied withdrawal id, returned by Binance as `withdrawOrderId` * in subsequent withdrawal-history queries. */ withdrawOrderId?: string | null; }; /** @description Response returned by `cs_binanceWithdraw`. */ WithdrawResponse: { /** * @description Binance-assigned withdrawal id. Used to look the request up later via * the withdrawal-history endpoint. */ id: string; }; }; responses: { AddThirdPartyUserResponse: { content: { "application/json": { /** @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; }; }; }; /** @description The response to the idp authenticate endpoint */ AuthenticationResponse: { content: { "application/json": { /** @description An OIDC token that can be used to authenticate with CubeSigner */ id_token: string; }; }; }; BabylonCovSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The slash-unbonding transaction signatures as an array of hex strings with no 0x prefix * @example [ * "02e21a7b0519539ef670f79d1c25a54f90b0c6d9fdb56a7de813fb207033032fffad8aaafeb1b77dd9ea8f17dadcf297696bbf5a4133292f3515b86bb9c2d78d9c" * ] */ slash_unbonding_transactions_signatures: string[]; /** * @description The slashing transaction signatures as an array of hex strings with no 0x prefix * @example [ * "03075eca9d176d1605d6c096c111e9a4f8d8739ac9708c1df3ed516106e7ab1387a3924a6652acf2e3524359731ca1fbb338a3afb1a67f6ea19c207b6ff466a5ad", * "022224493f4cffad5b84076db32dd8c49a28ff48af4e19e2bcc9953ff80347ba6e8343cf7a44e74a96ff71ea59a03b40166e85b0d1355954e04a4427dc8d637ff0" * ] */ slashing_transactions_signatures: string[]; /** * @description The signature that allows expanding a stake by spending the current active * stake transaction into a new staking transaction. A value is present iff the * corresponding request included a `stake_expansion` value. * @example b573e318803fd7aee1be5b6b18d496cc60ecc52429dbd477a879217c3ed26a795cb4f4e880aaff3a6ad66335e5404fa51caeb4964f0c9f7562737864e3bde5bc */ stake_expansion_transaction_signature?: string | null; /** * @description The unbonding transaction signature as hex string with no 0x prefix * @example b573e318803fd7aee1be5b6b18d496cc60ecc52429dbd477a879217c3ed26a795cb4f4e880aaff3a6ad66335e5404fa51caeb4964f0c9f7562737864e3bde5bc */ unbonding_transaction_signature: string; }; }; }; BabylonRegistrationResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The Babylon address that will receive the staking rewards for this deposit. * * This value will correspond to the `bbn_addr` value specified in the request, * but it will always have a `bbn` human-readable part. * @example bbn1n5anmc0kkrh70yjy7f6f399c74yd09xl5teffm */ bbn_addr: string; /** * @description The deposit transaction PSBT. This PSBT includes signatures on any * inputs controlled by the staker taproot key specified in the request. */ deposit: string; /** * Format: int64 * @description The deposit transaction fee in sats. * @example 1337 */ deposit_fee: number; /** * @description The proof of possession, i.e., a BIP322 signature on the staker's * Babylon address signed by the staker taproot key. This is a Bitcoin * witness stack in Bitcoin consensus hex encoding. */ pop: string; /** @description The slash-deposit transaction in Bitcoin consensus hex encoding. */ slash_deposit: string; /** * @description The staker taproot key's signature on the slash-deposit transaction. * This is a BIP340 signature in hex format. */ slash_deposit_sig: string; /** @description The slash-unbond transaction in Bitcoin consensus hex encoding. */ slash_unbond: string; /** * @description The staker taproot key's signature on the slash-unbond transaction. * This is a BIP340 signature in hex format. */ slash_unbond_sig: string; /** @description The (unsigned) unbonding transaction in Bitcoin consensus hex encoding. */ unbond: string; }; }; }; BabylonStakingResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * Format: int64 * @description The transaction fee in sats * @example 1337 */ fee: number; /** * @description The PSBT in either hex or base64 serialization * @example 70736274ff01005e... */ psbt: string; }; }; }; /** @description Response returned by the typed `binance_sign` endpoint. */ BinanceSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The full signed query string, ready to be submitted to Binance. * Encoded as `&recvWindow=×tamp=&signature=`. */ signed_query: string; }; }; }; /** @description BTC message signing response */ BtcMessageSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** @description The base64-encoded signature in BIP137 format. */ sig: string; }; }; }; /** @description Information about a policy KV store bucket. */ BucketInfo: { content: { "application/json": ({ created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & { /** @description The access-control entries for the bucket. */ acl?: unknown[] | null; /** @description Arbitrary user-defined metadata. */ metadata?: unknown; org_id: components["schemas"]["Id"]; owner: components["schemas"]["Id"]; }) & { /** @description The name of the bucket. */ name: string; }; }; }; /** @description Response returned by the typed `bybit_sign` endpoint. */ BybitSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The Bybit-bound payload (URL-encoded query for GET, JSON body for * POST). Submitted verbatim by the rpc-api lambda; the payload bytes are * also part of the signing input. */ payload: string; /** * Format: int32 * @description Effective receive window in milliseconds. */ recv_window: number; /** * @description Hex-encoded HMAC-SHA256 signature of * `timestamp || apiKey || recvWindow || payload`. Goes into the * `X-BAPI-SIGN` header. */ signature_hex: string; /** * Format: int64 * @description Signing timestamp (ms since epoch). Picked by the signer. */ timestamp_ms: number; }; }; }; /** @description Response returned by the typed `coinbase_sign` endpoint. */ CoinbaseSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The signed JWT, ready to be sent in `Authorization: Bearer ` to * the Coinbase Advanced Trade API. */ jwt: string; }; }; }; /** @description The number of users and keys in an org, organized by user role and key type */ ComputeCountsResponse: { content: { "application/json": { /** * @description A map of a `KeyType` to the amount of keys with that type in the org. * @example { * "SecpBtc": 3, * "SecpEthAddr": 1 * } */ keys: { [key: string]: number; }; /** * @description A map of a `MemberRole` to the amount of number of users with that role in the org. * @example { * "Member": 10, * "Owner": 1 * } */ users: { [key: string]: number; }; }; }; }; /** @description Information about a Contact. */ ContactInfoResponse: { content: { "application/json": components["schemas"]["Contact"] & { addresses: components["schemas"]["AddressMap"]; id: components["schemas"]["Id"]; }; }; }; CreateKeyImportKeyResponse: { content: { "application/json": components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; }; }; CreateKeyResponse: { content: { "application/json": { /** @description The info about the created keys */ keys: components["schemas"]["KeyInfo"][]; }; }; }; /** * @description The response to [create_import_key] containing the generated key and enclave * attestations. */ CreatePolicyImportKeyResponse: { content: { "application/json": components["schemas"]["KeyImportKey"] & { /** * @description An attestation document from a secure enclave, including an * RSA signing key used to sign the contents of this message. */ enclave_attestation: string; /** * @description An RSA-PSS-SHA256 signature on the public key and encrypted * secrets attesting to their generation inside a secure enclave. */ enclave_signature: string; }; }; }; /** @description The newly created role information */ CreateRoleResponse: { content: { "application/json": { /** * @description A human-readable name for the role. * @example my_role */ name?: string | null; /** * @description The id of the newly created role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; }; }; }; /** @description Response to [CustomChainRpcRequest] */ CustomChainRpcResponse: { content: { "application/json": unknown; }; }; /** @description The result of a Diffie Hellman key exchange */ DiffieHellmanResponse: { content: { "application/json": ( | { /** @description The resulting points as base64-encoded byte strings in a key-type--dependent format. */ points: string[]; /** @enum {string} */ response_type: "masked"; } | { /** * @description A ciphertext containing the resulting points. The enclosed plaintext is a sequence * of base64-encoded byte strings in a key-type--dependent format. */ encrypted_shared_secrets: string; /** * @description The ephemeral public key used for HPKE key derivation in base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @enum {string} */ response_type: "encrypted"; } ) & { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & Record; }; }; /** * @description The HTTP response to an email OTP request. * * This response contains an OIDC token without a signature. * The signature is sent to the end-user in an email. * The token can be reconstructed by concatenating the `partial_token` with the signature. */ EmailOtpResponse: { content: { "application/json": { /** * @description The OIDC token without the signature. * (The signature, which is actually a MAC, is sent to the end-user in an email) */ partial_token: string; }; }; }; EmptyImpl: { content: { "application/json": { status: components["schemas"]["StatusOk"]; }; }; }; /** @description Response generated when creating EOTS nonces */ EotsCreateNonceResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The generated nonces as an array of 0x-prefixed hex strings * @example [ * "0xb393bf39e71a16d784853d58255a296222a99fd3c87aa7ca206c5230c188f1c7", * "0xe01936584b4f0c0e97f0d3018c4f9db2bf7de41395c6403a48fd0dff0ef7b40d" * ] */ nonces: string[]; }; }; }; /** @description Response to [EsploraRequest] */ EsploraResponse: { content: { "application/json": unknown; }; }; Eth1SignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description Hex-encoded RLP encoding of the transaction and its signature * @example 0x22895118000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000001201d58656b0e22aaa68fdc692db41979098c3886ed33015d7467de9211609cdac000000000000000000000000000000000000000000000000000000000000000308b0c2900324d3ff9adfba7fdfe5af3f9b2cdbeef7b280437bbf1b1c59a093d615afe3e5dfed9622b540cdd9b49b3c5ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002001000000000000000000000049011adbcc3bc9c0307bb07f37dda1a1a9c69d2e0000000000000000000000000000000000000000000000000000000000000060903db8525674b8e7904f9b7d7d9ec55a0a42d33cf58be25469b0c21bbb6d06172bc5bb5fd1aed8e4f35936968958116b0619553c2cb1c52e7323074c6f8eb3d5a7074fc6580148df907837fa3b164ad7fbc2288dad1e8a5b021095b57c8a36d4 */ rlp_signed_tx: string; }; }; }; FidoAssertChallenge: { content: { "application/json": (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; }; }; /** * @description Sent by the server to the client. Contains the challenge data that must be * used to generate a new credential */ FidoCreateChallengeResponse: { content: { "application/json": (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialCreationOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; }; }; /** @description Result of registering a FIDO key */ FidoRegisterResponse: { content: { "application/json": { mfa?: components["schemas"]["MfaRequestInfo"]; status: components["schemas"]["StatusOk"]; }; }; }; /** @description The email sender configuration (without sensitive auth details) */ GetEmailConfigResponse: { content: { "application/json": { /** @description The email address that emails are sent from */ sender: string; template?: { /** @description An HTML template to use for the body. */ body_template: string; /** @description The subject line template */ subject_template: string; } | null; }; }; }; GetUserByEmailResponse: { content: { "application/json": { /** * @description Typically, this array is either empty (if no user with a given email was found) * or contains a single element, i.e., the user with a given email. */ users: components["schemas"]["UserInOrgInfoWithIdentity"][]; }; }; }; GetUserByOidcResponse: { content: { "application/json": { user?: components["schemas"]["UserInOrgInfoWithIdentity"] | null; }; }; }; /** * @description Proof that an end-user provided CubeSigner with a valid auth token * (either an OIDC token or a CubeSigner session token) */ IdentityProof: { content: { "application/json": { aud?: components["schemas"]["Aud"] | null; /** * @description The email associated with the user * @example user@email.com */ email?: string | null; exp_epoch: components["schemas"]["EpochDateTime"]; identity?: components["schemas"]["OidcIdentity"] | null; /** * @description The username (if any) associated with the user * @example cubistdev */ preferred_username?: string | null; user_info?: components["schemas"]["CubeSignerUserInfo"] | null; } & { /** @description An opaque identifier for the proof */ id: string; }; }; }; /** @description The result of invoking a Wasm policy. */ InvokePolicyResponse: { content: { "application/json": { response: components["schemas"]["WasmPolicyResponse"]; /** * @description The bytes written to `stderr`, encoded as a hex-string. * In most cases, these bytes correspond to a UTF-8-encoded `String`. */ stderr: string; /** * @description The bytes written to `stdout`, encoded as a hex-string. * In most cases, these bytes correspond to a UTF-8-encoded `String`. */ stdout: string; }; }; }; JrpcResponse: { content: { "application/json": components["schemas"]["Response"] & Record; }; }; /** @description The RPC API's response. */ JsonRpcResponse: { content: { "application/json": { error?: components["schemas"]["ErrorObj"] | null; /** @description ID from the corresponding request. */ id?: unknown; /** @description Constant "2.0". */ jsonrpc: string; /** @description Result, if success. */ result?: Record | null; }; }; }; /** @description A JSON Web Key set describing the key used to sign JSON Web Tokens */ JwkSetResponse: { content: { "application/json": { /** @description The keys included in this set */ keys: Record[]; }; }; }; /** @description Derivation-related metadata for keys derived from a long-lived mnemonic */ KeyDerivationInfo: { content: { "application/json": { /** @description The derivation path used to derive this key */ derivation_path: string; /** @description The mnemonic-id of the key's parent mnemonic */ mnemonic_id: string; }; }; }; /** @description A wrapped key-import key */ KeyImportKey: { content: { "application/json": { /** @description Base64-encoded, encrypted data key. */ dk_enc: string; /** * Format: int64 * @description Expiration timestamp expressed as seconds since the UNIX epoch. */ expires: number; /** * @description The ephemeral public key to which an imported key should be encrypted. * This is a P384 public key in base64-encoded uncompressed SECG format. */ public_key: string; /** @description Base64-encoded, encrypted secret key. */ sk_enc: string; }; }; }; KeyInRoleInfo: { content: { "application/json": { /** * @description Key ID * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_info?: components["schemas"]["KeyInfo"] | null; /** * @description Policies that are checked before this key is used on behalf of this role * @example [ * { * "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa" * }, * { * "TxDeposit": { * "kind": "Canonical" * } * } * ] */ policy?: Record[]; /** * @description Role ID * @example Role#e427c28a-9c5b-49cc-a257-878aea58a22c */ role_id: string; }; }; }; KeyInfo: { content: { "application/json": components["schemas"]["CommonFields"] & { /** * @description Key access-control entries * @example [ * { * "actions": [ * "manage:key:properties" * ], * "subjects": [ * "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f" * ] * } * ] */ acl?: unknown[] | null; derivation_info?: components["schemas"]["KeyDerivationInfo"] | null; /** @description Whether the key is enabled (only enabled keys may be used for signing) */ enabled: boolean; /** * @description The id of the key: "Key#" followed by a unique identifier specific to * the type of key (such as a public key for BLS or an ethereum address for Secp) * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ key_id: string; key_type: components["schemas"]["KeyType"]; /** * @description A unique identifier specific to the type of key, such as a public key or an ethereum address * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148 */ material_id: string; /** * @description Owner of the key * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ owner: string; /** * @description Key policy * @example [ * "AllowRawBlobSigning", * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy: unknown[]; properties?: components["schemas"]["KeyPropertiesPatch"] | null; /** @description The key provenance. */ provenance?: string | null; /** * @description Hex-encoded, serialized public key. The format used depends on the key type: * - Secp256k1 keys use 65-byte uncompressed SECG format; * - Stark keys use 33-byte compressed SECG format; * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format; * - Ed25519 keys use the canonical 32-byte encoding specified in RFC 8032. * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431 */ public_key: string; /** * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages) * @example Eth2Validator(1) */ purpose: string; /** @description The region affinity for this key */ region?: string; }; }; }; /** @description Response returned when requesting a key attestation. */ KeyInfoJwt: { content: { "application/json": { /** @description A JSON Web Token whose claims contain the `KeyInfo` structure. */ jwt: string; }; }; }; KeyInfos: { content: { "application/json": { keys: components["schemas"]["KeyInfo"][]; }; }; }; /** @description Third-party identities associated with the user's account */ ListIdentitiesResponse: { content: { "application/json": { identities: components["schemas"]["IdentityInfo"][]; }; }; }; /** @description All pending MMI requests created by the current user. */ ListPendingMessagesResponse: { content: { "application/json": { /** @description All pending messages for a user. */ pending_messages: components["schemas"]["PendingMessageInfo"][]; }; }; }; /** @description Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). */ MfaRequestInfo: { content: { "application/json": { created_at?: components["schemas"]["EpochDateTime"]; /** @description The session identity (user or role) that created this request. */ created_by: string; expires_at: components["schemas"]["EpochDateTime"]; /** @description Approval request ID. */ id: string; not_valid_until?: components["schemas"]["EpochDateTime"]; /** * @description MFA policy provenance * @enum {string} */ provenance: "Org" | "Key" | "KeyInRole" | "Role" | "User" | "EditPolicy"; receipt?: components["schemas"]["Receipt"] | null; /** @description The region this MFA request was created in. It can only be redeemed from the same region. */ region?: string; /** * @description If set, contains the IDs of all MFA requests (including this one!) that * were generated at once for the same CubeSigner operation. * * If not set, it means that this was the lone MFA request generated for `request`. * * This is useful so that a client can discover all the MFAs whose receipts must * be submitted together to carry out the original CubeSigner operation. */ related_ids?: string[]; request: components["schemas"]["HttpRequest"]; status: components["schemas"]["Status"]; }; }; }; /** @description Information about a new session, returned from multiple endpoints (e.g., login, refresh, etc.). */ NewSessionResponse: { content: { "application/json": { /** * Format: int64 * @description Session expiration (in seconds since UNIX epoch), beyond which it cannot be refreshed. * @example 1701879640 */ expiration?: number; org_id: components["schemas"]["Id"]; /** @description Token that can be used to refresh this session. */ refresh_token: string; session_info: components["schemas"]["ClientSessionInfo"]; /** * @description New token to be used for authentication. Requests to signing endpoints * should include this value in the `Authorization` header. */ token: string; }; }; }; /** @description An org-export ciphertext retrieved via the org-export API. */ OrgExportResponse: { content: { "application/json": { /** @description A base64-encoded export ciphertext. */ ciphertext: string; }; }; }; OrgInfo: { content: { "application/json": components["schemas"]["MfaRequirements"] & components["schemas"]["CommonFields"] & { access_model: components["schemas"]["AccessModel"]; custom_chains?: components["schemas"]["CustomChainsData"] | null; default_invite_kind?: components["schemas"]["InviteKind"]; email_preferences?: components["schemas"]["EmailPreferences"]; /** @description When false, all cryptographic operations involving keys in this org are disabled. */ enabled: boolean; ext_data?: | ({ /** * Format: int32 * @description Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users. * * This setting is checked only when an alien user requests to create or import a new key. * In other words, org admins can still assign unlimited number of keys to their alien users. */ alien_key_count_threshold?: number | null; /** * @description Whether alien users are allowed to update their own key policies. * Defaults to 'false'. */ aliens_can_update_key_policy?: boolean | null; } & { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & Record) | null; historical_data_configuration?: components["schemas"]["HistoricalDataConfiguration"]; idp_configuration?: components["schemas"]["IdpConfig"]; /** @description Deprecated: this field should be ignored. */ key_import_key?: string | null; /** * @description The organization's universally unique key-wrapping-key identifier. * This value is required when setting up key export. * @example mrk-fce09525e81587d23520f11e07e2e9d9 */ kwk_id: string; /** * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none. * @example TODO */ last_unstake: string; /** * Format: int32 * @description How many 'unstake' calls happened on the day when `last_unstake` was performed. */ last_unstake_day_count: number; /** * @description The human-readable name for the org * @example my_org_name */ name?: string | null; /** * @description The organization's notification endpoints, which are HTTPS URLs are notified about a * configurable set of events in an organization. For each event, CubeSigner sends a POST * request with a JSON-formatted body that contains the event details. * @example [ * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001", * "config": { * "url": "https://example.com/endpoint1" * }, * "status": "Confirmed" * }, * { * "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002", * "config": { * "filter": { * "OneOf": [ * "Eth2ConcurrentAttestationSigning", * "Eth2ConcurrentBlockSigning" * ] * }, * "url": "https://example.com/endpoint2" * }, * "status": "Pending" * } * ] */ notification_endpoints?: components["schemas"]["NotificationEndpoint"][]; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; passkey_configuration?: components["schemas"]["PasskeyConfig"]; /** * @description Org-wide policies that are checked before a key is used for signing * @example [ * { * "MaxDailyUnstake": 5 * } * ] */ policy?: Record[]; policy_engine_configuration?: components["schemas"]["PolicyEngineConfiguration"]; /** * @description Global sign policy that applies to every sign operation (every key, every role) in the org * @example [ * { * "TxReceiver": "0x0000000000000000000000000000000000000000" * } * ] */ sign_policy?: Record[]; /** * Format: int32 * @description The organization's currently configured TOTP failure limit, i.e., the number * of times a user can provide an incorrect TOTP code before being rate limited. * This value can be between 1 and 5 (inclusive). */ totp_failure_limit: number; /** * Format: int64 * @description The organization's currently configured user-export delay, i.e., the minimum * amount of time (in seconds) between when a user-export is initiated and when * it may be completed. (This value is meaningless for organizations that use * org-wide export.) */ user_export_delay: number; /** @description Whether user export is disabled */ user_export_disabled?: boolean; /** * Format: int64 * @description The organization's currently configured user-export window, i.e., the amount * of time (in seconds) between when the user-export delay is completed and when * the user export request has expired and can no longer be completed. (This value * is meaningless for organizations that use org-wide export.) */ user_export_window: number; webapp_enabled?: components["schemas"]["WebappEnabled"]; }; }; }; PaginatedAuditLogResponse: { content: { "application/json": { /** @description Audit log entries */ entries: components["schemas"]["AuditLogEntry"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedGetUsersInOrgResponse: { content: { "application/json": { /** @description The list of users in the org */ users: components["schemas"]["UserInOrgInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListBucketsResponse: { content: { "application/json": { /** @description The buckets in the organization. */ buckets: components["schemas"]["BucketInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListContactsResponse: { content: { "application/json": { /** @description A list of contacts in the organization, matching any provided queries. */ contacts: components["schemas"]["ContactInfoResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListHistoricalTxResponse: { content: { "application/json": { /** @description Historical transactions signed with the requested key, sorted from most to least recent. */ txs: components["schemas"]["HistoricalTx"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListInvitationsResponse: { content: { "application/json": { /** @description Pending invitations */ invitations: components["schemas"]["InvitationInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListKeyRolesResponse: { content: { "application/json": { /** @description All roles the key is in */ roles: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListKeysResponse: { content: { "application/json": { keys: components["schemas"]["KeyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListMfaResponse: { content: { "application/json": { /** @description All pending MFA requests */ mfa_requests: components["schemas"]["MfaRequestInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListPoliciesResponse: { content: { "application/json": { /** @description The Org's named policies. */ policies: components["schemas"]["PolicyInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRoleKeysResponse: { content: { "application/json": { /** @description All keys in a role */ keys: components["schemas"]["KeyInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRoleUsersResponse: { content: { "application/json": { /** @description All users in a role */ users: components["schemas"]["UserInRoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedListRolesResponse: { content: { "application/json": { /** @description All roles in an organization. */ roles: components["schemas"]["RoleInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedPolicyLogsResponse: { content: { "application/json": { /** @description The policy execution logs */ logs: { [key: string]: string; }[]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedQueryMetricsResponse: { content: { "application/json": { /** @description Advisory messages (e.g., if max number of results is reached). */ messages?: string[]; /** * Format: int64 * @description The period for which the statistic is computed, if any (not all metrics support splitting the requested time range into bins). * If set, equals to the value from the request rounded up to the closest multiple of 60. */ period?: number; /** @description Some metrics can optionally return the raw data, when requested. */ raw_data: { [key: string]: string; }[]; /** @description Computed data points. */ results: { /** @description The data points, one for each time period (time periods for which the value is 0 are omitted). */ data: { [key: string]: number; }; /** @description The metric dimensions. */ dimensions: { [key: string]: string; }; }[]; stat?: components["schemas"]["OrgMetricStat"] | null; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedSessionsResponse: { content: { "application/json": { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PaginatedUserExportListResponse: { content: { "application/json": { export_requests: components["schemas"]["UserExportInitResponse"][]; } & { /** * @description If set, the content of `response` does not contain the entire result set. * To fetch the next page of the result set, call the same endpoint * but specify this value as the 'page.start' query parameter. */ last_evaluated_key?: string | null; }; }; }; PasskeyAssertChallenge: { content: { "application/json": (components["schemas"]["ChallengePieces"] & { options: components["schemas"]["PublicKeyCredentialRequestOptions"]; }) & { /** @description The id of the challenge. Must be supplied when answering the challenge. */ challenge_id: string; }; }; }; /** @description Extended information about an existing MMI request. */ PendingMessageInfo: { content: { "application/json": { metadata: components["schemas"]["MmiMetadata"]; signedMessage?: components["schemas"]["SignedMessage"] | null; transaction?: components["schemas"]["TransactionAndStatus"] | null; } & { created_at: components["schemas"]["EpochDateTime"]; expires_at: components["schemas"]["EpochDateTime"]; /** @description The ID of the pending message */ id: string; /** @description The identity (a user or a role id) which created this message. */ identity: string; message_eip191?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; /** @description Hex-encoded (including a '0x' prefix) message to sign. */ message: string; } | null; message_eip712?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; data: components["schemas"]["TypedData"]; /** @enum {string} */ version: "v3" | "v4"; } | null; message_tx?: components["schemas"]["TypedTransaction"] | null; }; }; }; /** @description Extended information about an existing MMI message, including the signature. */ PendingMessageSignResponse: { content: { "application/json": ({ metadata: components["schemas"]["MmiMetadata"]; signedMessage?: components["schemas"]["SignedMessage"] | null; transaction?: components["schemas"]["TransactionAndStatus"] | null; } & { created_at: components["schemas"]["EpochDateTime"]; expires_at: components["schemas"]["EpochDateTime"]; /** @description The ID of the pending message */ id: string; /** @description The identity (a user or a role id) which created this message. */ identity: string; message_eip191?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; /** @description Hex-encoded (including a '0x' prefix) message to sign. */ message: string; } | null; message_eip712?: { /** * @description From address, hex-encoded, with leading '0x' * @example 0x0123456789012345678901234567890123456789 */ address: string; data: components["schemas"]["TypedData"]; /** @enum {string} */ version: "v3" | "v4"; } | null; message_tx?: components["schemas"]["TypedTransaction"] | null; }) & Record; }; }; /** @description A struct containing all the information about a specific version of a policy. */ PolicyInfo: { content: { "application/json": { /** @description The access-control entries for the policy. */ acl?: unknown[] | null; /** @description A list of entities (keys, roles, etc.) the policy is attached to. */ attached_to: components["schemas"]["PolicyAttachedToId"][]; created: components["schemas"]["EpochDateTime"]; edit_policy?: components["schemas"]["EditPolicy"]; /** @description User-defined metadata for the named policy. */ metadata?: unknown; /** @description The name of the policy. */ name: string; owner: components["schemas"]["Id"]; /** @description The policy id */ policy_id: string; policy_type: components["schemas"]["PolicyType"]; /** @description The policy rule. */ rules: unknown[]; /** * Format: int64 * @description The policy rule's version. */ version: number; }; }; }; /** * @description PolicyResultResponse is a wrapper on PolicyResult with two important * properties: * * derives OkToLogResponse, so that it can be used in the rocket handler. * * derives ToSchema and ToResponse, with the `val` field with value_type * Object, so that we don't have to provide all of the OpenAPI type * descriptions of a PolicyResult. * * The PolicyResult includes enums and other standard types (e.g. * std::time::Interval) which are nontrivial to represent in OpenAPI. Since * this endpoint is just for testing, we don't really care about how accurate * the schema is, and can lean on serde_json when decoding this response to a * PolicyResult in a client. Note that there is a bug in utoipa where the * value_type annotation will not work for a tuple-struct, only a struct with * fields. */ PolicyResultResponse: { content: { "application/json": { val: Record; }; }; }; /** @description A struct containing all non-secret information about policy secrets. */ PolicySecretsInfo: { content: { "application/json": components["schemas"]["CommonFields"] & { /** * @deprecated * @description The names of the secrets. */ names: string[]; /** @description The policy secrets. */ secrets: components["schemas"]["SecretInfo"][]; }; }; }; /** @description Response to a PSBT signing request */ PsbtSignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** * @description The PSBT in standard hex serialization, without leading "0x". * @example 70736274ff01005e... */ psbt: string; }; }; }; /** @description Public information about an organization. */ PublicOrgInfo: { content: { "application/json": { /** @description Explicitly configured (allowlisted) OpenID providers for an org */ oidc_issuers: { /** @description Intended audiences (client IDs) */ audiences: string[]; /** @description Issuer URL */ issuer: string; /** @description Optional issuer nickname */ nickname?: string | null; /** @description The user roles allowed to use this IDP */ users: components["schemas"]["MemberRole"][]; }[]; /** * @description Org identifier * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Whether logging in with just a passkey is allowed */ passkey_login_enabled: boolean; }; }; }; /** @description The metric data points. */ QueryMetricsResponse: { content: { "application/json": { /** @description Advisory messages (e.g., if max number of results is reached). */ messages?: string[]; /** * Format: int64 * @description The period for which the statistic is computed, if any (not all metrics support splitting the requested time range into bins). * If set, equals to the value from the request rounded up to the closest multiple of 60. */ period?: number; /** @description Some metrics can optionally return the raw data, when requested. */ raw_data: { [key: string]: string; }[]; /** @description Computed data points. */ results: { /** @description The data points, one for each time period (time periods for which the value is 0 are omitted). */ data: { [key: string]: number; }; /** @description The metric dimensions. */ dimensions: { [key: string]: string; }; }[]; stat?: components["schemas"]["OrgMetricStat"] | null; }; }; }; RoleInfo: { content: { "application/json": components["schemas"]["CommonFields"] & { /** * @description Whether the role is enabled * @example true */ enabled: boolean; /** @description Deprecated. The CubeSigner IDs of at most 100 keys associated with this role. */ keys?: components["schemas"]["KeyInRoleInfo"][] | null; /** * @description Whether the current user is a member of the role. This is always true, * except for owners who can see roles they are not members of. */ member: boolean; /** * @description The human-readable name for the role (must be alphanumeric) * @example my_role */ name?: string | null; /** * @description Policy that is checked whenever a key is accessed for signing via this role. * @example [ * { * "SourceIpAllowlist": [ * "123.456.78.9/16" * ] * }, * { * "RequireMfa": { * "count": 1 * } * } * ] */ policy?: Record[]; restricted_actions: components["schemas"]["RestrictedActionsMap"]; /** * @description The ID of the role * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b */ role_id: string; /** @description Deprecated. The list of at most 100 users with access to the role. */ users?: string[] | null; }; }; }; /** @description Response returned when requesting a role attestation. */ RoleInfoJwt: { content: { "application/json": { /** @description A JSON Web Token whose claims contain the `RoleInfo` structure. */ jwt: string; }; }; }; SessionInfo: { content: { "application/json": components["schemas"]["SessionMetadata"] & { /** * Format: int64 * @description Creation date (in seconds since unix epoch) */ created_at: number; /** * Format: int64 * @description Expiration date (in seconds since unix epoch) */ exp: number; last_used?: components["schemas"]["WhereAndWhen"] | null; lifetimes?: components["schemas"]["RatchetConfig"]; /** * @description A human-readable description for the session * @example OIDC login session */ purpose: string; /** * @description Lists user permission and access for the session * @example [ * "sign:*", * "manage:mfa:vote:cs" * ] */ scopes?: components["schemas"]["Scope"][]; /** * @description Session ID. Uniquely identifies the session, but cannot be used for auth. * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; }; /** @description The response from any operation operating on multiple sessions */ SessionsResponse: { content: { "application/json": { /** @description The list of sessions */ sessions: components["schemas"]["SessionInfo"][]; }; }; }; SignResponse: { content: { "application/json": { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { /** @description The hex-encoded resulting signature. */ signature: string; }; }; }; /** @description Returned upon a successful SIWE authentication. */ SiweCompleteResponse: { content: { "application/json": { /** @description The OIDC token corresponding to the user with the requested SIWE identity. */ id_token: string; }; }; }; /** * @description A challenge returned in response to a Sign-In with Ethereum request. * * Contains a message that the client must sign following EIP-191 * with the requested key in order to complete authentication. * * The client has until the message expires (but no more than 5 minutes) to complete the challenge. */ SiweInitResponse: { content: { "application/json": { /** @description The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) */ challenge_id: string; /** @description The message to sign following the EIP-191 standard. */ message: string; }; }; }; /** @description Returned upon a successful SIWS authentication. */ SiwsCompleteResponse: { content: { "application/json": { /** @description The OIDC token corresponding to the user with the requested SIWS identity. */ id_token: string; }; }; }; /** * @description A challenge returned in response to a Sign-In with Solana request. * * Contains a structured [SignInInput] that the client must render to its canonical text and sign * (ed25519) with the requested key in order to complete authentication. * * The client has until the message expires (but no more than 5 minutes) to complete the challenge. */ SiwsInitResponse: { content: { "application/json": { /** @description The ID of the challenge (to include in the request when calling the PATCH ('complete') endpoint) */ challenge_id: string; sign_in_input: components["schemas"]["SignInInput"]; }; }; }; StakeResponse: { content: { "application/json": ({ /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & { deposit_tx: components["schemas"]["DepositTxn"]; }) & { /** * @description The validator key id ("Key#...") * @example Key#db1731f8-3659-45c0-885b-e11e1f5b7be2 */ created_validator_key_id: string; }; }; }; TelegramAuthResponse: { content: { "application/json": { /** @description The OIDC token corresponding to this telegram user */ id_token: string; }; }; }; /** * @description OAuth2 standard Token Response. * * https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2 */ TokenResponse: { content: { "application/json": { /** @description The access token issued by the authorization server. */ access_token: string; expires_in: components["schemas"]["Seconds"]; /** @description An OIDC token issued by Cubist, containing user information */ id_token?: string | null; /** @description The refresh token issued by the authorization server. */ refresh_token?: string | null; /** @description The type of the token issued. Value is case insensitive. */ token_type: string; [key: string]: unknown; } & Record; }; }; TotpInfo: { content: { "application/json": { /** * @description The ID of the TOTP challenge. * @example TotpChallenge#7892ebba-563e-485b-bb7d-e26267363286 */ totp_id: string; /** * @description Standard TOTP url which includes everything needed to initialize TOTP. * @example otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist */ totp_url: string; }; }; }; /** @description Result of registering (resetting) TOTP */ TotpRegisterResponse: { content: { "application/json": { mfa?: components["schemas"]["MfaRequestInfo"]; status: components["schemas"]["StatusOk"]; }; }; }; /** @description A response to sign an eth2 unstake request. */ UnstakeResponse: { content: { "application/json": { message: components["schemas"]["VoluntaryExit"]; /** * @description BLS signature. * @example 0x910c7cd537ed91cc8c4a82f3cbd832e9be8c24a22e9c86df479f7ce42025ea6a09619b418b666a060e260d2aae31b8e50e9d05ca3442c7eed3b507e5207e14674275f68c2ba84c4bf6b8dd364a304acac8cfab3681e2514b4400f9242bc61164 */ signature: string; } & { /** @description Optional policy evaluation tree. */ policy_eval_tree?: components["schemas"]["PolicyEvalTree"] | null; } & Record; }; }; UpdateOrgResponse: { content: { "application/json": { alien_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description MFA types that are allowed to be used for implicitly security-sensitive * operations (like logging in, adding an MFA factor, exporting keys, etc.). */ allowed_mfa_types?: { [key: string]: components["schemas"]["MfaType"][]; } | null; custom_chains?: components["schemas"]["CustomChainsData"] | null; default_invite_kind?: components["schemas"]["InviteKind"] | null; edit_policy?: components["schemas"]["EditPolicy"] | null; email_preferences?: components["schemas"]["EmailPreferences"] | null; /** @description The new value of the 'enabled' property */ enabled?: boolean | null; ext_data?: | ({ /** * Format: int32 * @description Per alien user key count threshold, which, once exceeded, disallows further key creation by alien users. * * This setting is checked only when an alien user requests to create or import a new key. * In other words, org admins can still assign unlimited number of keys to their alien users. */ alien_key_count_threshold?: number | null; /** * @description Whether alien users are allowed to update their own key policies. * Defaults to 'false'. */ aliens_can_update_key_policy?: boolean | null; } & { created?: components["schemas"]["EpochDateTime"] | null; last_modified?: components["schemas"]["EpochDateTime"] | null; /** * Format: int64 * @description Version of this object */ version?: number; } & Record) | null; historical_data_configuration?: | components["schemas"]["HistoricalDataConfiguration"] | null; idp_configuration?: components["schemas"]["IdpConfig"] | null; key_export_requirement?: components["schemas"]["SecondFactorRequirement"] | null; member_login_requirement?: components["schemas"]["SecondFactorRequirement"] | null; /** * @description The new human-readable name for the org (must be alphanumeric) * @example my_org_name */ name?: string | null; /** * @description The new notification endpoint configurations * @example [ * { * "url": "https://example.com/endpoint" * } * ] */ notification_endpoints?: | components["schemas"]["NotificationEndpointConfiguration"][] | null; /** * @description The ID of the organization * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; passkey_configuration?: components["schemas"]["PasskeyConfig"] | null; /** * @description The new value of org-wide policies * @example [ * { * "MaxDailyUnstake": 5 * }, * { * "OriginAllowlist": [ * "https://example.com" * ] * } * ] */ policy?: Record[] | null; policy_engine_configuration?: components["schemas"]["PolicyEngineConfiguration"] | null; /** @description The new value of require_scope_ceiling */ require_scope_ceiling?: boolean | null; /** * @description The new value of the org-wide sign rules * @example [ * { * "TxReceiver": "0x0000000000000000000000000000000000000000" * } * ] */ sign_policy?: Record[] | null; /** * Format: int32 * @description The new value of the TOTP failure limit */ totp_failure_limit?: number | null; /** * Format: int64 * @description The new value of user-export delay */ user_export_delay?: number | null; /** @description The new value of user-export disabled */ user_export_disabled?: boolean | null; /** * Format: int64 * @description The new value of user-export window */ user_export_window?: number | null; /** * Format: int64 * @description New org version */ version: number; }; }; }; /** @description The response to a request for uploading a wasm policy */ UploadWasmPolicyResponse: { content: { "application/json": { /** @description A signed URL for uploading the requested wasm policy. */ signed_url: string; }; }; }; /** @description An encrypted user-export */ UserExportCompleteResponse: { content: { "application/json": { /** * @description The exported key material, encrypted with AES-256-GCM under a key * derived from the public key supplied in the request via HPKE (RFC9180) * with DHKEM(P-256, HKDF-SHA256) and base64 encoded. */ encrypted_key_material: string; /** * @description The ephemeral public key used for HPKE key derivation as base64-encoded * uncompressed SEC1 serialization. */ ephemeral_public_key: string; /** @description The user-id to which this key belongs. */ user_id: string; }; }; }; /** @description The response to a successful user-export init request */ UserExportInitResponse: { content: { "application/json": components["schemas"]["UserExportRequest"] & { /** * @description The key-id being requested. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; }; }; }; UserInOrgInfo: { content: { "application/json": { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; verified_email?: components["schemas"]["VerifiedEmail"] | null; }; }; }; UserInOrgInfoWithIdentity: { content: { "application/json": { /** * @description The user's email (optional) * @example alice@example.com */ email?: string | null; /** * @description The id of the user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ id: string; /** @description Whether the user has ever successfully logged in */ initialized?: boolean; membership: components["schemas"]["MemberRole"]; /** @description Optional user name. */ name?: string | null; status: components["schemas"]["MembershipStatus"]; verified_email?: components["schemas"]["VerifiedEmail"] | null; } & { /** @description Optional third-party identities via which the user was found */ identities?: components["schemas"]["IdentityInfo"][]; }; }; }; UserInfo: { content: { "application/json": { /** * @description Optional email * @example alice@example.com */ email?: string | null; /** @description All multi-factor authentication methods configured for this user */ mfa: components["schemas"]["ConfiguredMfa"][]; mfa_policy?: components["schemas"]["MfaPolicy"] | null; /** * @description Optional name * @example Alice */ name?: string | null; /** * @deprecated * @description All organizations the user belongs to. Deprecated in favor of 'orgs'. * @example [ * "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a" * ] */ org_ids: string[]; /** @description All organizations the user belongs to, including the membership role in each. */ orgs: components["schemas"]["UserInOrgMembership"][]; /** * @description The id of the currently logged in user * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */ user_id: string; verified_email?: components["schemas"]["VerifiedEmail"] | null; }; }; }; /** @description The response to the user/orgs endpoint */ UserOrgsResponse: { content: { "application/json": { /** @description The list of orgs this user is a member of */ orgs: components["schemas"]["OrgData"][]; }; }; }; }; parameters: never; requestBodies: never; headers: never; pathItems: never; } export type $defs = Record; export type external = Record; export interface operations { /** * User Info * @description User Info * * Retrieves information about the current user. * * PREFER `GET /v0/orgs/{org_id}/user/me` */ aboutMeLegacy: { responses: { 200: components["responses"]["UserInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * JWKS endpoint for the attestation key * @description JWKS endpoint for the attestation key * * Returns the public key used to sign Key info attestations. */ attestationJwkSet: { responses: { 200: components["responses"]["JwkSetResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List accessible organizations. * @description List accessible organizations. * * Unauthenticated endpoint for retrieving all organizations accessible to a user. * This information is emailed to the provided email address. */ email_my_orgs: { parameters: { query: { /** * @description The email of the user * @example alice@example.com */ email: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * (INTERNAL) Sentry API Proxy * @description (INTERNAL) Sentry API Proxy */ sentryApiCallPublic: { requestBody: { content: { "text/plain": string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * JWKS endpoint for MMI * @description JWKS endpoint for MMI * * Returns the public key used to sign JSON Web Tokens for MMI. */ mmiJwkSet: { responses: { 200: components["responses"]["JwkSetResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * MMI JSON-RPC endpoint * @description MMI JSON-RPC endpoint * * Handler for all [MMI JSON-RPC](https://docs.metamask-institutional.io/custodian-integration/integration-docs/api/methods) * requests. */ mmi: { requestBody: { content: { "application/json": components["schemas"]["Request"]; }; }; responses: { 200: components["responses"]["JrpcResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Token refresh endpoint, compliant with OAuth. * @description Token refresh endpoint, compliant with OAuth. * * The body content type can be either 'application/json' or 'application/x-www-form-urlencoded'. */ oauth2TokenRefresh: { requestBody: { content: { "application/json": components["schemas"]["TokenRequest"]; }; }; responses: { 200: components["responses"]["TokenResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Org * @description Get Org * * Retrieves information about an organization. */ getOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["OrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Org * @description Update Org * * Update organization attributes (enabled flag, name, and policies). */ updateOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateOrgRequest"]; }; }; responses: { 200: components["responses"]["UpdateOrgResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Query the audit log. * @description Query the audit log. */ queryAuditLog: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AuditLogRequest"]; }; }; responses: { 200: components["responses"]["PaginatedAuditLogResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Associate an OIDC identity with an arbitrary user in org . * @description Associate an OIDC identity with an arbitrary user in org . */ authMigrationIdentityAdd: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["MigrateIdentityRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Dissociate an OIDC identity from an arbitrary user in org . * @description Dissociate an OIDC identity from an arbitrary user in org . */ authMigrationIdentityRemove: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["MigrateIdentityRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update existing users' profiles. Currently supports only (re)setting emails. * @description Update existing users' profiles. Currently supports only (re)setting emails. */ authMigrationUserUpdate: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["MigrateUpdateUsersRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a serialized Avalanche C/X/P-Chain Message * @description Sign a serialized Avalanche C/X/P-Chain Message * * Signs an Avalanche message with a given SecpEth (C-Chain messages) or * SecpAva (X- and P-Chain messages) key. Currently signing C-Chain messages * with SecpEth key must also be explicitly allowed via `AllowRawBlobSigning` * policy. * * This is a pre-release feature. */ avaSerializedTxSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Avalanche chain * @example P */ ava_chain: string; /** * @description Avalanche address in bech32 or ETH format * @example 0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AvaSerializedTxSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign JSON-encoded Avalanche X- or P-Chain Message * @description Sign JSON-encoded Avalanche X- or P-Chain Message * * Signs an Avalanche message with a given SecpAva key. * This is a pre-release feature. */ avaSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Avalanche bech32 address format without the chain prefix * @example avax1am4w6hfrvmh3akduzkjthrtgtqafalce6an8cr */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AvaSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Babylon Covenant Committee Request * @description Sign Babylon Covenant Committee Request * * Signs transactions relevant to a Babylon covenant committee signer, * i.e., Schnorr and adaptor signatures for the unbonding, slashing, and * slash-unbonding outputs of a Babylon staking transaction. */ babylonCovSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description hex-encoded public key * @example 0x03e38106dd76656bc68d02898ede1a911df8c793e46ac4eb37d26c266aae5d2a5a */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BabylonCovSignRequest"]; }; }; responses: { 200: components["responses"]["BabylonCovSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create EOTS nonces * @description Create EOTS nonces * * Generates a set of Babylon EOTS nonces for a specified chain-id, starting at a * specified block height. */ createEotsNonces: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded public key of the EOTS key * @example 0x457f0f24cfb06c3c35874bbd1f59b57180a5a9d7e1f6929280839c830f5c147f */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EotsCreateNonceRequest"]; }; }; responses: { 200: components["responses"]["EotsCreateNonceResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create an EOTS signature * @description Create an EOTS signature * * Generates an EOTS signature for the specified chain-id, block height, and message. */ eotsSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded public key of the EOTS key * @example 0x457f0f24cfb06c3c35874bbd1f59b57180a5a9d7e1f6929280839c830f5c147f */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EotsSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Babylon Staking Registration * @description Sign Babylon Staking Registration * * Creates and signs the data needed to register a Phase-2 or Phase-3 * Babylon stake. This includes the deposit and unbonding transactions, * two slashing transactions, the slashing signatures, and the proof of * possession. * * Note that it is also possible to generate this registration data by * making four calls to the Babylon staking API, plus one call to the * PSBT signing API to generate the BIP-322 proof of possession. The * registration API generates the same data but is easier to use. * * Note that this action can only be called with a Taproot key. If your * deposit transaction spends UTXOs that are controlled by other keys, * you can submit the 'deposit' PSBT to the PSBT signing API one or more * times to generate the required signatures. * * For more information, consult the * [Babylon documentation](https://github.com/babylonlabs-io/babylon/blob/release/v1.x/docs/register-bitcoin-stake.md). * * This is a pre-release feature. */ babylonRegistration: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32 encoding of the public key * @example tb1pe4fgyn87pwku2xdptc2dtaeqzyx8wx89cqa6yntu8td49flpt5wq5k6hau */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BabylonRegistrationRequest"]; }; }; responses: { 200: components["responses"]["BabylonRegistrationResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Babylon Staking Transaction * @description Sign Babylon Staking Transaction * * Creates and signs transactions related to Babylon staking (i.e., * deposit, early unbond, withdrawal). The return value is a Pre-Signed * Bitcoin Transaction (PSBT), as defined in BIP-174, which matches the * format used in most Babylon tooling. * * The 'deposit' action can be used with either Segwit (i.e., SecpBtc/SecpBtcTest) * or Taproot (i.e., TaprootBtc/TaprootBtcTest) keys. The remaining actions can be * used only with Taproot keys. * * This is a pre-release feature. */ babylonStaking: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32 encoding of the public key * @example tb1pe4fgyn87pwku2xdptc2dtaeqzyx8wx89cqa6yntu8td49flpt5wq5k6hau */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BabylonStakingRequest"]; }; }; responses: { 200: components["responses"]["BabylonStakingResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a Bitcoin message. * @description Sign a Bitcoin message. * * Signs a message using BIP137 message signing with a given Secp256k1 key. */ btcMessageSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Address of a Segwit or Legacy bitcoin key * @example bc1q3r35u4th78h06d64mwmp3vpu8qmzya05pq8fwl */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BtcMessageSignRequest"]; }; }; responses: { 200: components["responses"]["BtcMessageSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a Partially Signed Bitcoin Transaction (PSBT) * @description Sign a Partially Signed Bitcoin Transaction (PSBT) * * Signs all inputs of the supplied PSBT v0 (BIP-174) that pertain to the * 'pubkey' specified in the request, which can be either a Taproot or a * Segwit key. For Segwit keys, CubeSigner-specific deterministic tweaking * can be applied to 'pubkey' before signing, on a per-input basis. (See the * CubeSigner documentation for more information on Segwit tweaking.) * * When calling with a segwit key the required scope is 'sign:btc:psbt:segwit'. * For a taproot key, the scope is 'sign:btc:psbt:taproot'. Either type of key * can be used with the 'sign:btc:psbt' scope. * * This is a pre-release feature. */ psbtSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32(m)-encoded segwit or taproot address * @example bc1p2wsldez5mud2yam29q22wgfh9439spgduvct83k3pm50fcxa5dps59h4z5 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["PsbtSignRequest"]; }; }; responses: { 200: components["responses"]["PsbtSignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Bitcoin Segwit Transaction * @description Sign Bitcoin Segwit Transaction * * Signs a Bitcoin Segwit transaction with a given key. * This is a pre-release feature. */ btcSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32-encoded segwit address * @example bc1q5p5qkae77ly80kr4pyfytdqm7rf08ddhdejl9g */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BtcSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Bitcoin Taproot Transaction * @description Sign Bitcoin Taproot Transaction * * Signs a Bitcoin Taproot transaction with a given key. * This is a pre-release feature. */ btcTaprootSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description bech32m-encoded taproot address * @example bc1p2wsldez5mud2yam29q22wgfh9439spgduvct83k3pm50fcxa5dps59h4z5 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TaprootSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Contacts * @description List Contacts * * List all contacts in the org. * Any org member is allowed to list all contacts in the org. * * ## Search Condition * The search condition is optional. * * - If the search condition starts with "label:...", this list will only hold contacts with * the label provided after the ":". For example, "label:cubist:erc20_token" would return contacts that * hold the label "cubist:erc20_token". * * - Otherwise, the result will contain only the contacts who have an address starting with, or * equaling, the given search string. For example, "0xee" would return all contacts holding an * address starting with "0xee". The search is case-insensitive. * * If a search term is defined, we do not guarantee * the number of results in a page. The behavior of this parameter may change * in the future (for example, making results more strictly paginated or * performing a fuzzy search rather than a prefix search). */ listContacts: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** @description Either 'label:...', which lists contacts with the label provided after the ':'. Or, an entire address, or prefix of an address, that returned contacts must have. When searching by address, it must be at least 3 characters. */ search?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListContactsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Contact * @description Create Contact * * Creates a new contact in the organization-wide address book. The * user making the request is the owner of the contact, giving them edit access * to the contact along with the org owners. */ createContact: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateContactRequest"]; }; }; responses: { 200: components["responses"]["ContactInfoResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Lookup Contacts by Address * @description Lookup Contacts by Address * * Returns all contacts in the org that have the given address. * * When querying with an EVM address without a chain, this endpoint returns * contacts with that address on *any* chain, including those without a chain * defined. */ lookupContactsByAddress: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["ContactAddressData"]; }; }; responses: { 200: components["responses"]["PaginatedListContactsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Contact * @description Get Contact * * Returns the properties of a Contact. */ getContact: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Contact * @example Contact#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ contact_id: string; }; }; responses: { 200: components["responses"]["ContactInfoResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Contact * @description Delete Contact * * Delete a contact, specified by its ID. * * Only the contact owner and org owners are allowed to delete contacts. * Additionally, the contact's edit policy (if set) must permit the deletion. */ deleteContact: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Contact * @example Contact#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ contact_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Contact * @description Update Contact * * Updates an existing contact in the organization-wide address book. Only * the contact owner or an org owner can update contacts. * * *Updates will overwrite the existing value of the field.* */ updateContact: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Contact * @example Contact#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ contact_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateContactRequest"]; }; }; responses: { 200: components["responses"]["ContactInfoResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get current counts of users and keys within an org. * @description Get current counts of users and keys within an org. */ counts: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["ComputeCountsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Derive Key From Long-Lived Mnemonic * @deprecated * @description Derive Key From Long-Lived Mnemonic * * Derives a key of a specified type using a supplied derivation path and an * existing long-lived mnemonic. */ deriveKeyLegacy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["DeriveKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Derive Key From New Or Existing Long-Lived Mnemonic * @description Derive Key From New Or Existing Long-Lived Mnemonic * * Uses either a new or existing long-lived mnemonic to derive keys of * one or more specified types via specified derivation paths. */ deriveKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["DeriveKeysRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Compute Diffie Hellman shared secret * @description Compute Diffie Hellman shared secret * * For a set of elliptic curve points (P_1, ..., P_i), computes the Diffie Hellman * shared secret (Q_1, ..., Qi) = (sk * P_1, ... sk * P_i), for sk the secret key. * Points are specified in a curve-dependent format. See CubeSigner documentation * for more details. * * The user can optionally specify a NIST P-256 public key, in which case the result * will be encrypted to the public key using RFC9180 HPKE(P-256, HKDF-SHA256) with * AES-256-GCM as the symmetric cipher. In this case, the resulting ciphertext will * contain a serialized JSON blob containing the vector of shared secrets in the same * order they were specified in the request. * * If the user does not specify a public key, the resulting shared secrets will be * returned unencrypted. In this case, the caller should sample a random value r * modulo the group order and mask the requested points as (r * P_1, ..., r * P_i). * The result will be (r * sk * P_1, ..., r * sk * P_i), which can be unmasked by * first computing r^-1, the multiplicative inverse of r modulo the group order, * then computing a scalar multiplication of each returned point with r^-1. * * There is little practical security difference between these two approaches. The * client is free to choose the one that is easier from an implementation perspective. */ diffieHellmanExchange: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["DiffieHellmanRequest"]; }; }; responses: { 200: components["responses"]["DiffieHellmanResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Email Template * @description Get Email Template * * Returns the email template for a given purpose. */ getEmailConfig: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Which email configuration to get */ purpose: | "otp" | "mfa_reset" | "otp_mfa" | "alien_password_reset" | "member_password_reset" | "alien_invite" | "member_invite" | "welcome"; }; }; responses: { 200: components["responses"]["GetEmailConfigResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Configure Email Template * @description Configure Email Template */ configureEmail: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Which email to configure */ purpose: | "otp" | "mfa_reset" | "otp_mfa" | "alien_password_reset" | "member_password_reset" | "alien_invite" | "member_invite" | "welcome"; }; }; requestBody: { content: { "application/json": components["schemas"]["ConfigureEmailRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Email Template * @description Delete Email Template */ deleteEmailConfig: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Which email configuration to delete */ purpose: | "otp" | "mfa_reset" | "otp_mfa" | "alien_password_reset" | "member_password_reset" | "alien_invite" | "member_invite" | "welcome"; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EIP-191 Data * @description Sign EIP-191 Data * * Signs a message using EIP-191 personal_sign with a given Secp256k1 key. */ eip191Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded EVM address of the Secp256k1 key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eip191SignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EIP-712 Typed Data * @description Sign EIP-712 Typed Data * * Signs typed data according to EIP-712 with a given Secp256k1 key. */ eip712Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded EVM address of the Secp256k1 key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eip712SignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign an EIP-7702 Authorization * @description Sign an EIP-7702 Authorization * * Signs an EIP-7702 authorization tuple `(chain_id, address, nonce)` with a given * Secp256k1 key. The resulting 65-byte signature (`r || s || y_parity`) can be used to * assemble a `SignedAuthorization` for an EIP-7702 set-code transaction. */ eip7702Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded EVM address of the Secp256k1 key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eip7702SignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get an Org-Export Ciphertext * @description Get an Org-Export Ciphertext * * Returns the export ciphertext associated with the provided key-id. * In order to use this API, you must be an org owner and your org must * be configured for org export and for API-based export delivery. */ getOrgExport: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["OrgExportResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List associated OIDC identities with the current user. * @description List associated OIDC identities with the current user. */ listOidcIdentities: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["ListIdentitiesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Associate an OIDC identity with the current user in org . * @description Associate an OIDC identity with the current user in org . * * Alien users are allowed to call this endpoint, but for them MFA is required * (unless they are registering an email-otp identity matching their current email); * additionally, limits may apply to how many identities that may register. */ addOidcIdentity: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddIdentityRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove an OIDC identity from the current user's account in org . * @description Remove an OIDC identity from the current user's account in org . */ removeOidcIdentity: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcIdentity"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create [IdentityProof] from CubeSigner user session * @description Create [IdentityProof] from CubeSigner user session * * This route can be used to prove to another party that a user has a * valid CubeSigner session. * * Clients are intended to call this route and pass the returned evidence * to another service which will verify it by making a request to `/v0/org//identity/verify`. */ createProofCubeSigner: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["IdentityProof"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create [IdentityProof] from OIDC token * @description Create [IdentityProof] from OIDC token * * Exchange an OIDC ID token (passed via the `Authorization` header) for a proof of authentication. * * This route can be used to prove to another party that a user has met the * authentication requirements (allowed issuers & audiences) for CubeSigner * without leaking their credentials. * * Clients are intended to call this route and pass the returned evidence to another service * which will verify it by making a request to `/v0/org//identity/verify`. */ createProofOidc: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["IdentityProof"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify identity proof * @description Verify identity proof * * Allows a third-party to validate proof of authentication. * * When a third-party is provided an [IdentityProof] object, they must check its * veracity by calling this endpoint */ verifyProof: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["IdentityProof"]; }; }; responses: {}; }; /** * Authenticate * @description Authenticate * * This endpoint exchanges an email & password for an OIDC token */ idpAuthenticate: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AuthenticationRequest"]; }; }; responses: { 200: components["responses"]["AuthenticationResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Request Password Reset * @description Request Password Reset * * This endpoint generates an OIDC token without a signature (of the form `{header}.{payload}.`), * and sends the signature to the user's email. Client applications can reconstruct the token * by concatenating the `{header}.{payload}.` with the signature, producing a valid OIDC token of * the form `{header}.{payload}.{signature}`. The token can then be used to authenticate the user * when performing the `idp_password_reset_confirm` request. */ idpPasswordResetRequest: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["PasswordResetRequest"]; }; }; responses: { 200: components["responses"]["EmailOtpResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Confirm Password Reset * @description Confirm Password Reset * * This endpoint allows IDP users to reset their password * using a token they have received in their email. */ idpPasswordResetConfirm: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["PasswordResetConfirmRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Key-Import Key * @description Create Key-Import Key * * Generate an ephemeral key that a client can use for key-import encryption. */ createKeyImportKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["CreateKeyImportKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Import Key * @description Import Key * * Securely imports an existing key using a previously generated key-import key. */ importKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["ImportKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Public Org Info * @description Public Org Info * * Unauthenticated endpoint that returns publicly-available information about an organization. */ public_org_info: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PublicOrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * (INTERNAL) Custom chain RPC proxy * @description (INTERNAL) Custom chain RPC proxy */ customChainRpcCall: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CustomChainRpcRequest"]; }; }; responses: { 200: components["responses"]["CustomChainRpcResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * (INTERNAL) Esplora API Proxy * @description (INTERNAL) Esplora API Proxy */ esploraApiCall: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EsploraRequest"]; }; }; responses: { 200: components["responses"]["EsploraResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * (INTERNAL) Authenticated Sentry API Proxy * @description (INTERNAL) Authenticated Sentry API Proxy */ sentryApiCall: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "text/plain": string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Accept an invitation * @description Accept an invitation * * This endpoint allows idp users to register using a token they have received in their email */ invitationAccept: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["InvitationAcceptRequest"]; }; }; responses: {}; }; /** * List pending invitations * @description List pending invitations * * Returns all pending invitations for the organization, i.e., those that have neither * been accepted nor canceled, and have not expired. */ listInvitations: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** @description Membership roles. If defined, only invitations for one of these roles are returned, grouped by role in descending role order (owners first, aliens last). */ membership?: components["schemas"]["MemberRole"][] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListInvitationsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Cancel a pending invitation * @description Cancel a pending invitation * * Removes a pending invitation from the organization. If no pending invitation * exists for the given email address, a not-found error is returned. */ cancelInvitation: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CancelInvitationRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Invite User * @description Invite User * * Creates a new user in an existing org and sends that user an invite email. */ invite: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["InviteRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Keys * @description List Keys * * Gets the list of accessible keys in a given org (to org owner, all org keys * are accessible; to members, only their own keys are accessible). * * If a search condition is, the result will contain only the keys whose either * material ID or metadata contain the search condition string. * * NOTE that if pagination is used and a page limit is set, the returned result * set may contain either FEWER or MORE elements than the requested page limit. */ listKeysInOrg: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** * @description Filter by key type * @example SecpEthAddr */ key_type?: components["schemas"]["KeyType"] | null; /** * @description Filter by key owner * @example User#5269c579-b4f9-4620-9e90-e46a5a0ffb4d */ key_owner?: components["schemas"]["Id"] | null; /** * @description Search key metadata * @example some value */ search?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListKeysResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Key * @description Create Key * * Creates one or more new keys of the specified type. */ createKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateKeyRequest"]; }; }; responses: { 200: components["responses"]["CreateKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Key * @description Get Key * * Returns the properties of a key. */ getKeyInOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["KeyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Key * @description Delete Key * * Deletes a key specified by its ID. * * Only the key owner and org owners are allowed to delete keys. * Additionally, the role's edit policy (if set) must permit the update. */ deleteKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Key * @description Update Key * * Enable or disable a key. The user must be the owner of the key or * organization to perform this action. * * For each requested update, the session must have the corresponding 'manage:key:update:_' scope; * if no updates are requested, the session must have 'manage:key:get'. */ updateKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateKeyRequest"]; }; }; responses: { 200: components["responses"]["KeyInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Attest to Key Properties * @description Attest to Key Properties * * The response is a JWT whose claims are the key properties. */ attestKey: { parameters: { query?: { include_roles?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["KeyInfoJwt"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Key Roles * @description List Key Roles * * Get all roles the key is in */ listKeyRoles: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["PaginatedListKeyRolesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Historical Transactions * @description List Historical Transactions * * Returns a sorted, paginated list of transactions signed by a given key, * ordered from most recent first. */ listHistoricalKeyTx: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["PaginatedListHistoricalTxResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Key by Material ID * @description Get Key by Material ID * * Returns the properties of a key. */ getKeyByMaterialId: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description Type of the key to look up */ key_type: string; /** @description Material ID of the key to look up */ material_id: string; }; }; responses: { 200: components["responses"]["KeyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Query org metrics. * @description Query org metrics. * * Metrics summarize usage information about your CubeSigner organization over time. For example, * you can call this endpoint find out: * * - the average number of keys over the last month, * - the average number monthly users over the last year, * - the total number of transactions signed last week, * - how the number of different API requests was trending day-by-day over the last week/month/year, etc. * * Each metric kind can have one or more dimensions, to further specify the org property it describes. * For example, the `UserCount` metrics have a membership dimensions to specify the kind of user membership * in the organization ("Owner" vs. "Member" vs. "Alien"). */ queryMetrics: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["QueryMetricsRequest"]; }; }; responses: { 200: components["responses"]["PaginatedQueryMetricsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Pending MFA Requests * @description List Pending MFA Requests * * Retrieves and returns all pending MFA requests that are accessible to the current session, * i.e., those created by the current session identity plus those in which the current user * is listed as an approver * * NOTE that if pagination is used and a page limit is set, the returned result * set may contain either FEWER or MORE elements than the requested page limit. * In particular, legacy MFA requests are not paginated: every accessible one * is returned in the first page, on top of the page limit. */ mfaList: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListMfaResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Pending MFA Request * @description Get Pending MFA Request * * Retrieves and returns a pending MFA request by its id. */ mfaGet: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Approve or Reject MFA Request * @description Approve or Reject MFA Request * * Approve or reject request after logging in with CubeSigner. * * If approving, adds the currently-logged user as an approver * of a pending MFA request of the [Status::RequiredApprovers] kind. If the required number of * approvers is reached, the MFA request is approved; the confirmation receipt can be used to * resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteCs: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate an Email OTP MFA Approval/Rejection * @description Initiate an Email OTP MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using Email OTP. */ mfaEmailInit: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["EmailOtpResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize a Email OTP MFA Approval/Rejection. * @description Finalize a Email OTP MFA Approval/Rejection. * * The request should contain the full JWT obtained by concatenating the * partial token returned by the `mfa_email_init` endpoint and the signature * emailed to the user issuing the request. * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteEmailComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EmailOtpAnswer"]; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate a FIDO MFA Approval/Rejection * @description Initiate a FIDO MFA Approval/Rejection * * Initiates the approval/rejection process of an MFA Request using FIDO. */ mfaFidoInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; responses: { 200: components["responses"]["FidoAssertChallenge"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize a FIDO MFA Approval/Rejection * @description Finalize a FIDO MFA Approval/Rejection * * If approving, adds an approver to a pending MFA request. * If the required number of approvers is reached, the MFA request is approved; * the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteFidoComplete: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoAssertAnswer"]; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Approve/Reject a TOTP MFA Request * @description Approve/Reject a TOTP MFA Request * * If approving, adds the current user as approver to a pending MFA request by * providing TOTP code. If the required number of approvers is reached, the MFA request is * approved; the confirmation receipt can be used to resume the original HTTP request. * * If rejecting, immediately deletes the pending MFA request. */ mfaVoteTotp: { parameters: { query?: { mfa_vote?: components["schemas"]["MfaVote"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired MfaRequest * @example MfaRequest#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ mfa_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["MfaRequestInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List pending MMI requests * @description List pending MMI requests * * Retrieves and returns all pending MMI messages accessible to the current session identity, i.e., * - a role session can access only the messages created by that role * - a user session can access the messages created by either that user or any role which the user is a member of */ mmiMessageList: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["ListPendingMessagesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get an MMI request * @description Get an MMI request * * Retrieves a pending MMI request by its ID. */ mmiMessageGet: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired PendingMessage * @example PendingMessage#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ msg_id: string; }; }; responses: { 200: components["responses"]["PendingMessageInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete an MMI request * @description Delete an MMI request * * Rejects an existing MMI request and then deletes it from the database. */ mmiMessageDelete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired PendingMessage * @example PendingMessage#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ msg_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Reject an MMI request * @description Reject an MMI request * * Rejects a pending MMI request. The record of the MMI request is kept in * the database until it expires or is explicitly deleted. * * Returns the updated request information. */ mmiMessageReject: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired PendingMessage * @example PendingMessage#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ msg_id: string; }; }; requestBody?: { content: { "application/json": components["schemas"]["MmiRejectRequest"] | null; }; }; responses: { 200: components["responses"]["PendingMessageInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Approve and sign an MMI request * @description Approve and sign an MMI request * * Signs a pending request that was generated through the MMI JSON RPC endpoint. * The signature is stored with the pending message and the updated request info is returned. * * The message should be associated with the organization this is called from, * and the user should be the owner of the corresponding message's key. */ mmiMessageSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired PendingMessage * @example PendingMessage#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ msg_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["PendingMessageInfo"]; }; }; responses: { 200: components["responses"]["PendingMessageSignResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Mint an OIDC ID token for Twitter * @description Mint an OIDC ID token for Twitter * * This function acts identically to Twitter's [`oauth2/token`](https://developer.twitter.com/en/docs/authentication/api-reference/token) endpoint, * but extends the output with an `id_token`. * * This `id_token` can then be used with any CubeSigner endpoint that requires an OIDC token. * Callers must request *at least* scopes `tweet.read` and `users.read` during auth with twitter. * * By default, the id token does not contain a confirmed email; * callers can request this field be populated by requesting the `users.email` scope * and adding `fetch_email` as a URL parameter to this route. * * * > [!IMPORTANT] * > This endpoint will fail unless the org is configured to allow the issuer `https://shim.oauth2.cubist.dev/twitter` and client ID being used for Twitter. */ oauth2Twitter: { parameters: { query?: { fetch_email?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": { [key: string]: string; }; }; }; responses: { 200: components["responses"]["TokenResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Login with OIDC * @description Login with OIDC * * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session. * * MFA is required when: * - an MFA policy is explicitly attached to the user logging in * (e.g., an org owner can do that at user creation time to require certain kind of MFA) * - the user has at least 1 MFA factor configured */ oidcAuth: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcLoginRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate login via email token * @description Initiate login via email token * * This endpoint generates an OIDC token without a signature (of the form `header.payload.`), and sends the signature to the user's email. * Client applications can reconstruct the token by concatenating the `partial_token` with the signature, producing a valid OIDC token of the form `header.payload.signature` * The token can then be used to authenticate the user. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > 1. Allow the issuer `https://shim.oauth2.cubist.dev/email-otp` and client ID being the Org ID * > 2. Have an email sender configured for OTPs */ emailOtpAuth: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EmailOtpRequest"]; }; }; responses: { 200: components["responses"]["EmailOtpResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate login via Sign-in With Ethereum (SIWE). * @description Initiate login via Sign-in With Ethereum (SIWE). * * This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) * to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard * OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID */ siweInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SiweInitRequest"]; }; }; responses: { 200: components["responses"]["SiweInitResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete login via Sign-in With Ethereum (SIWE) * @description Complete login via Sign-in With Ethereum (SIWE) * * If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint * generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siwe` with the Org ID as the client ID */ siweComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SiweCompleteRequest"]; }; }; responses: { 200: components["responses"]["SiweCompleteResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate login via Sign-in With Solana (SIWS). * @description Initiate login via Sign-in With Solana (SIWS). * * This endpoint generates a challenge which can be answered (via the corresponding PATCH endpoint) * to obtain an OIDC token. The OIDC token can then be exchanged for a user session via the standard * OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID */ siwsInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SiwsInitRequest"]; }; }; responses: { 200: components["responses"]["SiwsInitResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete login via Sign-in With Solana (SIWS) * @description Complete login via Sign-in With Solana (SIWS) * * If the challenge (issued by the corresponding POST endpoint) is answered correctly, this endpoint * generates an OIDC token that can then be exchanged for a user session via the standard OIDC auth route. * * > [!IMPORTANT] * > For this endpoint to succeed, the org must be configured to: * > Allow the issuer `https://shim.oauth2.cubist.dev/siws` with the Org ID as the client ID */ siwsComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SiwsCompleteRequest"]; }; }; responses: { 200: components["responses"]["SiwsCompleteResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Allows a user to authenticate with the telegram API using the tgWebAppData value * @description Allows a user to authenticate with the telegram API using the tgWebAppData value * The token has the following properties: * - The `sub` field is the telegram user ID * - The `iss` field depends on the chosen environment: * - `https://shim.oauth2.cubist.dev/telegram/production` for the production environment * - `https://shim.oauth2.cubist.dev/telegram/test` for the test environment * - The `aud` field is the provided telegram bot ID * - The `exp` field is derived from the `auth_date` field in the telegram data * * Fails if the telegram data is invalid or the signature is invalid */ telegramAuth: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TelegramAuthRequest"]; }; }; responses: { 200: components["responses"]["TelegramAuthResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Org * @description Create Org * * Creates a new organization. The new org is a child of the * current org and inherits its key-export policy. The new org * is created with one owner, the caller of this API. */ createOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateOrgRequest"]; }; }; responses: { 200: components["responses"]["OrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Policies * @description List Policies * * Returns the list of all policies in the Org. */ listPolicies: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** * @description The optional type of policies to return * @example Key */ policy_type?: components["schemas"]["PolicyType"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListPoliciesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Policy * @description Create Policy * * Creates a new named policy in the organization. The user making the request is the * owner of the policy, giving them edit access to the policy along with the org owners. */ createPolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreatePolicyRequest"]; }; }; responses: { 200: components["responses"]["PolicyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Policy * @description Delete Policy * * Delete the named policy with the given name or id. */ deletePolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired NamedPolicy * @example NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ policy_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Policy * @description Update Policy * * Updates the policy with the given name or id. */ updatePolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired NamedPolicy * @example NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ policy_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdatePolicyRequest"]; }; }; responses: { 200: components["responses"]["PolicyInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Policy Logs * @description Get Policy Logs * * Returns the logs for the given policy, within the given timeframe. */ getPolicyLogs: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired NamedPolicy * @example NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ policy_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["PolicyLogsRequest"]; }; }; responses: { 200: components["responses"]["PaginatedPolicyLogsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Policy * @description Get Policy * * Returns the specified version or latest of a named policy with the given name or id. */ getPolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired NamedPolicy * @example NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ policy_id: string; /** * @description The policy version, either 'latest' or 'v'. * @example latest */ version: string; }; }; responses: { 200: components["responses"]["PolicyInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Invoke Policy * @description Invoke Policy * * Invokes the [NamedPolicy] with the given ID with the given request information. * It is only supported for Wasm policies. */ invokePolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired NamedPolicy * @example NamedPolicy#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ policy_id: string; /** * @description The policy version, either 'latest' or 'v'. * @example latest */ version: string; }; }; requestBody: { content: { "application/json": components["schemas"]["InvokePolicyRequest"]; }; }; responses: { 200: components["responses"]["InvokePolicyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Buckets * @description List Buckets * * List available meta information about all policy KV store buckets in the org. */ listPolicyBuckets: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListBucketsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Bucket * @description Get Bucket * * Returns the meta information of a policy KV store bucket. */ getPolicyBucket: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; bucket_name: string; }; }; responses: { 200: components["responses"]["BucketInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Bucket * @description Update Bucket * * Updates meta information for an existing policy KV store bucket. */ updatePolicyBucket: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; bucket_name: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateBucketRequest"]; }; }; responses: { 200: components["responses"]["BucketInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Policy Import Key * @description Create Policy Import Key * * Generate an ephemeral key that a client can use for encrypting data related to Wasm * policies (e.g., policy secrets). */ createPolicyImportKey: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["CreatePolicyImportKeyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get the org-wide policy secrets. * @description Get the org-wide policy secrets. * * Note that this only returns the keys for the secrets, omitting the values. * The values are secret and are not accessible outside Wasm policy execution. */ getPolicySecrets: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PolicySecretsInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update org-level policy secrets * @description Update org-level policy secrets * * The provided secrets will replace any existing org-level secrets. * It fails if the secrets weren't previously created. * * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ updatePolicySecrets: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdatePolicySecretsRequest"]; }; }; responses: { 200: components["responses"]["PolicySecretsInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create or overwrite an org-level policy secret. * @description Create or overwrite an org-level policy secret. * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ setPolicySecret: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; secret_name: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SetPolicySecretRequest"]; }; }; responses: { 200: components["responses"]["PolicySecretsInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete an org-level policy secret. * @description Delete an org-level policy secret. * Must be permitted by the policy secret's edit policy if set, and the org's edit policy otherwise. */ deletePolicySecret: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; secret_name: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["PolicySecretsInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Upload Wasm Policy * @description Upload Wasm Policy * * Returns a signed URL for uploading a wasm policy to CubeSigner. The policy will be * deleted if not attached to a [NamedPolicy] soon after the upload has been completed. */ uploadWasmPolicy: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UploadWasmPolicyRequest"]; }; }; responses: { 200: components["responses"]["UploadWasmPolicyResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Roles * @description List Roles * * Retrieves all roles in an organization that the current user is allowed to access. */ listRoles: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** @description Don't include keys and users for each role */ summarize?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRolesResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Role * @description Create Role * * Creates a new role in an organization. Unless the logged-in user * is the owner, they are automatically added to the newly created role. */ createRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; /** @description Optional request body to set the role name */ requestBody?: { content: { "application/json": components["schemas"]["CreateRoleRequest"] | null; }; }; responses: { 200: components["responses"]["CreateRoleResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Role * @description Get Role * * Retrieves information about a role in an organization */ getRole: { parameters: { query?: { summarize?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["RoleInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete Role * @description Delete Role * * Deletes a role in an organization. * * Only users in the role can perform this action. * Additionally, the role's edit policy (if set) must permit the update. */ deleteRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update Role * @description Update Role * * Enables or disables a role (this requires the `manage:role:update:enable` scope). * Updates the role's policies (this requires the `manage:role:update:policy` scope). * Updates the role's edit policies (this requires the `manage:role:update:editPolicy` scope). * * The user must be in the role or an owner of the organization. * Additionally, the role's edit policy (if set) must permit the update. */ updateRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateRoleRequest"]; }; }; responses: { 200: components["responses"]["RoleInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Add Keys * @description Add Keys * * Adds a list of existing keys to an existing role. * * The key owner is allowed to add their key to any role that they are in. * * In "org custody" model only, org owners are allowed to add any key to any role. * * In all cases: the role's edit policy, as well as the edit policy of each of the keys, must permit the update. * * Each request to this endpoint can add, at maximum, 32 keys. */ addKeysToRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddKeysToRoleRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Add User * @description Add User * * Adds an existing user to an existing role. * * Only users in the role or org owners can add users to a role. * Additionally, the role's edit policy (if set) must permit the update. */ addUserToRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Attest to Role Properties * @description Attest to Role Properties * * The response is a JWT whose claims are the requested role properties. */ attestRole: { parameters: { query?: { /** * @description Role properties to include in an attestation. Defaults to basic role * properties, including associated users, but excluding associated keys. */ verbosity?: components["schemas"]["RoleAttestationVerbosity"]; /** * @description Associated keys filter, i.e., when specified, out all other associated * keys are filtered out. Defaults to including all associated keys. */ key_filter?: components["schemas"]["Id"] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["RoleInfoJwt"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Role Keys * @description List Role Keys * * Returns an array of all keys in a role. */ listRoleKeys: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRoleKeysResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get a Key in Role * @description Get a Key in Role * * Returns the key-in-role information for a given key and role. If `details` is set to `true`, * this endpoint returns detailed key information. */ getRoleKey: { parameters: { query?: { /** * @description Whether to include detailed key information * @example true */ details?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; responses: { 200: components["responses"]["KeyInRoleInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove Key * @description Remove Key * * Removes a given key from a role. * * Only users in the role or org owners can remove keys from a role. * Additionally, both the role's and the key's edit policy must permit the update. */ removeKeyFromRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create Token * @description Create Token * * Creates a new access token for a given role (to be used as "API Key" for all signing actions). * The `restricted_actions` field on the [Role] determines the membership role that is required to * create tokens. */ createRoleToken: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateTokenRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Historical Transactions * @description List Historical Transactions * * Returns a sorted, paginated list of transactions signed by the given role, * ordered from most recent first. */ listHistoricalRoleTx: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["PaginatedListHistoricalTxResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List Role Users. * @description List Role Users. * * Returns an array of all users who have access to a role. */ listRoleUsers: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; }; }; responses: { 200: components["responses"]["PaginatedListRoleUsersResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove User * @description Remove User * * Removes an existing user from an existing role. * * Only users in the role or org owners can remove users from a role. * Additionally, the role's edit policy (if set) must permit the update. */ removeUserFromRole: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired Role * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * High-level RPC endpoint. * @description High-level RPC endpoint. */ rpcApi: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["JsonRpcRequest"]; }; }; responses: { 200: components["responses"]["JsonRpcResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List sessions * @description List sessions * * If no query parameters are provided, all active sessions for the current user are returned. * * If a `role` query parameter is provided, all active sessions for the selected role are returned * (asserting first that the current user has permissions to read sessions for that role). * * If a `role_created_by` query parameter is provided, all active **role** sessions created by that * user are returned (gated by the same permissions as listing that user's own sessions: the * current user must be that user or an org owner). When combined with `role`, the result is * further restricted to the sessions created by that user for the given role; the permission model * is unchanged. The `user` selector cannot be combined with `role` or `role_created_by`. */ listSessions: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** * @description If provided, the name or ID of a role to operate on. * Cannot be specified together with `user`, but may be combined with `role_created_by` * to operate on the role sessions created by a given user for this specific role. * @example my-role */ role?: string | null; /** * @description If provided, the ID of a user to operate on. * Cannot be specified together with other selectors. * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user?: string | null; /** * @description If provided, the ID of the user whose created role sessions to operate on. * Selects all *role* sessions created by that user (user sessions are not affected). * Cannot be specified together with `user`. When combined with `role`, the selection is * further restricted to the sessions created by that user for the given role. * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_created_by?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedSessionsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Create new user session (management and/or signing) * @description Create new user session (management and/or signing) * * Creates a new user session, silently truncating requested session and auth lifetimes to be at * most requestor's session and auth lifetime, respectively. To extend the requested lifetimes past * the requestor's, set the `extend_lifetimes` flag in the request body (in which case MFA will * be required). */ createSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CreateSessionRequest"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke ALL existing user or role session(s) * @description Revoke ALL existing user or role session(s) * * Immediately revokes existing sessions, preventing them from being used or refreshed. * * If no query params are provided, **ALL** sessions for the **CURRENT USER** are revoked * (to revoke just the current user session, use `DELETE /v0/org//session/self`) * * If a `role` query parameter is provided, **ALL** session for **THAT ROLE** are revoked * (if the current user has permissions to revoke sessions for the role). * * If a `role_created_by` query parameter is provided, **ROLE** sessions created by **THAT USER** * are revoked (gated by the same permissions as revoking that user's own sessions: the current * user must be that user or an org owner). User sessions are not affected. Unless the current * user is an org owner, only sessions for roles the current user is **still a member of** are * revoked (so a user cannot revoke sessions for a role they have since been removed from); org * owners revoke across all roles. * * If **both** a `role` and a `role_created_by` query parameter are provided, the selection above * is narrowed to only the sessions created by **THAT USER** for **THAT ROLE**. The permission * model is unchanged from the `role_created_by`-only case (the current user must be that user or * an org owner, and non-owners are still limited to roles they are a member of); `role` is purely * an additional filter. * * The `user` selector cannot be combined with `role` or `role_created_by`. */ revokeSessions: { parameters: { query?: { /** * @description If provided, the name or ID of a role to operate on. * Cannot be specified together with `user`, but may be combined with `role_created_by` * to operate on the role sessions created by a given user for this specific role. * @example my-role */ role?: string | null; /** * @description If provided, the ID of a user to operate on. * Cannot be specified together with other selectors. * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user?: string | null; /** * @description If provided, the ID of the user whose created role sessions to operate on. * Selects all *role* sessions created by that user (user sessions are not affected). * Cannot be specified together with `user`. When combined with `role`, the selection is * further restricted to the sessions created by that user for the given role. * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ role_created_by?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["SessionsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke current session * @description Revoke current session * * Immediately revokes the current session, preventing it from being used or refreshed */ revokeCurrentSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get session information * @description Get session information */ getSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The ID of the session to get or 'self' for current session * @example 1c0d853d-c15f-42dc-a82c-9874e589bc75 */ session_id: string; }; }; responses: { 200: components["responses"]["SessionInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Revoke a session * @description Revoke a session * * Immediately revokes an existing session, preventing it from being used or refreshed */ revokeSession: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The ID of the session to revoke * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e */ session_id: string; }; }; responses: { 200: components["responses"]["SessionInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Solana Message * @description Sign Solana Message * * Signs a Solana message with a given key. * This is a pre-release feature. */ solanaSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description The base58-encoded public key * @example 86ZRPszBp5EoPj7wR3bHn7wnAZ5iYfpasRc7DKFPTUaZ */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SolanaSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a serialized SUI transaction. * @description Sign a serialized SUI transaction. * * This is a pre-release feature. */ suiSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded SUI key address * @example 0xdd68d35a778db1e3123c950e5db5361333f57733a77486a704dd8c994d96761d */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["SuiSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign a tendermint message. * @description Sign a tendermint message. * * Signs the given base-64 encoded vote or proposal with the given tendermint key. */ tendermintSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded validator public key with 0x prefix * @example 0x7d8d344e6e53151692fa78a098630799946ad4d6a027ae6bcd7a78dc78281650 */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TendermintSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get Token-Accessible Keys * @description Get Token-Accessible Keys * * Retrieves the keys that a user or role session can access. */ listTokenKeys: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["KeyInfos"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * User Info * @description User Info * * Retrieves information about the current user. */ aboutMe: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["UserInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate Reset Verified Email Flow * @description Initiate Reset Verified Email Flow */ userResetEmailInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EmailResetRequest"]; }; }; responses: { 200: components["responses"]["EmailOtpResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize a Reset Verified Email Flow * @description Finalize a Reset Verified Email Flow */ userResetEmailComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["EmailOtpAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List outstanding user-export requests * @description List outstanding user-export requests */ userExportList: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** * @description If provided, the user-id whose user-export requests to list. Defaults to the * current user. Only the org owner may list requests for another user. * @example User#806c9544-f1fa-4bad-8d4d-1097a1844726 */ user_id?: string | null; /** * @description If provided, the key-id for which to list an existing user-export request. * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedUserExportListResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate a user-export request * @description Initiate a user-export request * * This starts a delay (whose length is determined by Org-wide settings) * before export can be completed, and returns a ticket that can be used * to complete the export once the timer has expired. * * Only one user-export request can be active for a given key. If there * is already an active export, this endpoint will return an error. To * create a new request, first delete the existing one. */ userExportInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UserExportInitRequest"]; }; }; responses: { 200: components["responses"]["UserExportInitResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete an existing user-export request * @description Delete an existing user-export request */ userExportDelete: { parameters: { query: { /** * @description The key-id whose export request should be deleted * @example Key#0x3c4d90Cc5Af1644C3A3B013Baa5488997381D7C8 */ key_id: string; /** * @description The user-id who owns this request. If omitted, defaults to the current user. * Only the org owner may delete user-export requests for another user. * @example User#806c9544-f1fa-4bad-8d4d-1097a1844726 */ user_id?: string | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete a user-export request * @description Complete a user-export request * * This endpoint can be called only after initiating a user-export request via * the `user_export_init` API, and only within the subsequent export window * (i.e., after the export delay has passed and before the request has expired). * * To check on the status of an export request, see the `user_export_list` API. */ userExportComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UserExportCompleteRequest"]; }; }; responses: { 200: components["responses"]["UserExportCompleteResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate registration of a FIDO key. * @description Initiate registration of a FIDO key. * * If a discoverable key is requested, user verification (PIN) is required. * * Generates a challenge that must be answered to prove ownership of a key. */ userRegisterFidoInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoCreateRequest"]; }; }; responses: { 200: components["responses"]["FidoCreateChallengeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize registration of a FIDO key * @description Finalize registration of a FIDO key * * Accepts the response to the challenge generated by the POST to this endpoint. */ userRegisterFidoComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["FidoCreateChallengeAnswer"]; }; }; responses: { 200: components["responses"]["FidoRegisterResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete FIDO key * @description Delete FIDO key * * Deletes a FIDO key from the user's account (if the key is not the sole MFA factor). MFA is always required. */ userDeleteFido: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Name or ID of the desired FidoKey * @example FidoKey#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ fido_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initialize TOTP Reset * @description Initialize TOTP Reset * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ userResetTotpInit: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody?: { content: { "application/json": components["schemas"]["TotpResetRequest"] | null; }; }; responses: { 200: components["responses"]["TotpInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Delete TOTP * @description Delete TOTP * * Deletes TOTP from the user's account (if TOTP is not the sole MFA factor). MFA is always required. */ userDeleteTotp: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize resetting TOTP * @description Finalize resetting TOTP * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ userResetTotpComplete: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpChallengeAnswer"]; }; }; responses: { 200: components["responses"]["TotpRegisterResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify TOTP * @description Verify TOTP * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ userVerifyTotp: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * List users in organization * @description List users in organization * * If a query is defined, the result will contain only the users whose name or * email contain the query string. NOTE that if pagination is used and a page * limit is set, the returned result set may contain FEWER elements than the * requested page limit. */ listUsersInOrg: { parameters: { query?: { /** * @description Max number of items to return per page. * * If the actual number of returned items may be less that this, even if there exist more * data in the result set. To reliably determine if more data is left in the result set, * inspect the [UnencryptedLastEvalKey] value in the response object. */ "page.size"?: number; /** * @description The start of the page. Omit to start from the beginning; otherwise, only specify a * the exact value previously returned as 'last_evaluated_key' from the same endpoint. */ "page.start"?: string | null; /** @description A query string. If defined, all returned users will contain this string in their name or email. */ q?: string | null; /** @description Membership roles. If defined, only users with one of these roles in the org are returned, grouped by role in descending role order (owners first, aliens last). */ membership?: components["schemas"]["MemberRole"][] | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; responses: { 200: components["responses"]["PaginatedGetUsersInOrgResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Add a third-party user to the org * @description Add a third-party user to the org */ createOidcUser: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AddThirdPartyUserRequest"]; }; }; responses: { 200: components["responses"]["AddThirdPartyUserResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get user by email. * @description Get user by email. * * The search includes all users and their third-party identities. */ getUserInOrgByEmail: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description The email associated with the user. */ email: string; }; }; responses: { 200: components["responses"]["GetUserByEmailResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove a third-party user from the org * @description Remove a third-party user from the org */ deleteOidcUser: { parameters: { query?: { revoke_role_sessions_they_created?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["OidcIdentity"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get a user by their OIDC identity * @description Get a user by their OIDC identity * * Retrieves a user in the organization by their OIDC issuer and subject. */ getUserInOrgByOidc: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** @description The OIDC issuer. */ iss: string; /** @description The OIDC subject. */ sub: string; }; }; responses: { 200: components["responses"]["GetUserByOidcResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initialize MFA reset for user * @description Initialize MFA reset for user */ resetMemberMfa: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["MfaResetRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete MFA reset for user * @description Complete MFA reset for user */ completeResetMemberMfa: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["CompleteMfaResetRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Get user by id * @description Get user by id * * If the requesting user is an owner of the org, the response additionally * includes the user's OIDC identities. */ getUserInOrg: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; responses: { 200: components["responses"]["UserInOrgInfoWithIdentity"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Remove a user from the org * @description Remove a user from the org */ deleteUser: { parameters: { query?: { revoke_role_sessions_they_created?: boolean | null; }; path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Empty"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Update a user's membership in the org * @description Update a user's membership in the org * * Enable/disable another user in the org, or change their membership role. */ updateUserMembership: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired User * @example User#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ user_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UpdateUserMembershipRequest"]; }; }; responses: { 200: components["responses"]["UserInOrgInfo"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate Login with Passkey * @description Initiate Login with Passkey * * The response contains a FIDO challenge that the client must answer with any of their * discoverable credentials. The answer should be submitted with the corresponding PATCH request. */ passkeyAuthInit: { requestBody: { content: { "application/json": components["schemas"]["LoginRequest"]; }; }; responses: { 200: components["responses"]["PasskeyAssertChallenge"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Complete Login with Passkey * @description Complete Login with Passkey * * The request should contain an answer to the challenge issued by the corresponding POST request. * The challenge may be answered with any of the user's discoverable credentials; if the credential * included in the answer is registered with a user and an organization, the response will contain * a CubeSigner session (with the parameters supplied in the previous POST request) for that user * in that organization. */ passkeyAuthComplete: { requestBody: { content: { "application/json": components["schemas"]["PasskeyAssertAnswer"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initiate registration of a FIDO key * @deprecated * @description Initiate registration of a FIDO key * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/fido` instead. * * Generates a challenge that must be answered to prove ownership of a key */ registerFidoInitLegacy: { requestBody: { content: { "application/json": components["schemas"]["FidoCreateRequest"]; }; }; responses: { 200: components["responses"]["FidoCreateChallengeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize registration of a FIDO key * @deprecated * @description Finalize registration of a FIDO key * * DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/fido` instead. * * Accepts the response to the challenge generated by the POST to this endpoint. */ registerFidoCompleteLegacy: { requestBody: { content: { "application/json": components["schemas"]["FidoCreateChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Initialize TOTP Reset * @deprecated * @description Initialize TOTP Reset * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp` instead. * * Creates a new TOTP challenge that must be answered to prove that the new TOTP * was successfully imported into an authenticator app. * * This operation is allowed if EITHER * - the user account is not yet initialized and no TOTP is already set, OR * - the user has not configured any auth factors; * otherwise, MFA is required. */ resetTotpInitLegacy: { requestBody?: { content: { "application/json": components["schemas"]["TotpResetRequest"] | null; }; }; responses: { 200: components["responses"]["TotpInfo"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Finalize resetting TOTP * @deprecated * @description Finalize resetting TOTP * * DEPRECATED. Use `PATCH /v0/org/{org_id}/user/me/totp` instead. * * Checks if the response contains the correct TOTP code corresponding to the * challenge generated by the POST method of this endpoint. */ resetTotpCompleteLegacy: { requestBody: { content: { "application/json": components["schemas"]["TotpChallengeAnswer"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Verify TOTP * @deprecated * @description Verify TOTP * * DEPRECATED. Use `POST /v0/org/{org_id}/user/me/totp/verify` instead. * * Checks if a given code matches the current TOTP code for the current user. * Errors with 403 if the current user has not set up TOTP or the code fails verification. */ verifyTotpLegacy: { requestBody: { content: { "application/json": components["schemas"]["TotpApproveRequest"]; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Retrieves all the orgs the user is a part of * @description Retrieves all the orgs the user is a part of */ userOrgs: { responses: { 200: components["responses"]["UserOrgsResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Raw Blob * @description Sign Raw Blob * * Signs an arbitrary blob with a given key. * * - ECDSA signatures are serialized as big-endian r and s plus recovery-id * byte v, which can in general take any of the values 0, 1, 2, or 3. * * - EdDSA signatures are serialized in the standard format. * * - BLS signatures are not supported on the blob-sign endpoint. */ blobSign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description ID of the desired Key * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ key_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["BlobSignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Record heartbeat * @description Record heartbeat * * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch. */ cube3signerHeartbeat: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody?: { content: { "application/json": components["schemas"]["HeartbeatRequest"] | null; }; }; responses: { 200: components["responses"]["EmptyImpl"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign EVM Transaction * @description Sign EVM Transaction * * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key. * Returns an RLP-encoded transaction with EIP-155 signature. * * The key must be associated with the role and organization on whose behalf this action is called. */ eth1Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded ethereum address of the secp key * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eth1SignRequest"]; }; }; responses: { 200: components["responses"]["Eth1SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Validator Request * @description Sign Validator Request * * Signs an eth2 validator request with a given BLS key. * * The key must be associated with the role and organization on whose behalf this action is called. */ eth2Sign: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded validator (BLS) public key with 0x prefix * @example 0x9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["Eth2SignRequest"]; }; }; responses: { 200: components["responses"]["SignResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Stake Deposit * @description Sign Stake Deposit * * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the * provided validator key. Otherwise, we generate a new BLS key. * * When using a pregenerated key, the key must be associated with the role and organization on whose * behalf this action is called. */ stake: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["StakeRequest"]; }; }; responses: { 200: components["responses"]["StakeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Sign Unstake Request * @description Sign Unstake Request * * Handle unstaking request, producing a signed voluntary exit message * that can be posted directly to the Beacon chain. * * The key must be associated with the role and organization on whose behalf this action is called. */ unstake: { parameters: { path: { /** * @description Name or ID of the desired Org * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; /** * @description Hex-encoded validator (BLS) public key * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c */ pubkey: string; }; }; requestBody: { content: { "application/json": components["schemas"]["UnstakeRequest"]; }; }; responses: { 200: components["responses"]["UnstakeResponse"]; 202: { content: { "application/json": components["schemas"]["AcceptedResponse"]; }; }; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; /** * Refresh Signer Session * @description Refresh Signer Session */ signerSessionRefresh: { parameters: { path: { /** * @description ID of the organization owning the key * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a */ org_id: string; }; }; requestBody: { content: { "application/json": components["schemas"]["AuthData"]; }; }; responses: { 200: components["responses"]["NewSessionResponse"]; default: { content: { "application/json": components["schemas"]["ErrorResponse"]; }; }; }; }; }