@cubist-labs/cubesigner-sdk 0.1.23

package/src/schema.ts

@@ -0,0 +1,3054 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+
+/** OneOf type helpers */
+type Without<T, U> = { [P in Exclude<keyof T, keyof U>]?: never };
+type XOR<T, U> = (T | U) extends object ? (Without<T, U> & U) | (Without<U, T> & T) : T | U;
+type OneOf<T extends any[]> = T extends [infer Only] ? Only : T extends [infer A, infer B, ...infer Rest] ? OneOf<[XOR<A, B>, ...Rest]> : never;
+
+export interface paths {
+  "/v0/about_me": {
+    /**
+     * User Info
+     * @description User Info
+     *
+     * Retrieves information about the current user.
+     */
+    get: operations["aboutMe"];
+  };
+  "/v0/org/{org_id}": {
+    /**
+     * Get Org
+     * @description Get Org
+     *
+     * Retrieves information about an organization.
+     */
+    get: operations["getOrg"];
+    /**
+     * Update Org
+     * @description Update Org
+     *
+     * Update organization attributes (enabled flag, name, and policies).
+     */
+    patch: operations["updateOrg"];
+  };
+  "/v0/org/{org_id}/btc/sign/{pubkey}": {
+    /**
+     * Sign Bitcoin Transaction
+     * @description Sign Bitcoin Transaction
+     *
+     * Signs a Bitcoin transaction with a given key.
+     * This is a pre-release feature.
+     */
+    post: operations["btcSign"];
+  };
+  "/v0/org/{org_id}/import_key": {
+    /**
+     * Create Key-Import Key
+     * @description Create Key-Import Key
+     *
+     * Generate an ephemeral key that a client can use for key-import encryption.
+     */
+    get: operations["createKeyImportKey"];
+    /**
+     * Import Key
+     * @description Import Key
+     *
+     * Securely imports an existing key using a previously generated key-import key.
+     */
+    put: operations["importKey"];
+  };
+  "/v0/org/{org_id}/invite": {
+    /**
+     * Invite User
+     * @description Invite User
+     *
+     * Creates a new user in an existing org and sends that user an invite email.
+     */
+    post: operations["invite"];
+  };
+  "/v0/org/{org_id}/keys": {
+    /**
+     * List Keys
+     * @description List Keys
+     *
+     * Gets the list of owned keys in a given org.
+     */
+    get: operations["listKeysInOrg"];
+    /**
+     * Import Key (Deprecated)
+     * @description Import Key (Deprecated)
+     *
+     * Securely imports an existing key. This API is deprecated; please use the new version.
+     */
+    put: operations["importKeyLegacy"];
+    /**
+     * Create Key
+     * @description Create Key
+     *
+     * Creates one or more new keys of the specified type (BLS or Secp).
+     */
+    post: operations["createKey"];
+  };
+  "/v0/org/{org_id}/keys/get_keys": {
+    /**
+     * Legacy List Keys
+     * @deprecated
+     * @description Legacy List Keys
+     *
+     * This route is deprecated. Use `GET /v0/org/<org_id>/keys?<key_type>`
+     */
+    post: operations["listKeysLegacy"];
+  };
+  "/v0/org/{org_id}/keys/{key_id}": {
+    /**
+     * Get Key
+     * @description Get Key
+     *
+     * Returns the properties of a key.
+     */
+    get: operations["getKeyInOrg"];
+    /**
+     * Update Key
+     * @description Update Key
+     *
+     * Enable or disable a key.  The user must be the owner of the key or organization to perform this action.
+     */
+    patch: operations["updateKey"];
+  };
+  "/v0/org/{org_id}/mfa/{mfa_id}": {
+    /**
+     * Gets a Pending MFA Request
+     * @description Gets a Pending MFA Request
+     *
+     * Retrieves and returns a pending MFA request by its id.
+     */
+    get: operations["mfaGet"];
+    /**
+     * Approve a Pending MFA Request
+     * @description Approve a Pending MFA Request
+     *
+     * Adds the current user as an approver of a pending MFA request of the [Status::RequiredApprovers] kind.
+     * If the required number of approvers is reached, the MFA request is approved;
+     * the confirmation receipt can be used to resume the original HTTP request.
+     */
+    patch: operations["mfaApproveCs"];
+  };
+  "/v0/org/{org_id}/mfa/{mfa_id}/totp": {
+    /**
+     * Approve a TOTP MFA Request
+     * @description Approve a TOTP MFA Request
+     *
+     * Adds an approver to a pending TOTP MFA request.
+     *
+     * If the required number of approvers is reached, the MFA request is approved;
+     * the confirmation receipt can be used to resume the original HTTP request.
+     */
+    patch: operations["mfaApproveTotp"];
+  };
+  "/v0/org/{org_id}/oidc": {
+    /**
+     * Login with OIDC
+     * @description Login with OIDC
+     *
+     * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session
+     */
+    post: operations["oidcAuth"];
+  };
+  "/v0/org/{org_id}/roles": {
+    /**
+     * List Roles
+     * @description List Roles
+     *
+     * Retrieves all roles in an organization that the current user is allowed to access.
+     */
+    get: operations["listRoles"];
+    /**
+     * Create Role
+     * @description Create Role
+     *
+     * Creates a new role in an organization. Unless the logged-in user
+     * is the owner, they are automatically added to the newly created role.
+     */
+    post: operations["createRole"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}": {
+    /**
+     * Get Role
+     * @description Get Role
+     *
+     * Retrieves information about a role in an organization
+     */
+    get: operations["getRole"];
+    /**
+     * Delete Role
+     * @description Delete Role
+     *
+     * Deletes a role in an organization.
+     * Only organization owners can perform this action.
+     */
+    delete: operations["deleteRole"];
+    /**
+     * Update Role
+     * @description Update Role
+     *
+     * Enables or disables a role.
+     * The user must be in the role or an owner of the organization.
+     */
+    patch: operations["updateRole"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}/add_keys": {
+    /**
+     * Add Keys
+     * @description Add Keys
+     *
+     * Adds a list of existing keys to an existing role.
+     */
+    put: operations["addKeysToRole"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}/add_user/{user_id}": {
+    /**
+     * Add User
+     * @description Add User
+     *
+     * Adds an existing user to an existing role.
+     * Only users in the role or owners can add users to a role.
+     */
+    put: operations["addUserToRole"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}/keys/{key_id}": {
+    /**
+     * Remove Key
+     * @description Remove Key
+     *
+     * Removes a given key from a role
+     */
+    delete: operations["removeKeyFromRole"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}/tokens": {
+    /**
+     * List Tokens
+     * @description List Tokens
+     *
+     * Returns all access tokens for a given role.
+     * Only users in the role or owners can create a token for it.
+     */
+    get: operations["listRoleTokens"];
+    /**
+     * Create Token
+     * @description Create Token
+     *
+     * Creates a new access token for a given role (to be used as "API Key" for all signing actions).
+     * Only users in the role or owners can create a token for it.
+     */
+    post: operations["createRoleToken"];
+    /**
+     * Revoke All Tokens
+     * @description Revoke All Tokens
+     *
+     * Revokes all access tokens associated with a role.
+     * Only users in the role or owners can perform this action.
+     */
+    delete: operations["revokeAllRoleTokens"];
+  };
+  "/v0/org/{org_id}/roles/{role_id}/tokens/{session_id}": {
+    /**
+     * Revoke Token
+     * @description Revoke Token
+     *
+     * Revokes an access token associated with a role.
+     * Only users in the role or owners can perform this action.
+     */
+    delete: operations["revokeRoleToken"];
+  };
+  "/v0/org/{org_id}/token/keys": {
+    /**
+     * Get Token-Accessible Keys
+     * @description Get Token-Accessible Keys
+     *
+     * Retrieves the keys that the role token can access.
+     */
+    get: operations["listTokenKeys"];
+  };
+  "/v0/org/{org_id}/users": {
+    /**
+     * List users in organization
+     * @description List users in organization
+     */
+    get: operations["listUsersInOrg"];
+    /**
+     * Adds a third-party user to the org
+     * @description Adds a third-party user to the org
+     */
+    post: operations["createOidcUser"];
+  };
+  "/v0/totp": {
+    /**
+     * Reset TOTP
+     * @description Reset TOTP
+     *
+     * Creates and sets a new TOTP configuration for the current user,
+     * overriding the existing one (if any).
+     */
+    patch: operations["userResetTotp"];
+  };
+  "/v0/totp/verify/{code}": {
+    /**
+     * Verify TOTP
+     * @description Verify TOTP
+     *
+     * Checks if a given code matches the current TOTP code for the current user.
+     * Errors with 403 if the current user has not set up TOTP or the code fails verification.
+     */
+    get: operations["userVerifyTotp"];
+  };
+  "/v1/org/{org_id}/blob/sign/{key_id}": {
+    /**
+     * Sign Raw Blob
+     * @description Sign Raw Blob
+     *
+     * Signs an arbitrary blob with a given key.
+     * This is a pre-release feature.
+     */
+    post: operations["blobSign"];
+  };
+  "/v1/org/{org_id}/cube3signer/heartbeat": {
+    /**
+     * Record heartbeat
+     * @description Record heartbeat
+     *
+     * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch.
+     */
+    post: operations["cube3signerHeartbeat"];
+  };
+  "/v1/org/{org_id}/eth1/sign/{pubkey}": {
+    /**
+     * Sign EVM Transaction
+     * @description Sign EVM Transaction
+     *
+     * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key.
+     *
+     * The key must be associated with the role and organization on whose behalf this action is called.
+     */
+    post: operations["eth1Sign"];
+  };
+  "/v1/org/{org_id}/eth2/sign/{pubkey}": {
+    /**
+     * Sign Validator Request
+     * @description Sign Validator Request
+     *
+     * Signs an eth2 validator request with a given BLS key.
+     *
+     * The key must be associated with the role and organization on whose behalf this action is called.
+     */
+    post: operations["eth2Sign"];
+  };
+  "/v1/org/{org_id}/eth2/stake": {
+    /**
+     * Sign Stake Deposit
+     * @description Sign Stake Deposit
+     *
+     * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the
+     * provided validator key. Otherwise, we generate a new BLS key.
+     *
+     * When using a pregenerated key, the key must be associated with the role and organization on whose
+     * behalf this action is called.
+     */
+    post: operations["stake"];
+  };
+  "/v1/org/{org_id}/eth2/unstake/{pubkey}": {
+    /**
+     * Sign Unstake Request
+     * @description Sign Unstake Request
+     *
+     * Handle unstaking request, producing a signed voluntary exit message
+     * that can be posted directly to the Beacon chain.
+     *
+     * The key must be associated with the role and organization on whose behalf this action is called.
+     */
+    post: operations["unstake"];
+  };
+  "/v1/org/{org_id}/solana/sign/{pubkey}": {
+    /**
+     * Sign Solana Message
+     * @description Sign Solana Message
+     *
+     * Signs a Solana message with a given key.
+     * This is a pre-release feature.
+     */
+    post: operations["solanaSign"];
+  };
+  "/v1/org/{org_id}/token/refresh": {
+    /**
+     * Refresh Signer Session
+     * @description Refresh Signer Session
+     */
+    patch: operations["signerSessionRefresh"];
+  };
+}
+
+export type webhooks = Record<string, never>;
+
+export interface components {
+  schemas: {
+    AcceptedResponse: components["schemas"]["ErrorResponse"] & Record<string, never>;
+    /**
+     * @description Different responses we return for status code "202 Accepted".
+     *
+     * Even though "202 Accepted" is a successful response, we represent
+     * it as a Rust error because that makes it easy to have route handlers
+     * return `Result<T, SignerError>` where `T` is the type of the
+     * response for the status code "200 Ok".
+     */
+    AcceptedValue: {
+      MfaRequired: {
+        id: string;
+      };
+    };
+    AddKeysToRoleRequest: {
+      /**
+       * @description A list of keys to add to a role
+       * @example [
+       *   "Key#63023a27-1e70-430a-b293-ffbc9d6c4484"
+       * ]
+       */
+      key_ids: string[];
+      /**
+       * @description Optional policies to apply for each key
+       * @example [
+       *   {
+       *     "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa"
+       *   },
+       *   {
+       *     "TxDeposit": {
+       *       "kind": "Canonical"
+       *     }
+       *   },
+       *   {
+       *     "RequireMfa": {
+       *       "kind": {
+       *         "RequiredApprovers": {
+       *           "count": 1
+       *         }
+       *       },
+       *       "restricted_operations": [
+       *         "Eth1Sign",
+       *         "BlobSign"
+       *       ]
+       *     }
+       *   }
+       * ]
+       */
+      policy: Record<string, never>[] | null;
+    };
+    AddThirdPartyUserRequest: {
+      identity: components["schemas"]["OIDCIdentity"];
+      role: components["schemas"]["MemberRole"];
+    };
+    ApprovalInfo: {
+      timestamp: components["schemas"]["EpochDateTime"];
+    };
+    /** @description Data required for both `authenticate` and `refresh`. */
+    AuthData: {
+      /** Format: int32 */
+      epoch_num: number;
+      epoch_token: components["schemas"]["B32"];
+      other_token: string;
+    };
+    /** @description Wrapper around a zeroizing 32-byte fixed-size array */
+    B32: string;
+    /**
+     * @example {
+     *   "message_base64": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTYK"
+     * }
+     */
+    BlobSignRequest: {
+      /**
+       * @description The blob to sign, encoded as a base64 string.
+       *
+       * Note that certain signing keys impose additional requirements on the contents of
+       * the message. For example, Secp256k1 keys require that the message is 32 bytes long.
+       */
+      message_base64: string;
+    };
+    /** @enum {string} */
+    BtcSighashType: "All" | "None" | "Single" | "AllPlusAnyoneCanPay" | "NonePlusAnyoneCanPay" | "SinglePlusAnyoneCanPay";
+    BtcSignRequest: {
+      sig_kind: components["schemas"]["BtcSignatureKind"];
+      /** @description The bitcoin transaction to sign */
+      tx: Record<string, never>;
+    };
+    BtcSignatureKind: {
+      /** @description Segregated Witness */
+      Segwit: {
+        /**
+         * @description Transaction input index
+         * @example 0
+         */
+        input_index: number;
+        /**
+         * @description Script
+         * @example 0x76a91479091972186c449eb1ded22b78e40d009bdf008988ac
+         */
+        script_code: string;
+        sighash_type: components["schemas"]["BtcSighashType"];
+        /**
+         * Format: int64
+         * @description Amount in satoshis
+         * @example 1000000
+         */
+        value: number;
+      };
+    };
+    /**
+     * @description Session information sent to the client.
+     * This struct works in tandem with its server-side counterpart [`SessionData`].
+     */
+    ClientSessionInfo: {
+      /** @description Token to use for authorization. */
+      auth_token: string;
+      auth_token_exp: components["schemas"]["EpochDateTime"];
+      /**
+       * Format: int32
+       * @description Epoch at which the token was last refreshed
+       */
+      epoch: number;
+      epoch_token: components["schemas"]["B32"];
+      /** @description Token to use for refreshing the `(auth, refresh)` token pair */
+      refresh_token: string;
+      refresh_token_exp: components["schemas"]["EpochDateTime"];
+      /** @description Session ID */
+      session_id: string;
+    };
+    ConfiguredMfa: OneOf<["Totp", {
+      /** @description Named FIDO device (multiple can be configured per user, but the names must be different) */
+      Fido: string;
+    }]>;
+    CreateKeyRequest: {
+      /**
+       * Format: int64
+       * @description Chain id for which the key is allowed to sign messages
+       * @example 5
+       */
+      chain_id: number | null;
+      /**
+       * Format: int32
+       * @description Number of keys to create
+       * @example 1
+       */
+      count: number;
+      key_type: components["schemas"]["KeyType"];
+      /**
+       * @description Allows users to specify a user other than themselves to receive the key
+       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+       */
+      owner: string | null;
+    };
+    /** @description Optional create role request body */
+    CreateRoleRequest: {
+      /**
+       * @description A human-readable name for the role.
+       * @example my_role
+       */
+      name: string;
+    };
+    CreateTokenRequest: components["schemas"]["RatchetConfig"] & {
+      /**
+       * @description A human readable description of the purpose of the key
+       * @example Validator Signing
+       */
+      purpose: string;
+    };
+    /**
+     * @description Information produced by a successful deposit
+     * @example {
+     *   "chain_id": 5,
+     *   "deposit_txn": {
+     *     "data": "0x...",
+     *     "to": "0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b",
+     *     "value": "0x1bc16d674ec800000"
+     *   },
+     *   "new_validator_pk": "9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da"
+     * }
+     */
+    DepositTxn: {
+      /**
+       * Format: int64
+       * @description Chain ID for which the deposit transaction was created
+       */
+      chain_id: number;
+      /** @description The deposit transaction. Includes only `to`, `value`, and `data` fields. */
+      deposit_txn: Record<string, never>;
+      /** @description The hex-encoded compressed form of the new validator BLS public key */
+      new_validator_pk: string;
+    };
+    /**
+     * @description The type of deposit to perform
+     * @enum {string}
+     */
+    DepositType: "Canonical" | "Wrapper";
+    /**
+     * @description Epoch is a quoted `uint64`.
+     * @example 256
+     */
+    Epoch: string;
+    /**
+     * Format: int64
+     * @description DateTime measured in seconds since unix epoch.
+     * A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]
+     * representing the number of seconds since [`SystemTime::UNIX_EPOCH`].
+     */
+    EpochDateTime: number;
+    /** @description The structure of ErrorResponse must match the response template that AWS uses */
+    ErrorResponse: {
+      accepted?: components["schemas"]["AcceptedValue"] | null;
+      /** @description Error message */
+      message: string;
+    };
+    /**
+     * @example {
+     *   "chain_id": 43113,
+     *   "tx": {
+     *     "chain_id": "0xa869",
+     *     "gas": "0x61a80",
+     *     "maxFeePerGas": "0x9502F900",
+     *     "maxPriorityFeePerGas": "0x50",
+     *     "nonce": "0xb",
+     *     "to": "0xf00ba12f00000000b4121200000f00c0ffeef00d",
+     *     "type": "0x02",
+     *     "value": "0x10000000000"
+     *   }
+     * }
+     */
+    Eth1SignRequest: {
+      /**
+       * Format: int64
+       * @description The chain id to set in the given transaction.
+       */
+      chain_id: number;
+      /**
+       * @description EIP-2718 typed transaction (see the [ethers-rs
+       * interface](https://docs.rs/ethers/latest/ethers/types/struct.Eip1559TransactionRequest.html)) types, including EIP-1559 transactions (`{ "type": "0x02" ... }`), and legacy
+       * transactions (`{ "type": "0x00" ... }`). All values in the transaction are expected
+       * to be (0x-prefixed or not) hex strings or byte arrays.
+       */
+      tx: Record<string, never>;
+    };
+    /**
+     * @example {
+     *   "eth2_sign_request": {
+     *     "aggregation_slot": {
+     *       "slot": "36"
+     *     },
+     *     "fork_info": {
+     *       "fork": {
+     *         "current_version": "0x42424242",
+     *         "epoch": "0",
+     *         "previous_version": "0x42424242"
+     *       },
+     *       "genesis_validators_root": "0x9d13d61212c067e02ce8e608a7007e2c3b02571e9e6f27ff45dfa91bf27c870b"
+     *     },
+     *     "signingRoot": "0x9c57e77c4965727542b9337df6756f948464bca3859bea6ed3c0ec6600d8982a",
+     *     "type": "AGGREGATION_SLOT"
+     *   },
+     *   "network": "mainnet"
+     * }
+     */
+    Eth2SignRequest: {
+      /**
+       * @description Subset of the Web3Signer Eth2 BLS signing request whose schema is defined
+       * [here](https://consensys.github.io/web3signer/web3signer-eth2.html#tag/Signing/operation/ETH2_SIGN).
+       * We handle deposits and voluntary exits separately.
+       */
+      eth2_sign_request: Record<string, never>;
+      network: components["schemas"]["Network"];
+    };
+    /**
+     * @description Specifies a fork of the `BeaconChain`, to prevent replay attacks.
+     * The schema of `Fork` is defined in the [Beacon chain
+     * spec](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#fork).
+     * @example {
+     *   "current_version": "0x00001020",
+     *   "epoch": "0",
+     *   "previous_version": "0x00001020"
+     * }
+     */
+    Fork: {
+      /**
+       * @description Current fork version.
+       * @example 0x43434343
+       */
+      current_version: string;
+      epoch: components["schemas"]["Epoch"];
+      /**
+       * @description Previous fork version.
+       * @example 0x42424242
+       */
+      previous_version: string;
+    };
+    /**
+     * @description Genesis data as defined in the [Beacon API
+     * spec](https://ethereum.github.io/beacon-APIs/#/Beacon/getGenesis).
+     * You can get the genesis data from the Beacon node's `/eth/v1/beacon/genesis` end-point.
+     * This struct definition is originally from lighthouse's eth2.
+     */
+    GenesisData: {
+      /**
+       * @description Genesis fork version.
+       * @example 0x42424242
+       */
+      genesis_fork_version: string;
+      /**
+       * @description Genesis time
+       * @example 1679326449
+       */
+      genesis_time: string;
+      /**
+       * @description Genesis validators root.
+       * @example 0x270d43e74ce340de4bca2b1936beca0f4f5408d9e78aec4850920baf659d5b69
+       */
+      genesis_validators_root: string;
+    };
+    GetKeysInOrgRequest: {
+      key_type: components["schemas"]["KeyType"] | null;
+    };
+    /** @description Stats pertaining the the sender `cube3signer` instance */
+    HeartbeatRequest: {
+      /**
+       * Format: int64
+       * @description Number of requests currently active (received but not necessarily being processed yet)
+       */
+      current_num_requests_active: number;
+      /**
+       * Format: int64
+       * @description Number of requests currently being processed by cube3signer
+       */
+      current_num_requests_processing: number;
+      /**
+       * Format: int64
+       * @description Number of new requests during this heartbeat period
+       */
+      num_requests: number;
+      /**
+       * Format: int64
+       * @description Number of requests that failed during this heartbeat period
+       */
+      num_requests_failed: number;
+      /**
+       * Format: int64
+       * @description Number of requests were retried during this heartbeat period
+       */
+      num_requests_retried: number;
+      /**
+       * Format: int64
+       * @description Number of retries during this heartbeat period
+       */
+      num_retries: number;
+      /**
+       * Format: int64
+       * @description Number of times auth token was refreshed during this heartbeat period
+       */
+      num_token_refreshes?: number;
+      /**
+       * Format: int64
+       * @description Number of times auth token refresh failed during this heartbeat period
+       */
+      num_token_refreshes_failed?: number;
+      /**
+       * @description Version of the proxy sending the heart beat request
+       *
+       * TODO: Make non-optional once we do not support proxies without version information
+       */
+      proxy_version: string | null;
+    };
+    /**
+     * @description Information about the request.
+     *
+     * Captures all the relevant info (including the request body) about requests that require MFA.
+     * We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)
+     * it is exactly the same as it originally was.
+     */
+    HttpRequest: {
+      /** @description HTTP request body */
+      body: Record<string, unknown> | null;
+      /** @description HTTP method of the request */
+      method: string;
+      /** @description HTTP path of the request (including host or not?) */
+      path: string;
+    };
+    ImportKeyLegacyRequest: {
+      /**
+       * Format: int64
+       * @description The chain ID of the chain that the key will be used for
+       * @example 5
+       */
+      chain_id: number | null;
+      /** @description The key to import encrypted with the public key of the organization */
+      key_material: components["schemas"]["RsaOaepXChaChaMaterial"][];
+      key_type: components["schemas"]["KeyType"];
+    };
+    ImportKeyRequest: components["schemas"]["KeyImportKey"] & {
+      /** @description A set of encrypted keys to be imported */
+      key_material: components["schemas"]["ImportKeyRequestMaterial"][];
+      key_type: components["schemas"]["KeyType"];
+    };
+    ImportKeyRequestMaterial: {
+      /**
+       * @description The client's ephemeral public key used to derive a shared key.
+       * This is a base64-encoded, SEC1-encoded P384 public key.
+       */
+      client_public_key: string;
+      /**
+       * @description The encrypted keying material to be imported.
+       * This is a base64-encoded ciphertext.
+       */
+      ikm_enc: string;
+      /**
+       * @description A salt value used to derive a shared key.
+       * This is a base64-encoded byte string.
+       */
+      salt: string;
+    };
+    InviteRequest: {
+      /**
+       * @description The user's email address
+       * @example alice@acme.com
+       */
+      email: string;
+      /**
+       * @description The user's full name
+       * @example Alice Wonderland
+       */
+      name: string;
+      /**
+       * @description Skip sending an invitation email to this user if true.
+       *
+       * NOTE: this field is for internal testing use ONLY. If you do not
+       * send an invitation email, the user will never be able to log in.
+       * @example false
+       */
+      skip_email: boolean;
+    };
+    /** @description A wrapped key-import key */
+    KeyImportKey: {
+      /** @description Base64-encoded, encrypted data key. */
+      dk_enc: string;
+      /**
+       * Format: int64
+       * @description Expiration timestamp expressed as seconds since the UNIX epoch.
+       */
+      expires: number;
+      /**
+       * @description The ephemeral public key to which an imported key should be encrypted.
+       * This is a P384 public key in base64-encoded uncompressed SECG format.
+       */
+      public_key: string;
+      /** @description Base64-encoded, encrypted secret key. */
+      sk_enc: string;
+    };
+    KeyInfo: {
+      /** @description Whether the key is enabled (only enabled keys may be used for signing) */
+      enabled: boolean;
+      /**
+       * @description The id of the key: "Key#" followed by a unique identifier specific to
+       * the type of key (such as a public key for BLS or an ethereum address for Secp)
+       * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
+       */
+      key_id: string;
+      key_type: components["schemas"]["KeyType"];
+      /**
+       * @description A unique identifier specific to the type of key, such as a public key or an ethereum address
+       * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148
+       */
+      material_id: string;
+      /**
+       * @description Owner of the key
+       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+       */
+      owner: string;
+      /**
+       * @description Key policy
+       * @example []
+       */
+      policy: Record<string, never>[];
+      /**
+       * @description Hex-encoded, serialized public key. The format used depends on the key type:
+       * - secp256k1 keys use 65-byte uncompressed SECG format;
+       * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format;
+       * - ed25519 keys use the canonical 64-byte encoding specified in RFC 8032.
+       * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431
+       */
+      public_key: string;
+      /**
+       * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages)
+       * @example Eth2Validator(1)
+       */
+      purpose: string;
+    };
+    /** @enum {string} */
+    KeyType: "SecpEthAddr" | "SecpBtc" | "SecpBtcTest" | "BlsPub" | "BlsInactive" | "Ed25519SolanaAddr" | "Ed25519SuiAddr" | "Ed25519AptosAddr";
+    KeyWithPolicies: {
+      /**
+       * @description Key ID
+       * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
+       */
+      key_id: string;
+      /**
+       * @description Policies that are checked before this key is used on behalf of this role
+       * @example [
+       *   {
+       *     "TxReceiver": "0x8c594691c0e592ffa21f153a16ae41db5befcaaa"
+       *   },
+       *   {
+       *     "TxDeposit": {
+       *       "kind": "Canonical"
+       *     }
+       *   }
+       * ]
+       */
+      policy?: Record<string, never>[];
+    };
+    /**
+     * @description Describes whether a user in an org is an Owner or just a regular member
+     * @enum {string}
+     */
+    MemberRole: "Owner" | "Member" | "Alien";
+    /** @enum {string} */
+    MfaType: "CubeSigner" | "Totp";
+    /**
+     * @description Network name ('mainnet', 'prater', 'goerli')
+     * @example goerli
+     * @enum {string}
+     */
+    Network: "mainnet" | "prater" | "goerli";
+    /**
+     * @description Represents a globally unique OIDC-authorized user by expressing the full "path" to a user. That is:
+     *
+     * (iss)       (sub)
+     * Issuer -> Subresource
+     *
+     * We include a non-standard third-tier `disambiguator` which allows us to map
+     * a single OIDC user to multiple `User`s in CubeSigner
+     */
+    OIDCIdentity: {
+      /**
+       * @description Free-form additional user info.
+       * @example null
+       */
+      disambiguator?: string | null;
+      /**
+       * @description The root-level issuer who administrates this user. Frome the OIDC spec:
+       * Issuer Identifier for the Issuer of the response. The iss
+       * value is a case sensitive URL using the https scheme that contains
+       * scheme, host, and optionally, port number and path components and
+       * no query or fragment components.
+       * @example https://accounts.google.com
+       */
+      iss: string;
+      /**
+       * @description From the OIDC spec:
+       *
+       * A locally unique and never reassigned identifier within the Issuer for
+       * the End-User, which is intended to be consumed by the Client, e.g.,
+       * 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed
+       * 255 ASCII characters in length. The sub value is a case sensitive
+       * string.
+       * @example 10769150350006150715113082367
+       */
+      sub: string;
+    };
+    OidcLoginRequest: {
+      /**
+       * @description Controls what capabilities this session will have.
+       * @example [
+       *   "sign:*"
+       * ]
+       */
+      scopes: string[];
+    };
+    OidcLoginResponse: {
+      /**
+       * @description Token to be used for signing auth. Requests to signing endpoints
+       * should include this value in the `Authorization` header
+       */
+      token: string;
+    };
+    OrgInfo: {
+      /** @description When false, all cryptographic operations involving keys in this org are disabled. */
+      enabled: boolean;
+      /**
+       * @description The RSA public key to use when importing keys into this organization. This string is the
+       * hex encoding of the DER representation of the key.
+       * @example 30820222300d06092a864886f70d01010105000382020f003082020a0282020100c89765b8f347caafbec09fcb17740e032d854ec99f2d9c16167be335339b4fdeba18a7f13d8e8b7ae7d689cab63d8ecdf548f4746eacaf95b61fef76ade9f81b3c038891c52542fd352697b618afbea6103723c28f2db450e9d852be16a4dc2cbc9442da9a6610044009e056ba90728f0b9888d9b036e493aaed168ccf930fa2f730b17eb3ad6f455a792b762c47f3d3c6b7a7c458556a592e688791599a576bf2149d8e9614db775e7a48602d237a347d5399c681f7f7d9c81f6a64e7cfd356bba545d45e5023ca1f09a66a1d4550f61cf2c4367e14997b5d749bb0326a44d058119e8caf7fd79d517eb2d11dddb2db329f350698f0f978d5e150bb402c8bc4c5ec36d6f38db3f3a204813cda9f52dbcee809204f8e35a455c0e110e10eec41f734f2d55a058a7a21fa90602f94da6de2378ff61e7b3550b77e53d75d7b3d3b39ccab0e5101b916dab01da096f7627175d5b68a1a6464ce5be3e95e7c464d69eb0b675057705c11bc79c3543313b0d9c703c50dc1a16dd9b55e5599e3b02e527b85938e7b81c65e56960bcd7c7a266b07dc05107fd0d7d3c208a878eb0fc74b0d007f421d0c5b28cf78eb441aa0166dceeeac255d68622492f9b526ae13c93754ea8eda96f3b764ba931f8d49c7de8b00ac53d993ab9b08fd2892d8e82cc1a9746f0b426b19256d13d780445e150ce81da0b3c96e32559cb47cb5cb93f805650203010001
+       */
+      key_import_key: string;
+      /**
+       * @description The organization's universally unique key-wrapping-key identifier.
+       * This value is required when setting up key export.
+       * @example mrk-fce09525e81587d23520f11e07e2e9d9
+       */
+      kwk_id: string;
+      /**
+       * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none.
+       * @example TODO
+       */
+      last_unstake: string;
+      /**
+       * Format: int32
+       * @description How many 'unstake' calls happened on the day when `last_unstake` was performed.
+       */
+      last_unstake_day_count: number;
+      /**
+       * @description The human-readable name for the org
+       * @example my_org_name
+       */
+      name?: string | null;
+      /**
+       * @description The ID of the organization
+       * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+       */
+      org_id: string;
+      /**
+       * @description Org-wide policies that are checked before a key is used for signing
+       * @example [
+       *   {
+       *     "MaxDailyUnstake": 5
+       *   }
+       * ]
+       */
+      policy?: Record<string, never>[];
+    };
+    RatchetConfig: {
+      auth_lifetime?: components["schemas"]["Seconds"];
+      refresh_lifetime?: components["schemas"]["Seconds"];
+      session_lifetime?: components["schemas"]["Seconds"];
+    };
+    /** @description Receipt that an MFA request was approved. */
+    Receipt: {
+      /**
+       * @description Confirmation code the user needs to present when resuming the original request.
+       * @example ba1d75dd-d999-4c1b-944d-25c25440c8af
+       */
+      confirmation: string;
+      /** @description The ID of the logged-in user whose action created this approval. */
+      final_approver: string;
+      timestamp: components["schemas"]["EpochDateTime"];
+    };
+    RoleInfo: {
+      /**
+       * @description Whether the role is enabled
+       * @example true
+       */
+      enabled: boolean;
+      /** @description The CubeSigner IDs of the keys */
+      keys: components["schemas"]["KeyWithPolicies"][];
+      /**
+       * @description The human-readable name for the role (must be alphanumeric)
+       * @example my_role
+       */
+      name?: string | null;
+      /**
+       * @description The ID of the role
+       * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b
+       */
+      role_id: string;
+      /**
+       * @description The list of users with access to the role
+       * @example [
+       *   "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f",
+       *   "User#5593c25b-52e2-4fb5-b39b-96d41d681d82"
+       * ]
+       */
+      users: string[];
+    };
+    /**
+     * @description Encrypted key material for import using hybrid encryption.
+     *
+     * The imported keying material is encrypted using [XChaCha20Poly1305], which
+     * we choose for its speed and side channel resistance, its ability to encrypt
+     * very long messages, and its safety when using random nonces even for a large
+     * number of messages. The latter should not happen in this case, but the cost
+     * is negligible and the benefit is that we know it's safe to use random nonces.
+     *
+     * The XChaCha key is encrypted using [RSAES-OAEP-SHA256], which we choose because
+     * it's the best of the [available options for asymmetric encryption][kmsopts]
+     * in AWS KMS.
+     *
+     * [XChaCha20Poly1305]: https://doc.libsodium.org/secret-key_cryptography/aead/chacha20-poly1305/xchacha20-poly1305_construction
+     * [RSAES-OAEP-SHA256]: https://www.rfc-editor.org/rfc/rfc8017#section-7.1
+     * [kmsopts]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html
+     */
+    RsaOaepXChaChaMaterial: {
+      /**
+       * @description The keying material to be imported, encrypted with
+       * [XChaCha20Poly1305](https://doc.libsodium.org/secret-key_cryptography/aead/chacha20-poly1305/xchacha20-poly1305_construction).
+       */
+      ikm_enc: number[];
+      /**
+       * @description The key-wrapping key used to encrypt `ikm_enc`, encrypted with
+       * [RSAES-OAEP-SHA256](https://www.rfc-editor.org/rfc/rfc8017#section-7.1).
+       */
+      kwk_enc: number[];
+      /** @description The nonce used to generate `ikm_enc`. */
+      nonce: number[];
+    };
+    /**
+     * Format: int64
+     * @description Duration measured in seconds
+     * A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.
+     */
+    Seconds: number;
+    SignRequest: {
+      message: Record<string, never>;
+    };
+    SolanaSignRequest: components["schemas"]["SignRequest"] & Record<string, never>;
+    StakeRequest: {
+      /**
+       * Format: int64
+       * @description The chain on which we will deposit
+       * @example 5
+       */
+      chain_id: number;
+      deposit_type: components["schemas"]["DepositType"];
+      unsafe_conf: components["schemas"]["UnsafeConf"] | null;
+      /**
+       * @description The validator BLS public key to use, or `None` to generate a fresh one.
+       * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c
+       */
+      validator_key: string | null;
+      /**
+       * @description The ethereum address to which withdrawn funds go
+       * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148
+       */
+      withdrawal_addr: string;
+    };
+    Status: {
+      /** @description Users who are allowed to approve. Must be non-empty. */
+      allowed_approvers: string[];
+      /** @description Allowed approval types. When omitted, defaults to any. */
+      allowed_mfa_types?: components["schemas"]["MfaType"][] | null;
+      /** @description Users who have already approved */
+      approved_by: {
+        [key: string]: ({
+          [key: string]: components["schemas"]["ApprovalInfo"] | undefined;
+        }) | undefined;
+      };
+      /**
+       * Format: int32
+       * @description How many users must approve
+       */
+      count: number;
+      /**
+       * Format: int32
+       * @description How many auth factors to require per user
+       */
+      num_auth_factors: number;
+    };
+    TokenInfo: {
+      /** @description Session ID. Use it to revoke a session. Cannot be used for auth. */
+      hash: string;
+      /** @description Tokens purpose */
+      purpose: string;
+    };
+    TotpApproveRequest: {
+      /** @description TOTP verification code */
+      code: string;
+    };
+    /** @description Options that should be set only for local devnet testing. */
+    UnsafeConf: {
+      /**
+       * @description The hex-encoded address of the deposit contract. If omitted, inferred from `chain_id`
+       * @example 0xff50ed3d0ec03ac01d4c79aad74928bff48a7b2b
+       */
+      deposit_contract_addr: string | null;
+      /**
+       * @description The hex-encoded 4-byte fork version
+       * @example 0x00001020
+       */
+      genesis_fork_version: string | null;
+    };
+    /**
+     * @description Unstake message request.
+     * @example {
+     *   "epoch": "256",
+     *   "fork": {
+     *     "current_version": "0x00001020",
+     *     "epoch": "0",
+     *     "previous_version": "0x00001020"
+     *   },
+     *   "genesis_data": {
+     *     "genesis_fork_version": "0x00001020",
+     *     "genesis_time": "1679541642",
+     *     "genesis_validators_root": "0x270d43e74ce340de4bca2b1936beca0f4f5408d9e78aec4850920baf659d5b69"
+     *   },
+     *   "network": "goerli",
+     *   "validator_index": "0"
+     * }
+     */
+    UnstakeRequest: {
+      epoch: components["schemas"]["Epoch"] | null;
+      fork: components["schemas"]["Fork"];
+      genesis_data: components["schemas"]["GenesisData"];
+      network: components["schemas"]["Network"];
+      /**
+       * @description Validator index (`uint64`) to exit. You can get the validator index from the Beacon node's
+       * `/eth/v1/beacon/states/head/validators/{pubkey}` end-point. This end point returns an
+       * object that contains information about the validator (whose public key is `{pubkey}`),
+       * including the validator index. The schema of this end-point is defined
+       * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/getStateValidator).
+       * @example 31337
+       */
+      validator_index: string;
+    };
+    UpdateKeyRequest: {
+      /**
+       * @description If set, updates the keys's `enabled` property to this value.
+       * Once disabled, a key cannot be used for signing.
+       */
+      enabled?: boolean | null;
+      /**
+       * @description If set, updates key's owner to this value.
+       * The new owner must be an existing user who is a member of the same org.
+       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+       */
+      owner?: string | null;
+      /**
+       * @description If set, update this key's policies (old policies will be overwritten!).
+       * @example []
+       */
+      policy?: Record<string, never>[] | null;
+    };
+    UpdateOrgRequest: {
+      /** @description If set, update this org's `enabled` field to this value. */
+      enabled?: boolean | null;
+      /**
+       * @description If set, update this org's alias.  Org aliases are globally unique.
+       * @example my_org
+       */
+      name?: string | null;
+      /**
+       * @description If set, update this org's policies (old policies will be overwritten!).
+       * @example [
+       *   {
+       *     "MaxDailyUnstake": 5
+       *   },
+       *   {
+       *     "OriginAllowlist": [
+       *       "https://example.com"
+       *     ]
+       *   },
+       *   {
+       *     "SourceIpAllowlist": [
+       *       "10.1.2.3/8",
+       *       "169.254.17.1/16"
+       *     ]
+       *   }
+       * ]
+       */
+      policy?: Record<string, never>[] | null;
+    };
+    UpdateRoleRequest: {
+      /**
+       * @description If set, updates the role's `enabled` property to this value.
+       * Once disabled, a role cannot be used; and it's tokens cannot be used for signing.
+       */
+      enabled?: boolean | null;
+    };
+    UserIdInfo: {
+      /**
+       * @description The user's email
+       * @example alice@example.com
+       */
+      email: string;
+      /**
+       * @description The id of the user
+       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+       */
+      id: string;
+    };
+    UserInfo: {
+      /** @example alice@example.com */
+      email: string;
+      /** @description All multi-factor authentication methods configured for this user */
+      mfa: components["schemas"]["ConfiguredMfa"][];
+      /**
+       * @description All organizations the user belongs to
+       * @example [
+       *   "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a"
+       * ]
+       */
+      org_ids: string[];
+      /**
+       * @description The id of the currently logged in user
+       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+       */
+      user_id: string;
+    };
+    /**
+     * @description An exit voluntarily submitted a validator who wishes to withdraw.
+     * The schema for this message is defined
+     * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit).
+     */
+    VoluntaryExit: {
+      epoch: components["schemas"]["Epoch"];
+      /**
+       * @description Index of the exiting validator.
+       * @example 256
+       */
+      validator_index: string;
+    };
+  };
+  responses: {
+    AddThirdPartyUserResponse: {
+      content: {
+        "application/json": {
+          /** @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f */
+          user_id: string;
+        };
+      };
+    };
+    BlobSignResponse: {
+      content: {
+        "application/json": {
+          /** @description The hex-encoded signature. */
+          signature: string;
+        };
+      };
+    };
+    BtcSignResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description The hex-encoded signature in DER format.
+           * @example 0x3045022100e12be3904f665f755e106741680548fefc9febf4cff31c5c0ee4627b3c1b35fe022066fde9a0b17e4cd38da983fb0d604294f00d0bd47fcb649c5216f3a2e8b7ad2d01
+           */
+          signature: string;
+        };
+      };
+    };
+    CreateKeyImportKeyResponse: {
+      content: {
+        "application/json": components["schemas"]["KeyImportKey"] & {
+          /**
+           * @description An attestation document from a secure enclave, including an
+           * RSA signing key used to sign the contents of this message.
+           */
+          enclave_attestation: string;
+          /**
+           * @description An RSA-PSS-SHA256 signature on the public key and encrypted
+           * secrets attesting to their generation inside a secure enclave.
+           */
+          enclave_signature: string;
+        };
+      };
+    };
+    CreateKeyResponse: {
+      content: {
+        "application/json": {
+          /** @description The info about the created keys */
+          keys: components["schemas"]["KeyInfo"][];
+        };
+      };
+    };
+    /** @description The newly created role information */
+    CreateRoleResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description A human-readable name for the role.
+           * @example my_role
+           */
+          name?: string | null;
+          /**
+           * @description The id of the newly created role
+           * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b
+           */
+          role_id: string;
+        };
+      };
+    };
+    CreateTokenResponse: {
+      content: {
+        "application/json": {
+          session_info: components["schemas"]["ClientSessionInfo"];
+          /**
+           * @description Token to be used for signing auth. Requests to signing endpoints
+           * should include this value in the `Authorization` header
+           */
+          token: string;
+        };
+      };
+    };
+    EmptyImpl: {
+      content: {
+        "application/json": {
+          status: string;
+        };
+      };
+    };
+    Eth1SignResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description Hex-encoded RLP encoding of the transaction and its signature
+           * @example 0x22895118000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000001201d58656b0e22aaa68fdc692db41979098c3886ed33015d7467de9211609cdac000000000000000000000000000000000000000000000000000000000000000308b0c2900324d3ff9adfba7fdfe5af3f9b2cdbeef7b280437bbf1b1c59a093d615afe3e5dfed9622b540cdd9b49b3c5ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002001000000000000000000000049011adbcc3bc9c0307bb07f37dda1a1a9c69d2e0000000000000000000000000000000000000000000000000000000000000060903db8525674b8e7904f9b7d7d9ec55a0a42d33cf58be25469b0c21bbb6d06172bc5bb5fd1aed8e4f35936968958116b0619553c2cb1c52e7323074c6f8eb3d5a7074fc6580148df907837fa3b164ad7fbc2288dad1e8a5b021095b57c8a36d4
+           */
+          rlp_signed_tx: string;
+        };
+      };
+    };
+    Eth2SignResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description Hex encoded signature prefixed with 0x e.g. "0x0000..."
+           * @example 0xb4f2ef9d12a54e1f569596c07c97d6d730535b6ffc0d287761dc78103a86326782471a04c75ce7a6faea08ca9a4a0830031cdcb893da8711d54aa22619f1a7e71b8185ddf4c6bfd9babbd735960e35e56bd6eeb89625b04850e7a9ef8846e549
+           */
+          signature: string;
+        };
+      };
+    };
+    GetKeysInOrgResponse: {
+      content: {
+        "application/json": {
+          keys: components["schemas"]["KeyInfo"][];
+        };
+      };
+    };
+    GetUsersInOrgResponse: {
+      content: {
+        "application/json": {
+          /** @description The list of users in the org */
+          users: components["schemas"]["UserIdInfo"][];
+        };
+      };
+    };
+    /** @description A wrapped key-import key */
+    KeyImportKey: {
+      content: {
+        "application/json": {
+          /** @description Base64-encoded, encrypted data key. */
+          dk_enc: string;
+          /**
+           * Format: int64
+           * @description Expiration timestamp expressed as seconds since the UNIX epoch.
+           */
+          expires: number;
+          /**
+           * @description The ephemeral public key to which an imported key should be encrypted.
+           * This is a P384 public key in base64-encoded uncompressed SECG format.
+           */
+          public_key: string;
+          /** @description Base64-encoded, encrypted secret key. */
+          sk_enc: string;
+        };
+      };
+    };
+    KeyInfo: {
+      content: {
+        "application/json": {
+          /** @description Whether the key is enabled (only enabled keys may be used for signing) */
+          enabled: boolean;
+          /**
+           * @description The id of the key: "Key#" followed by a unique identifier specific to
+           * the type of key (such as a public key for BLS or an ethereum address for Secp)
+           * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
+           */
+          key_id: string;
+          key_type: components["schemas"]["KeyType"];
+          /**
+           * @description A unique identifier specific to the type of key, such as a public key or an ethereum address
+           * @example 0x8e3484687e66cdd26cf04c3647633ab4f3570148
+           */
+          material_id: string;
+          /**
+           * @description Owner of the key
+           * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+           */
+          owner: string;
+          /**
+           * @description Key policy
+           * @example []
+           */
+          policy: Record<string, never>[];
+          /**
+           * @description Hex-encoded, serialized public key. The format used depends on the key type:
+           * - secp256k1 keys use 65-byte uncompressed SECG format;
+           * - BLS keys use 48-byte compressed BLS12-381 (ZCash) format;
+           * - ed25519 keys use the canonical 64-byte encoding specified in RFC 8032.
+           * @example 0x04d2688b6bc2ce7f9879b9e745f3c4dc177908c5cef0c1b64cff19ae7ff27dee623c64fe9d9c325c7fbbc748bbd5f607ce14dd83e28ebbbb7d3e7f2ffb70a79431
+           */
+          public_key: string;
+          /**
+           * @description The purpose for which the key can be used (e.g., chain id for which the key is allowed to sign messages)
+           * @example Eth2Validator(1)
+           */
+          purpose: string;
+        };
+      };
+    };
+    KeyInfos: {
+      content: {
+        "application/json": {
+          keys: components["schemas"]["KeyInfo"][];
+        };
+      };
+    };
+    ListRolesResponse: {
+      content: {
+        "application/json": {
+          /** @description All roles in an organization. */
+          roles: components["schemas"]["RoleInfo"][];
+        };
+      };
+    };
+    ListTokensResponse: {
+      content: {
+        "application/json": {
+          tokens: components["schemas"]["TokenInfo"][];
+        };
+      };
+    };
+    /** @description Returned as a response from multiple routes (e.g., 'get mfa', 'approve mfa', 'approve totp'). */
+    MfaRequestInfo: {
+      content: {
+        "application/json": {
+          expires_at: components["schemas"]["EpochDateTime"];
+          /** @description Approval request ID. */
+          id: string;
+          receipt: components["schemas"]["Receipt"] | null;
+          request: components["schemas"]["HttpRequest"];
+          status: components["schemas"]["Status"];
+        };
+      };
+    };
+    OidcLoginResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description Token to be used for signing auth. Requests to signing endpoints
+           * should include this value in the `Authorization` header
+           */
+          token: string;
+        };
+      };
+    };
+    OrgInfo: {
+      content: {
+        "application/json": {
+          /** @description When false, all cryptographic operations involving keys in this org are disabled. */
+          enabled: boolean;
+          /**
+           * @description The RSA public key to use when importing keys into this organization. This string is the
+           * hex encoding of the DER representation of the key.
+           * @example 30820222300d06092a864886f70d01010105000382020f003082020a0282020100c89765b8f347caafbec09fcb17740e032d854ec99f2d9c16167be335339b4fdeba18a7f13d8e8b7ae7d689cab63d8ecdf548f4746eacaf95b61fef76ade9f81b3c038891c52542fd352697b618afbea6103723c28f2db450e9d852be16a4dc2cbc9442da9a6610044009e056ba90728f0b9888d9b036e493aaed168ccf930fa2f730b17eb3ad6f455a792b762c47f3d3c6b7a7c458556a592e688791599a576bf2149d8e9614db775e7a48602d237a347d5399c681f7f7d9c81f6a64e7cfd356bba545d45e5023ca1f09a66a1d4550f61cf2c4367e14997b5d749bb0326a44d058119e8caf7fd79d517eb2d11dddb2db329f350698f0f978d5e150bb402c8bc4c5ec36d6f38db3f3a204813cda9f52dbcee809204f8e35a455c0e110e10eec41f734f2d55a058a7a21fa90602f94da6de2378ff61e7b3550b77e53d75d7b3d3b39ccab0e5101b916dab01da096f7627175d5b68a1a6464ce5be3e95e7c464d69eb0b675057705c11bc79c3543313b0d9c703c50dc1a16dd9b55e5599e3b02e527b85938e7b81c65e56960bcd7c7a266b07dc05107fd0d7d3c208a878eb0fc74b0d007f421d0c5b28cf78eb441aa0166dceeeac255d68622492f9b526ae13c93754ea8eda96f3b764ba931f8d49c7de8b00ac53d993ab9b08fd2892d8e82cc1a9746f0b426b19256d13d780445e150ce81da0b3c96e32559cb47cb5cb93f805650203010001
+           */
+          key_import_key: string;
+          /**
+           * @description The organization's universally unique key-wrapping-key identifier.
+           * This value is required when setting up key export.
+           * @example mrk-fce09525e81587d23520f11e07e2e9d9
+           */
+          kwk_id: string;
+          /**
+           * @description Date/time (in UTC) when last 'unstake' was performed. Unix epoch if none.
+           * @example TODO
+           */
+          last_unstake: string;
+          /**
+           * Format: int32
+           * @description How many 'unstake' calls happened on the day when `last_unstake` was performed.
+           */
+          last_unstake_day_count: number;
+          /**
+           * @description The human-readable name for the org
+           * @example my_org_name
+           */
+          name?: string | null;
+          /**
+           * @description The ID of the organization
+           * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+           */
+          org_id: string;
+          /**
+           * @description Org-wide policies that are checked before a key is used for signing
+           * @example [
+           *   {
+           *     "MaxDailyUnstake": 5
+           *   }
+           * ]
+           */
+          policy?: Record<string, never>[];
+        };
+      };
+    };
+    RefreshResponse: {
+      content: {
+        "application/json": {
+          session_info: components["schemas"]["ClientSessionInfo"];
+          /**
+           * @description New token to be used for signing auth. Requests to signing endpoints
+           * should include this value in the `Authorization` header
+           */
+          token: string;
+        };
+      };
+    };
+    RevokeTokenResponse: {
+      content: {
+        "application/json": {
+          token?: components["schemas"]["TokenInfo"] | null;
+        };
+      };
+    };
+    RevokeTokensResponse: {
+      content: {
+        "application/json": {
+          /** @description Tokens that were revoked. */
+          revoked: components["schemas"]["TokenInfo"][];
+        };
+      };
+    };
+    RoleInfo: {
+      content: {
+        "application/json": {
+          /**
+           * @description Whether the role is enabled
+           * @example true
+           */
+          enabled: boolean;
+          /** @description The CubeSigner IDs of the keys */
+          keys: components["schemas"]["KeyWithPolicies"][];
+          /**
+           * @description The human-readable name for the role (must be alphanumeric)
+           * @example my_role
+           */
+          name?: string | null;
+          /**
+           * @description The ID of the role
+           * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b
+           */
+          role_id: string;
+          /**
+           * @description The list of users with access to the role
+           * @example [
+           *   "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f",
+           *   "User#5593c25b-52e2-4fb5-b39b-96d41d681d82"
+           * ]
+           */
+          users: string[];
+        };
+      };
+    };
+    SolanaSignResponse: {
+      content: {
+        "application/json": {
+          /** @description The hex-encoded signature. */
+          signature: string;
+        };
+      };
+    };
+    StakeResponse: {
+      content: {
+        "application/json": {
+          /**
+           * @description The validator key id ("Key#...")
+           * @example Key#db1731f8-3659-45c0-885b-e11e1f5b7be2
+           */
+          created_validator_key_id: string;
+          deposit_tx: components["schemas"]["DepositTxn"];
+        };
+      };
+    };
+    TotpInfo: {
+      content: {
+        "application/json": {
+          /**
+           * @description Standard TOTP url which includes everything needed to initialize TOTP.
+           * @example otpauth://totp/Cubist:alice-%40example.com?secret=DAHF7KCOTQWSOMK4XFEMNHXO4J433OD7&issuer=Cubist
+           */
+          totp_url: string;
+        };
+      };
+    };
+    /**
+     * @description Unstake responses are signed voluntary exit messages.
+     * The schema for this message is defined
+     * [here](https://github.com/ethereum/consensus-specs/blob/v1.0.1/specs/phase0/beacon-chain.md#signedvoluntaryexit).
+     * This message can be directly POSTed to the Beacon node's
+     * `/eth/v1/beacon/pool/voluntary_exits` end-point (see expected schema
+     * [here](https://ethereum.github.io/beacon-APIs/#/Beacon/submitPoolVoluntaryExit)).
+     */
+    UnstakeResponse: {
+      content: {
+        "application/json": {
+          message: components["schemas"]["VoluntaryExit"];
+          /**
+           * @description BLS signature.
+           * @example 0x910c7cd537ed91cc8c4a82f3cbd832e9be8c24a22e9c86df479f7ce42025ea6a09619b418b666a060e260d2aae31b8e50e9d05ca3442c7eed3b507e5207e14674275f68c2ba84c4bf6b8dd364a304acac8cfab3681e2514b4400f9242bc61164
+           */
+          signature: string;
+        };
+      };
+    };
+    UpdateOrgResponse: {
+      content: {
+        "application/json": {
+          /** @description The new value of the 'enabled' property */
+          enabled?: boolean | null;
+          /**
+           * @description The new human-readable name for the org (must be alphanumeric)
+           * @example my_org_name
+           */
+          name?: string | null;
+          /**
+           * @description The ID of the organization
+           * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+           */
+          org_id: string;
+          /**
+           * @description The new value of org-wide policies
+           * @example [
+           *   {
+           *     "MaxDailyUnstake": 5
+           *   },
+           *   {
+           *     "OriginAllowlist": [
+           *       "https://example.com"
+           *     ]
+           *   }
+           * ]
+           */
+          policy?: Record<string, never>[] | null;
+        };
+      };
+    };
+    UserInfo: {
+      content: {
+        "application/json": {
+          /** @example alice@example.com */
+          email: string;
+          /** @description All multi-factor authentication methods configured for this user */
+          mfa: components["schemas"]["ConfiguredMfa"][];
+          /**
+           * @description All organizations the user belongs to
+           * @example [
+           *   "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a"
+           * ]
+           */
+          org_ids: string[];
+          /**
+           * @description The id of the currently logged in user
+           * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+           */
+          user_id: string;
+        };
+      };
+    };
+  };
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+
+export type external = Record<string, never>;
+
+export interface operations {
+
+  /**
+   * User Info
+   * @description User Info
+   *
+   * Retrieves information about the current user.
+   */
+  aboutMe: {
+    responses: {
+      200: components["responses"]["UserInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Get Org
+   * @description Get Org
+   *
+   * Retrieves information about an organization.
+   */
+  getOrg: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["OrgInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Update Org
+   * @description Update Org
+   *
+   * Update organization attributes (enabled flag, name, and policies).
+   */
+  updateOrg: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["UpdateOrgRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["UpdateOrgResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Bitcoin Transaction
+   * @description Sign Bitcoin Transaction
+   *
+   * Signs a Bitcoin transaction with a given key.
+   * This is a pre-release feature.
+   */
+  btcSign: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description bech32 encoding of the public key
+         * @example bc1q5p5qkae77ly80kr4pyfytdqm7rf08ddhdejl9g
+         */
+        pubkey: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["BtcSignRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["BtcSignResponse"];
+      202: {
+        content: {
+          "application/json": components["schemas"]["AcceptedResponse"];
+        };
+      };
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Create Key-Import Key
+   * @description Create Key-Import Key
+   *
+   * Generate an ephemeral key that a client can use for key-import encryption.
+   */
+  createKeyImportKey: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateKeyImportKeyResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Import Key
+   * @description Import Key
+   *
+   * Securely imports an existing key using a previously generated key-import key.
+   */
+  importKey: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["ImportKeyRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateKeyResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Invite User
+   * @description Invite User
+   *
+   * Creates a new user in an existing org and sends that user an invite email.
+   */
+  invite: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["InviteRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["EmptyImpl"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * List Keys
+   * @description List Keys
+   *
+   * Gets the list of owned keys in a given org.
+   */
+  listKeysInOrg: {
+    parameters: {
+      query?: {
+        /**
+         * @description Filter by key type
+         * @example SecpEthAddr
+         */
+        key_type?: components["schemas"]["KeyType"];
+      };
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["GetKeysInOrgResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Import Key (Deprecated)
+   * @description Import Key (Deprecated)
+   *
+   * Securely imports an existing key. This API is deprecated; please use the new version.
+   */
+  importKeyLegacy: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["ImportKeyLegacyRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateKeyResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Create Key
+   * @description Create Key
+   *
+   * Creates one or more new keys of the specified type (BLS or Secp).
+   */
+  createKey: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["CreateKeyRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateKeyResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Legacy List Keys
+   * @deprecated
+   * @description Legacy List Keys
+   *
+   * This route is deprecated. Use `GET /v0/org/<org_id>/keys?<key_type>`
+   */
+  listKeysLegacy: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["GetKeysInOrgRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["GetKeysInOrgResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Get Key
+   * @description Get Key
+   *
+   * Returns the properties of a key.
+   */
+  getKeyInOrg: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description ID of the key
+         * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
+         */
+        key_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["KeyInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Update Key
+   * @description Update Key
+   *
+   * Enable or disable a key.  The user must be the owner of the key or organization to perform this action.
+   */
+  updateKey: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description ID of the key
+         * @example Key#0x8e3484687e66cdd26cf04c3647633ab4f3570148
+         */
+        key_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["UpdateKeyRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["KeyInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Gets a Pending MFA Request
+   * @description Gets a Pending MFA Request
+   *
+   * Retrieves and returns a pending MFA request by its id.
+   */
+  mfaGet: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description ID of the approval
+         * @example ...
+         */
+        mfa_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["MfaRequestInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Approve a Pending MFA Request
+   * @description Approve a Pending MFA Request
+   *
+   * Adds the current user as an approver of a pending MFA request of the [Status::RequiredApprovers] kind.
+   * If the required number of approvers is reached, the MFA request is approved;
+   * the confirmation receipt can be used to resume the original HTTP request.
+   */
+  mfaApproveCs: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description ID of the MFA approval request
+         * @example MfaRequest#6de79de4-662c-4203-9235-b6ace5cb432b
+         */
+        mfa_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["MfaRequestInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Approve a TOTP MFA Request
+   * @description Approve a TOTP MFA Request
+   *
+   * Adds an approver to a pending TOTP MFA request.
+   *
+   * If the required number of approvers is reached, the MFA request is approved;
+   * the confirmation receipt can be used to resume the original HTTP request.
+   */
+  mfaApproveTotp: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description ID of the MFA approval request
+         * @example MfaRequest#6de79de4-662c-4203-9235-b6ace5cb432b
+         */
+        mfa_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["TotpApproveRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["MfaRequestInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Login with OIDC
+   * @description Login with OIDC
+   *
+   * Exchange an OIDC ID token (passed via the `Authorization` header) for a signer session
+   */
+  oidcAuth: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["OidcLoginRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["OidcLoginResponse"];
+      202: {
+        content: {
+          "application/json": components["schemas"]["AcceptedResponse"];
+        };
+      };
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * List Roles
+   * @description List Roles
+   *
+   * Retrieves all roles in an organization that the current user is allowed to access.
+   */
+  listRoles: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["ListRolesResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Create Role
+   * @description Create Role
+   *
+   * Creates a new role in an organization. Unless the logged-in user
+   * is the owner, they are automatically added to the newly created role.
+   */
+  createRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    /** @description Optional request body to set the role name */
+    requestBody?: {
+      content: {
+        "application/json": components["schemas"]["CreateRoleRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateRoleResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Get Role
+   * @description Get Role
+   *
+   * Retrieves information about a role in an organization
+   */
+  getRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["RoleInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Delete Role
+   * @description Delete Role
+   *
+   * Deletes a role in an organization.
+   * Only organization owners can perform this action.
+   */
+  deleteRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["EmptyImpl"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Update Role
+   * @description Update Role
+   *
+   * Enables or disables a role.
+   * The user must be in the role or an owner of the organization.
+   */
+  updateRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["UpdateRoleRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["EmptyImpl"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Add Keys
+   * @description Add Keys
+   *
+   * Adds a list of existing keys to an existing role.
+   */
+  addKeysToRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AddKeysToRoleRequest"];
+      };
+    };
+    responses: {
+    };
+  };
+  /**
+   * Add User
+   * @description Add User
+   *
+   * Adds an existing user to an existing role.
+   * Only users in the role or owners can add users to a role.
+   */
+  addUserToRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+        /**
+         * @description ID of the user to add to role
+         * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
+         */
+        user_id: string;
+      };
+    };
+    responses: {
+    };
+  };
+  /**
+   * Remove Key
+   * @description Remove Key
+   *
+   * Removes a given key from a role
+   */
+  removeKeyFromRole: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+        /**
+         * @description ID of the desired Key
+         * @example Key#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        key_id: string;
+      };
+    };
+    responses: {
+    };
+  };
+  /**
+   * List Tokens
+   * @description List Tokens
+   *
+   * Returns all access tokens for a given role.
+   * Only users in the role or owners can create a token for it.
+   */
+  listRoleTokens: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["ListTokensResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Create Token
+   * @description Create Token
+   *
+   * Creates a new access token for a given role (to be used as "API Key" for all signing actions).
+   * Only users in the role or owners can create a token for it.
+   */
+  createRoleToken: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["CreateTokenRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["CreateTokenResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Revoke All Tokens
+   * @description Revoke All Tokens
+   *
+   * Revokes all access tokens associated with a role.
+   * Only users in the role or owners can perform this action.
+   */
+  revokeAllRoleTokens: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["RevokeTokensResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Revoke Token
+   * @description Revoke Token
+   *
+   * Revokes an access token associated with a role.
+   * Only users in the role or owners can perform this action.
+   */
+  revokeRoleToken: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Name or ID of the desired Role
+         * @example Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        role_id: string;
+        /**
+         * @description The ID of the session to revoke
+         * @example 77aad2100c361f497635dd005c4d15781e2e5df4b9f45d8e74f37425cbc30b9e
+         */
+        session_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["RevokeTokenResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Get Token-Accessible Keys
+   * @description Get Token-Accessible Keys
+   *
+   * Retrieves the keys that the role token can access.
+   */
+  listTokenKeys: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["KeyInfos"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * List users in organization
+   * @description List users in organization
+   */
+  listUsersInOrg: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["GetUsersInOrgResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Adds a third-party user to the org
+   * @description Adds a third-party user to the org
+   */
+  createOidcUser: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AddThirdPartyUserRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["AddThirdPartyUserResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Reset TOTP
+   * @description Reset TOTP
+   *
+   * Creates and sets a new TOTP configuration for the current user,
+   * overriding the existing one (if any).
+   */
+  userResetTotp: {
+    responses: {
+      200: components["responses"]["TotpInfo"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Verify TOTP
+   * @description Verify TOTP
+   *
+   * Checks if a given code matches the current TOTP code for the current user.
+   * Errors with 403 if the current user has not set up TOTP or the code fails verification.
+   */
+  userVerifyTotp: {
+    parameters: {
+      path: {
+        code: string;
+      };
+    };
+    responses: {
+      200: components["responses"]["EmptyImpl"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Raw Blob
+   * @description Sign Raw Blob
+   *
+   * Signs an arbitrary blob with a given key.
+   * This is a pre-release feature.
+   */
+  blobSign: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description The ID of the key
+         * @example Key#0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E
+         */
+        key_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["BlobSignRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["BlobSignResponse"];
+      202: {
+        content: {
+          "application/json": components["schemas"]["AcceptedResponse"];
+        };
+      };
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Record heartbeat
+   * @description Record heartbeat
+   *
+   * This endpoint is called by the cube3signer proxy to record various metrics to CloudWatch.
+   */
+  cube3signerHeartbeat: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the organization owning the key
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["HeartbeatRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["EmptyImpl"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign EVM Transaction
+   * @description Sign EVM Transaction
+   *
+   * Signs an Ethereum (and other EVM) transaction with a given Secp256k1 key.
+   *
+   * The key must be associated with the role and organization on whose behalf this action is called.
+   */
+  eth1Sign: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Hex-encoded ethereum address of the secp key
+         * @example 0x49011adbCC3bC9c0307BB07F37Dda1a1a9c69d2E
+         */
+        pubkey: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["Eth1SignRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["Eth1SignResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Validator Request
+   * @description Sign Validator Request
+   *
+   * Signs an eth2 validator request with a given BLS key.
+   *
+   * The key must be associated with the role and organization on whose behalf this action is called.
+   */
+  eth2Sign: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Hex-encoded validator (BLS) public key with 0x prefix
+         * @example 0x9700fbb8c906942442c2a5b3ad7498f27aedda253786a6fbaa8fef47fb7af234e50cf2cce815a553087992ae565d48da
+         */
+        pubkey: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["Eth2SignRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["Eth2SignResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Stake Deposit
+   * @description Sign Stake Deposit
+   *
+   * Signs a deposit transaction with a `validator_key`. If `validator_key` is set to a pregenerated key, we use the
+   * provided validator key. Otherwise, we generate a new BLS key.
+   *
+   * When using a pregenerated key, the key must be associated with the role and organization on whose
+   * behalf this action is called.
+   */
+  stake: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["StakeRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["StakeResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Unstake Request
+   * @description Sign Unstake Request
+   *
+   * Handle unstaking request, producing a signed voluntary exit message
+   * that can be posted directly to the Beacon chain.
+   *
+   * The key must be associated with the role and organization on whose behalf this action is called.
+   */
+  unstake: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description Hex-encoded validator (BLS) public key
+         * @example 0xa99a76ed7796f7be22d5b7e85deeb7c5677e88e511e0b337618f8c4eb61349b4bf2d153f649f7b53359fe8b94a38e44c
+         */
+        pubkey: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["UnstakeRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["UnstakeResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Sign Solana Message
+   * @description Sign Solana Message
+   *
+   * Signs a Solana message with a given key.
+   * This is a pre-release feature.
+   */
+  solanaSign: {
+    parameters: {
+      path: {
+        /**
+         * @description Name or ID of the desired Org
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+        /**
+         * @description The base58-encoded public key
+         * @example 86ZRPszBp5EoPj7wR3bHn7wnAZ5iYfpasRc7DKFPTUaZ
+         */
+        pubkey: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["SolanaSignRequest"];
+      };
+    };
+    responses: {
+      200: components["responses"]["SolanaSignResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+  /**
+   * Refresh Signer Session
+   * @description Refresh Signer Session
+   */
+  signerSessionRefresh: {
+    parameters: {
+      path: {
+        /**
+         * @description ID of the organization owning the key
+         * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+         */
+        org_id: string;
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AuthData"];
+      };
+    };
+    responses: {
+      200: components["responses"]["RefreshResponse"];
+      default: {
+        content: {
+          "application/json": components["schemas"]["ErrorResponse"];
+        };
+      };
+    };
+  };
+}