@celigo/api-specs 0.2.1

package/dist/user.yml

@@ -0,0 +1,831 @@
+openapi: 3.2.0
+info:
+  version: 1.0.0
+  title: Users
+  description: API for managing user access to a Celigo account — invitations, access levels, and per-integration permissions.
+  x-celigo-ai-guidance:
+    - |-
+      API for managing account users - inviting, updating permissions,
+      and removing access.
+servers:
+  - url: https://api.integrator.io
+    description: Production (US / default region)
+  - url: https://api.eu.integrator.io
+    description: Production (EU region)
+  - url: https://api.au.integrator.io
+    description: Production (AU region)
+  - url: https://api.ca.integrator.io
+    description: Production (CA region)
+security:
+  - bearerAuth: []
+tags:
+  - name: Users
+    description: |-
+      Manage user access to a Celigo account. Each record represents a user's
+      access grant, including their access level and invitation status.
+
+      Access is controlled at two levels:
+      - **accessLevel** — account-wide role (administrator, manage, monitor, etc.)
+      - **integrationAccessLevel** — per-integration overrides for finer control.
+
+      The account owner is not included — only invited users appear. Users can
+      be disabled (reversible) or permanently removed.
+
+      ## User schema
+
+      {% openapi-schemas spec="user" schemas="User" grouped="true" %}
+paths:
+  /v1/ashares:
+    get:
+      x-internal: false
+      summary: List users
+      description: |-
+        Returns all users with access to the account. The account owner is
+        not included — only invited users appear.
+      operationId: listUsers
+      tags:
+        - Users
+      parameters:
+        - name: userType
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - workspace
+              - end-user
+            x-enumDescriptions:
+              workspace: Workspace (team member) access records — the records this endpoint returns.
+              end-user: End-user records; always empty here (204) — list them via the End Users API instead.
+          description: |-
+            Filter by access-record type. `workspace` returns the same records as
+            an unfiltered call; `end-user` always returns 204 because end users
+            are served by the End Users API, not this endpoint.
+      responses:
+        '200':
+          description: All users with access to the account.
+          x-celigo-ai-guidance:
+            - Successfully retrieved list of users
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/User'
+              examples:
+                default:
+                  value:
+                    - _id: 6798f4dc43db9184f4bc8ee0
+                      accepted: true
+                      userType: workspace
+                      accessLevel: administrator
+                      integrationAccessLevel: []
+                      accountSSORequired: false
+                      accountMFARequired: false
+                      isProductionAdmin: true
+                      allowIntegrationWorkspaceCreation: false
+                      createdVia: existing_account_invite
+                      lastModified: '2026-05-02T17:02:59.371Z'
+                      createdAt: '2025-01-28T15:16:44.327Z'
+                      lastSignIn: '2026-05-02T17:02:59.370Z'
+                      sharedWithUser:
+                        _id: 624774a6a7574d3ed9f9a5cc
+                        email: admin@example.com
+                        name: Account Admin
+                        allowedToResetMFA: false
+                        accountSSOLinked: not_linked
+                    - _id: 690954729ef09ab572f65e5d
+                      accepted: true
+                      userType: workspace
+                      integrationAccessLevel:
+                        - _integrationId: 68f52162f00a35a1b26eaafb
+                          accessLevel: manage
+                        - _integrationId: 6842261335b64c0bcb308e4f
+                          accessLevel: monitor
+                      accountSSORequired: false
+                      accountMFARequired: false
+                      allowIntegrationWorkspaceCreation: false
+                      createdVia: existing_account_invite
+                      lastModified: '2026-04-09T18:48:15.653Z'
+                      createdAt: '2025-11-04T01:18:42.025Z'
+                      sharedWithUser:
+                        _id: 69095422a6fa76e8c7c170eb
+                        email: contributor@example.com
+                        name: Integration User
+                        allowedToResetMFA: false
+                        accountSSOLinked: not_linked
+        '204':
+          description: No users exist in the account
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+  /v1/ashares/{_id}:
+    get:
+      x-internal: false
+      summary: Get a user
+      operationId: getUser
+      tags:
+        - Users
+      description: Retrieve a single user's access record by its id.
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: User access-record id.
+          schema:
+            type: string
+            format: objectId
+      responses:
+        '200':
+          description: The user record.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+              examples:
+                default:
+                  value:
+                    _id: 6798f4dc43db9184f4bc8ee0
+                    accepted: true
+                    accessLevel: administrator
+                    integrationAccessLevel: []
+                    accountSSORequired: false
+                    accountMFARequired: false
+                    isProductionAdmin: true
+                    allowIntegrationWorkspaceCreation: false
+                    createdVia: existing_account_invite
+                    lastModified: '2026-05-02T17:02:59.371Z'
+                    createdAt: '2025-01-28T15:16:44.327Z'
+                    lastSignIn: '2026-05-02T17:02:59.370Z'
+                    sharedWithUser:
+                      _id: 624774a6a7574d3ed9f9a5cc
+                      email: admin@example.com
+                      name: Account Admin
+                      allowedToResetMFA: false
+                      accountSSOLinked: not_linked
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+    put:
+      x-internal: false
+      summary: Update a user
+      operationId: updateUser
+      tags:
+        - Users
+      description: |-
+        Update a user's access level, integration permissions, or account
+        settings. The user's email cannot be changed after invite. To
+        disable a user without deleting, use `PUT /v1/ashares/{_id}/disable`
+        instead.
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: User access-record id.
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Request'
+            examples:
+              changeAccessLevel:
+                summary: Change to administrator
+                value:
+                  accessLevel: administrator
+              integrationOnly:
+                summary: Integration-only access
+                value:
+                  integrationAccessLevel:
+                    - _integrationId: 68f52162f00a35a1b26eaafb
+                      accessLevel: manage
+                    - _integrationId: 6842261335b64c0bcb308e4f
+                      accessLevel: monitor
+              disableUser:
+                summary: Re-enable a disabled user
+                value:
+                  disabled: false
+      responses:
+        '204':
+          description: User updated.
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+    delete:
+      x-internal: false
+      summary: Delete a user
+      operationId: deleteUser
+      tags:
+        - Users
+      description: |-
+        Remove a user from the current account. This is irreversible — for a
+        reversible alternative, use `PUT /v1/ashares/{_id}/disable`. Works
+        on both accepted and pending invites.
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: User access-record id.
+          schema:
+            type: string
+            format: objectId
+      responses:
+        '204':
+          description: User removed from the account.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_userId}/disable:
+    put:
+      x-internal: false
+      operationId: toggleUserDisabled
+      tags:
+        - Users
+      summary: Toggle a user's account access (disable or re-enable)
+      description: |-
+        Toggles the `disabled` flag on a user's access record. Call again to
+        re-enable — there is no separate `/enable` path. Only works on users
+        with `accepted: true`.
+      parameters:
+        - name: _userId
+          in: path
+          required: true
+          description: |-
+            The ashare record `_id` from `GET /v1/ashares` — despite the
+            parameter name, this is NOT `sharedWithUser._id`.
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Empty body — the target is identified by the path parameter alone.
+            examples:
+              default:
+                summary: Empty body
+                value: {}
+      responses:
+        '204':
+          description: User access toggled.
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          description: User not found.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                ashare_not_found:
+                  value:
+                    errors:
+                      - code: invalid_ref
+                        message: AShare not found.
+  /v1/ashares/{_id}/reinvite:
+    put:
+      x-internal: false
+      summary: Reinvite a user who dismissed their invite
+      description: |-
+        Re-sends the invitation to a user who previously dismissed it. Only
+        works on users with `dismissed: true` in the user record. After
+        reinviting, the user returns to a pending state awaiting acceptance.
+      operationId: reinviteUser
+      tags:
+        - Users
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: User access-record id.
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Empty body.
+            examples:
+              empty:
+                summary: Empty body — no fields required
+                value: {}
+      responses:
+        '204':
+          description: Reinvitation sent.
+        '400':
+          description: User has not dismissed the invite.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                notDismissed:
+                  summary: User has not dismissed
+                  value:
+                    errors:
+                      - code: invalid_request
+                        message: User has not dismissed the invite.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+  /v1/invite/multiple:
+    post:
+      x-internal: false
+      summary: Invite users to the account
+      description: |-
+        Invite one or more users by email. Each entry in the response array
+        corresponds to the email at the same index — check `statusCode` per
+        entry for partial failures.
+      operationId: inviteUsers
+      tags:
+        - Users
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/InviteRequest'
+            examples:
+              monitorAccess:
+                summary: Invite with monitor access
+                value:
+                  emails:
+                    - user1@example.com
+                    - user2@example.com
+                  accessLevel: monitor
+              integrationOnly:
+                summary: Invite with per-integration access
+                value:
+                  emails:
+                    - contractor@example.com
+                  integrationAccessLevel:
+                    - _integrationId: 68f52162f00a35a1b26eaafb
+                      accessLevel: manage
+      responses:
+        '200':
+          description: Array of results, one per email.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    statusCode:
+                      type: integer
+                      description: |-
+                        Per-entry result code. `201` on success, `400` if
+                        the user already has access (use `PUT /v1/ashares/{_id}`
+                        to update permissions instead).
+                    doc:
+                      $ref: '#/components/schemas/User'
+              examples:
+                default:
+                  value:
+                    - statusCode: 201
+                      doc:
+                        _id: 6a02b1869a09438890230ae2
+                        accessLevel: monitor
+                        integrationAccessLevel: []
+                        lastModified: '2026-05-12T04:50:14.342Z'
+                        createdAt: '2026-05-12T04:50:14.330Z'
+                        allowIntegrationWorkspaceCreation: false
+                        createdVia: existing_account_invite
+                        sharedWithUser:
+                          _id: 6a02b1859a09438890230a9f
+                          email: user1@example.com
+                    - statusCode: 201
+                      doc:
+                        _id: 6a02b1869a09438890230aef
+                        accessLevel: monitor
+                        integrationAccessLevel: []
+                        lastModified: '2026-05-12T04:50:14.355Z'
+                        createdAt: '2026-05-12T04:50:14.345Z'
+                        allowIntegrationWorkspaceCreation: false
+                        createdVia: existing_account_invite
+                        sharedWithUser:
+                          _id: 6a02b1859a09438890230aab
+                          email: user2@example.com
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+  schemas:
+    UserBase:
+      type: object
+      description: Writable fields shared by the request and response schemas.
+      properties:
+        disabled:
+          type: boolean
+          description: Set to False to enable a disabled user, or True to maintain disabled
+        accessLevel:
+          type: string
+          description: |-
+            Account-level access for the user.
+
+            **CRITICAL**: This controls account-wide access. Choose your strategy:
+
+            - Integration-only access: omit `accessLevel` and specify integrations in `integrationAccessLevel`
+            - Account-wide monitoring + selective management: set `accessLevel: monitor` and use `integrationAccessLevel`
+              to grant `manage` access for specific integrations
+            - Full account access: set `accessLevel: manage` or `accessLevel: administrator` and leave
+              `integrationAccessLevel` undefined/empty
+
+            If per-integration level permissions are needed, omit `accessLevel` and instead populate `integrationAccessLevel`.
+          x-celigo-ai-guidance:
+            - Choose the `accessLevel` value based on what the user should be able to do across the account.
+          enum:
+            - monitor
+            - manage
+            - administrator
+          x-enumDescriptions:
+            monitor: Grants access to view all integrations, run flows, and troubleshoot flow errors (retry/resolve) without modifying integrations, flows, steps, resources, account settings, or users
+            manage: Grants access to edit all integrations and resources and troubleshoot flow errors, but not to view or edit account settings or invite/manage users
+            administrator: Grants full account administration, including editing account settings, resources, and integrations; inviting/managing users; and troubleshooting flow errors, but does not grant owner-only actions such as transferring account ownership or managing owner permissions
+        integrationAccessLevel:
+          type: array
+          description: |-
+            Per-integration access levels for the user.
+
+            Use this for granting access to specific integrations.
+
+            - If `accessLevel` is omitted, this creates **integration-only** access.
+            - If `accessLevel` is `monitor`, this grants **elevated access** (typically `manage`) for specific integrations.
+            - If `accessLevel` is `manage` or `administrator`, do not set `integrationAccessLevel`.
+          items:
+            type: object
+            properties:
+              _integrationId:
+                type: string
+                format: objectId
+                x-celigo-refModel: integrations
+                examples:
+                  - 68f52162f00a35a1b26eaafb
+                description: Integration ID the user should have access to.
+              accessLevel:
+                type: string
+                description: Access level for this integration.
+                enum:
+                  - monitor
+                  - manage
+                x-enumDescriptions:
+                  monitor: Read-only access to view the integration and troubleshoot errors.
+                  manage: Full access to edit the integration and its resources.
+        accountSSORequired:
+          type: boolean
+          description: When true, SSO is required for this user in this account.
+          x-celigo-ai-guidance:
+            - Whether the invited user must use SSO to access this account.
+        accountMFARequired:
+          type: boolean
+          description: When true, MFA is required for this user in this account.
+          x-celigo-ai-guidance:
+            - Whether the invited user must use MFA to access this account.
+        allowAccessToAPIM:
+          type: boolean
+          description: When true, the user can access API Management (APIM) features for this account.
+        allowToEditRetryData:
+          type: boolean
+          description: |-
+            When true, the user can edit retry data when troubleshooting flow run errors (Error Management).
+
+            All users with **Monitor** access can view, retry, and resolve errant records. This flag controls whether they
+            can also **edit the retry data payload**. If set to false, the user cannot edit retry data for flow runs in any
+            integration workspace where they only have **Monitor** access.
+
+            This setting only applies when:
+            - `accessLevel` is `monitor`, or
+            - an entry in `integrationAccessLevel` grants `monitor` access for a specific integration.
+        allowIntegrationWorkspaceCreation:
+          type: boolean
+          description: When true, the user can create integration workspaces.
+    ResourceResponse:
+      type: object
+      description: Response
+      x-celigo-ai-guidance:
+        - Core response fields shared by all Celigo resources
+      properties:
+        _id:
+          type: string
+          format: objectId
+          readOnly: true
+          description: Unique identifier for the resource. Format is a 24-character hexadecimal string.
+          x-celigo-ai-guidance:
+            - |-
+              The _id is used in:
+              - API endpoints that operate on a specific resource (e.g., GET, PUT, DELETE)
+              - References from other resources (e.g., flows that use this resource)
+              - Job history and error tracking
+          examples:
+            - 5f8d43a1b9e5a80011a35f2c
+        createdAt:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Timestamp when the resource was created. Set automatically and cannot be modified.
+          x-celigo-ai-guidance:
+            - Recorded in ISO 8601 with a UTC timezone (Z suffix).
+          examples:
+            - '2023-04-01T09:15:32Z'
+        lastModified:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Timestamp when the resource was last updated. Changes whenever any property is modified.
+          x-celigo-ai-guidance:
+            - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+          examples:
+            - '2023-04-15T14:30:15Z'
+        deletedAt:
+          type:
+            - string
+            - 'null'
+          format: date-time
+          readOnly: true
+          description: Timestamp when the resource was soft-deleted. When null or absent, the resource is active.
+          x-celigo-ai-guidance:
+            - Non-null means the resource is soft-deleted (in the recycle bin) — recoverable within the retention period before permanent removal.
+          examples:
+            - '2023-05-20T11:45:32Z'
+      required:
+        - _id
+    User:
+      type: object
+      required:
+        - _id
+        - sharedWithUser
+        - integrationAccessLevel
+        - createdAt
+        - lastModified
+      description: |-
+        A user's access record in the account. Each user who has been invited
+        (or shared access) gets one record per account they belong to. The
+        `_id` is the access-record id, not the user's own id — the user's
+        identity is in `sharedWithUser._id`. The account owner does not
+        appear in this list.
+      x-celigo-ai-guidance:
+        - Account user object representing a user's access to the account
+      allOf:
+        - $ref: '#/components/schemas/UserBase'
+        - type: object
+          properties:
+            _id:
+              type: string
+              format: objectId
+              readOnly: true
+              x-celigo-refModel: users
+              examples:
+                - 6798f4dc43db9184f4bc8ee0
+              description: Access-record id for this user in the account.
+            accepted:
+              type: boolean
+              readOnly: true
+              description: When true, the user has accepted the invitation to join the account.
+            userType:
+              type: string
+              readOnly: true
+              enum:
+                - workspace
+              description: |-
+                Discriminates workspace users from end users on the underlying
+                access-record model. This endpoint only returns `workspace`
+                records — end users are managed through the End Users API.
+              x-enumDescriptions:
+                workspace: A workspace (team member) access record.
+            lastSignIn:
+              type: string
+              format: date-time
+              readOnly: true
+              examples:
+                - '2026-05-02T17:02:59.370Z'
+              description: When the user last signed in to this account.
+              x-celigo-ai-guidance:
+                - Last sign-in timestamp for the user (if available).
+            dismissed:
+              type: boolean
+              readOnly: true
+              description: When true, the invitation has been declined by the user.
+            isProductionAdmin:
+              type: boolean
+              readOnly: true
+              description: When true, the user has production-admin privileges in this account.
+            createdVia:
+              type: string
+              readOnly: true
+              description: How this user's access record was created.
+              enum:
+                - existing_account_invite
+                - existing_account_share_request
+                - invited_during_signup
+                - new_account_auto_join
+              x-enumDescriptions:
+                existing_account_invite: User was invited to an existing account by an admin.
+                existing_account_share_request: User requested access to a shared account.
+                invited_during_signup: User was invited as part of a new account signup flow.
+                new_account_auto_join: User automatically joined a new account via domain matching.
+            ssoSetupPending:
+              type: boolean
+              readOnly: true
+              description: |-
+                When true, the user must complete SSO setup for this account
+                before their SSO-required access is fully active. Set by the
+                server during SSO enrollment; cleared by removing the field, so
+                it is never `false`.
+            sharedWithUser:
+              type: object
+              readOnly: true
+              description: Identity details of the invited/shared user.
+              properties:
+                _id:
+                  type: string
+                  format: objectId
+                  x-celigo-refModel: users
+                  examples:
+                    - 624774a6a7574d3ed9f9a5cc
+                  description: The user's own account id.
+                email:
+                  type: string
+                  format: email
+                  examples:
+                    - admin@example.com
+                  description: Email address of the user.
+                name:
+                  type: string
+                  examples:
+                    - Account Admin
+                  description: Display name of the user.
+                lastSignIn:
+                  type: string
+                  format: date-time
+                  examples:
+                    - '2026-05-02T17:02:59.370Z'
+                  description: When the user last signed in (across any account).
+                allowedToResetMFA:
+                  type: boolean
+                  description: When true, the current requester can reset MFA for this user.
+                accountSSOLinked:
+                  type: string
+                  description: |-
+                    SSO linkage status for the user in this account.
+                    `this_account` means SSO is linked to the current account.
+                    `other_account` means SSO is linked to a different account.
+                  enum:
+                    - not_linked
+                    - this_account
+                    - other_account
+                  x-enumDescriptions:
+                    not_linked: User has no SSO linkage for this account.
+                    this_account: User's SSO is linked to this account.
+                    other_account: User's SSO is linked to a different account.
+        - $ref: '#/components/schemas/ResourceResponse'
+    Error:
+      type: object
+      description: Standard error response envelope returned by integrator.io APIs.
+      properties:
+        errors:
+          type: array
+          description: List of errors that occurred while processing the request.
+          items:
+            type: object
+            properties:
+              code:
+                oneOf:
+                  - type: string
+                  - type: integer
+                description: |-
+                  Machine-readable error code. Usually a string like
+                  `invalid_ref`, `missing_required_field`, or `unauthorized`;
+                  may be an **integer** when the error mirrors an upstream HTTP
+                  status (e.g. `500`) — most commonly returned by connection-ping
+                  and adaptor-proxy responses.
+              message:
+                type: string
+                description: Human-readable description of the error.
+              field:
+                type: string
+                description: |-
+                  Optional pointer to the document field that caused the error.
+                  Used by structural validation errors (`missing_required_field`,
+                  `invalid_ref`) to indicate which field is at fault
+                  (e.g. `_id`, `type`, `http.baseURI`).
+              source:
+                type: string
+                description: |-
+                  Optional origin layer for the error — e.g. `application` when
+                  the error came from the remote system the adaptor called,
+                  `connector` when the adaptor itself rejected the request.
+            required:
+              - message
+      required:
+        - errors
+    Request:
+      type: object
+      description: Fields that can be sent when inviting or updating an account user.
+      allOf:
+        - $ref: '#/components/schemas/UserBase'
+    InviteRequest:
+      description: |-
+        Request body for inviting users to the account. Extends the base
+        user request with email fields. Access settings apply uniformly
+        to all emails in a batch invite.
+      allOf:
+        - $ref: '#/components/schemas/Request'
+        - type: object
+          properties:
+            email:
+              type: string
+              format: email
+              examples:
+                - newuser@example.com
+              description: Single email address to invite (use with `POST /v1/invite`).
+            emails:
+              type: array
+              description: Email addresses to invite (use with `POST /v1/invite/multiple`).
+              items:
+                type: string
+                format: email
+                examples:
+                  - user1@example.com
+  responses:
+    401-unauthorized:
+      description: |-
+        Unauthorized. The request lacks a valid bearer token, or the provided token
+        failed to authenticate.
+
+        Note: the 401 response is produced by the auth middleware **before** the
+        request reaches the endpoint handler, so it does **not** follow the
+        standard `{errors: [...]}` envelope. Instead the body is a bare
+        `{message: string}` object with no `code`, no `errors` array. Callers
+        handling 401s should key off the HTTP status and the `message` string,
+        not try to destructure an `errors[]`.
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+                description: |-
+                  Human-readable description of the auth failure. Known values:
+                  - `"Unauthorized"` — no `Authorization` header on the request.
+                  - `"Bearer Authentication Failed"` — header present but token
+                    is invalid, revoked, or expired.
+            required:
+              - message
+          examples:
+            missing_token:
+              summary: No Authorization header sent
+              value:
+                message: Unauthorized
+            invalid_token:
+              summary: Bearer token invalid or revoked
+              value:
+                message: Bearer Authentication Failed
+    404-not-found:
+      description: |
+        Not found. The requested resource does not exist or is not visible to the caller.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            default:
+              value:
+                errors:
+                  - code: not_found
+                    message: The requested resource was not found.
+    400-bad-request:
+      description: |
+        Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            default:
+              value:
+                errors:
+                  - code: invalid_request
+                    message: The request body failed validation.
+x-enable-proxy: true
+x-internal: false