@celigo/api-specs 0.2.1

package/dist/audit.yml

@@ -0,0 +1,2006 @@
+openapi: 3.2.0
+info:
+  version: 1.0.0
+  title: Audit Logs
+  description: API for querying Celigo audit logs — the append-only record of configuration changes and account events.
+servers:
+  - url: https://api.integrator.io
+    description: Production (US / default region)
+  - url: https://api.eu.integrator.io
+    description: Production (EU region)
+  - url: https://api.au.integrator.io
+    description: Production (AU region)
+  - url: https://api.ca.integrator.io
+    description: Production (CA region)
+security:
+  - bearerAuth: []
+tags:
+  - name: Audit Logs
+    description: |-
+      Audit logs are an append-only record of every configuration change and
+      account event in Celigo. Each entry captures who performed an action,
+      what resource was affected, when it happened, and what changed — down
+      to field-level diffs for updates. Use them for compliance, change
+      tracking, and troubleshooting.
+
+      Notes:
+      - History is retained for a minimum of one year.
+      - Sensitive values (tokens, passwords) appear masked as `******`.
+      - CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.
+      - `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.
+
+      ## Audit entry schema
+
+      {% openapi-schemas spec="audit" schemas="AuditEntry" grouped="true" %}
+paths:
+  /v1/audit:
+    get:
+      x-internal: false
+      summary: Query audit logs
+      operationId: getAuditLogs
+      tags:
+        - Audit Logs
+      description: |-
+        Search audit log entries across all resources in the current account.
+        Use this to answer "what changed?" across the account — filter by resource
+        type, user, source, action, or time range. Results are ordered newest-first.
+
+        Filtering by `resourceType` + `_resourceId` returns entries for that
+        exact resource only — to include descendants (e.g. an integration's
+        flows and exports), use `GET /v1/{resourceType}/{_id}/audit` instead.
+        `_resourceId` requires `resourceType` to also be set.
+      parameters:
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 1000
+            default: 1000
+            examples:
+              - 100
+          description: Maximum number of audit entries to return.
+        - name: after
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`
+            response header's `rel="next"` URL rather than constructing it.
+          schema:
+            type: string
+            examples:
+              - W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0
+        - name: resourceType
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - accesstoken
+              - agent
+              - api
+              - ashare
+              - asynchelper
+              - connection
+              - dataset
+              - ediprofile
+              - environment
+              - export
+              - file
+              - filedefinition
+              - flow
+              - folder
+              - group
+              - iclient
+              - idpconfig
+              - import
+              - integration
+              - lookupcache
+              - mcpoauthprovider
+              - mcpserver
+              - notification
+              - revision
+              - role
+              - script
+              - ssoclient
+              - stack
+              - supportshare
+              - sync
+              - tool
+              - user
+            examples:
+              - connection
+            x-enumDescriptions:
+              accesstoken: API access token resource.
+              agent: On-premise agent resource.
+              api: Custom API endpoint resource.
+              ashare: Workspace user access record (account share) resource.
+              asynchelper: Async helper resource used for long-running operations.
+              connection: Connection resource for authenticating to external systems.
+              dataset: Dataset resource for data storage.
+              ediprofile: EDI profile resource for trading partner interchange configuration.
+              environment: Environment variable resource.
+              export: Export resource for reading data from a source system.
+              file: Celigo Storage file resource.
+              filedefinition: File definition resource for parsing structured files.
+              flow: Flow resource for data integration pipelines.
+              folder: Celigo Storage folder resource.
+              group: End-user group resource.
+              iclient: iClient shared credential resource.
+              idpconfig: End-user identity provider configuration resource.
+              import: Import resource for writing data to a destination system.
+              integration: Integration workspace resource.
+              lookupcache: Lookup cache resource for in-memory key-value stores.
+              mcpoauthprovider: MCP OAuth provider resource.
+              mcpserver: MCP server resource for AI agent tool hosting.
+              notification: Notification subscription resource.
+              revision: Revision snapshot resource for version control.
+              role: End-user role resource.
+              script: Script resource for custom JavaScript hooks.
+              ssoclient: SSO client configuration resource.
+              stack: Stack resource for on-premise or Lambda execution environments.
+              supportshare: Support share access grant resource.
+              sync: Sync resource.
+              tool: Tool resource for reusable building blocks.
+              user: User access record resource.
+          description: |-
+            Filter by resource type (singular form). Unsupported values are
+            rejected with 422 `audit_not_supported`.
+        - name: _resourceId
+          in: query
+          required: false
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 60a2c4e6f321d800129a1a3c
+          description: Filter by a specific resource id. Requires `resourceType` to also be set.
+        - name: _byUserId
+          in: query
+          required: false
+          description: Filter by user id, or pass `support` to filter actions performed by Celigo support.
+          schema:
+            type: string
+            x-celigo-refModel: users
+            examples:
+              - 624cb0346309dc3a543733a2
+        - name: source
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - ui
+              - api
+              - system
+              - connector
+              - script
+              - stack
+              - sso
+              - cli
+              - mcp
+              - ora
+            examples:
+              - ui
+            x-enumDescriptions:
+              ui: Change made through the Celigo web UI.
+              api: Change made via the REST API.
+              system: Change made automatically by the platform.
+              connector: Change made by an Integration App (connector) process.
+              script: Change made by a custom script execution.
+              stack: Change made by extension code hosted on a stack.
+              sso: Change triggered by an SSO authentication event.
+              cli: Change made via the Celigo CLI.
+              mcp: Change made through the Celigo Platform MCP server.
+              ora: Change made by the Ora AI assistant.
+          description: |-
+            Filter by source. Unsupported values are rejected with 422
+            `invalid_audit_field`.
+        - name: fieldPath
+          in: query
+          required: false
+          schema:
+            type: string
+            examples:
+              - http.auth.token.token
+          description: |-
+            Restrict the `fieldChanges` of returned entries to changes on this
+            field path. The value is not validated against known paths — an
+            unknown path simply matches nothing.
+        - name: action
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - create
+              - update
+              - delete
+              - view
+              - restore
+              - purge
+              - signin
+              - signout
+              - purgelogs
+            examples:
+              - update
+            x-enumDescriptions:
+              create: A resource was created.
+              update: A resource was modified.
+              delete: A resource was deleted (moved to recycle bin).
+              view: A resource was viewed or accessed.
+              restore: A resource was restored from the recycle bin.
+              purge: A resource was permanently purged from the recycle bin.
+              signin: A user signed in to the account.
+              signout: A user signed out of the account.
+              purgelogs: Execution logs were purged for a resource.
+          description: Filter by action/event.
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+      responses:
+        '200':
+          description: Audit entries
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination link. Includes `<...>; rel="next"` with an
+                `after` cursor when more entries exist; absent on the final page.
+              schema:
+                type: string
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AuditEntry'
+              examples:
+                default:
+                  value:
+                    - _id: 69fe3b7833f18c171d7e91b9
+                      resourceType: connection
+                      _resourceId: 69497ca1b40d3e24522a7f3c
+                      source: system
+                      fieldChanges:
+                        - fieldPath: http.auth.token.token
+                          oldValue: '******'
+                          newValue: '******'
+                      event: update
+                      time: '2026-05-08T19:37:27.436Z'
+                      byUser:
+                        _id: 624cb0346309dc3a543733a2
+                        email: jane.doe@example.com
+                        name: Jane Doe
+                    - _id: 69f6367c3469e3f559a8cac9
+                      resourceType: connection
+                      _resourceId: 69f6367b3469e3f559a8cabf
+                      source: api
+                      fieldChanges: []
+                      event: create
+                      time: '2026-05-02T17:38:04.021Z'
+                      deletedInfo:
+                        name: My HTTP Connection
+                      byUser:
+                        _id: 624cb0346309dc3a543733a2
+                        email: jane.doe@example.com
+                        name: Jane Doe
+        '204':
+          description: No audit entries found
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          $ref: '#/components/responses/422-unprocessable-entity'
+    post:
+      x-internal: false
+      summary: Query audit logs with multi-select filters
+      operationId: queryAuditLogs
+      tags:
+        - Audit Logs
+      description: |-
+        The POST variant of the account-wide audit query, for filters the GET
+        query string cannot express: each body filter is an array that matches
+        entries with any of the listed values, and `resourceName` scopes results
+        to an explicit list of resources. Response shape and ordering are
+        identical to `GET /v1/audit`.
+
+        Pagination, sorting, and time bounds stay in the query string — sending
+        them in the body fails with 400 `invalid_request_body`.
+      parameters:
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 1000
+            default: 1000
+            examples:
+              - 100
+          description: Maximum number of audit entries to return.
+        - name: after
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`
+            response header's `rel="next"` URL rather than constructing it. Mutually exclusive
+            with `before`.
+          schema:
+            type: string
+            examples:
+              - W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0
+        - name: before
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the previous page, from the `Link` response
+            header. Mutually exclusive with `after` — sending both returns 422.
+          schema:
+            type: string
+        - name: sort_by
+          in: query
+          required: false
+          description: Field to sort by. Only `time` is accepted; other values return 422.
+          schema:
+            type: string
+            enum:
+              - time
+            default: time
+            x-enumDescriptions:
+              time: Sort by the entry timestamp.
+        - name: sort_order
+          in: query
+          required: false
+          description: Sort direction for `time`.
+          schema:
+            type: string
+            enum:
+              - asc
+              - desc
+            default: desc
+            x-enumDescriptions:
+              asc: Oldest entries first.
+              desc: Newest entries first.
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuditQueryFilters'
+            examples:
+              multi-select:
+                summary: Connection and agent creates/updates
+                value:
+                  resourceType:
+                    - connection
+                    - agent
+                  action:
+                    - create
+                    - update
+              by-source:
+                summary: Entries from API or system activity
+                value:
+                  source:
+                    - api
+                    - system
+      responses:
+        '200':
+          description: Audit entries
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination link. Includes `<...>; rel="next"` with an
+                `after` cursor when more entries exist; absent on the final page.
+              schema:
+                type: string
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AuditEntry'
+              examples:
+                default:
+                  value:
+                    - _id: 69fe3b7833f18c171d7e91b9
+                      resourceType: connection
+                      _resourceId: 69497ca1b40d3e24522a7f3c
+                      source: api
+                      fieldChanges:
+                        - fieldPath: http.auth.token.token
+                          oldValue: '******'
+                          newValue: '******'
+                      event: update
+                      time: '2026-05-08T19:37:27.436Z'
+                      byUser:
+                        _id: 624cb0346309dc3a543733a2
+                        email: jane.doe@example.com
+                        name: Jane Doe
+        '204':
+          description: No audit entries match the filters.
+        '400':
+          description: Pagination parameters were sent in the request body.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                pagination_in_body:
+                  value:
+                    errors:
+                      - code: invalid_request_body
+                        message: 'The request body should not contain pagination parameter(s): limit. Pagination values (after, before, limit, sort_order, sort_by) must be provided as query parameters. The request body should only contain filter fields.'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          description: |-
+            A filter value is invalid, a filter that must be an array was sent as
+            another type, or the `after`/`before` cursor is malformed.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                invalid_value:
+                  value:
+                    errors:
+                      - code: invalid_audit_field
+                        message: zzz is not a valid audit source.
+                not_an_array:
+                  value:
+                    errors:
+                      - code: invalid_field_type
+                        message: The "source" field must be an array when provided in the request body.
+  /v1/audit/signedURL:
+    get:
+      x-internal: false
+      summary: Get signed URL to download audit logs CSV (all documents)
+      operationId: getAuditSignedUrlAll
+      tags:
+        - Audit Logs
+      description: |-
+        Generates a signed URL for downloading a CSV export of audit logs across all
+        documents. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,
+        Field, Old value, New value, Support.
+
+        The signed URL expires after 15 minutes. When `hasMore` is true, pass
+        the last CSV row's timestamp as `to` to fetch the next batch.
+      parameters:
+        - name: resourceType
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - accesstoken
+              - agent
+              - api
+              - ashare
+              - asynchelper
+              - connection
+              - dataset
+              - ediprofile
+              - environment
+              - export
+              - file
+              - filedefinition
+              - flow
+              - folder
+              - group
+              - iclient
+              - idpconfig
+              - import
+              - integration
+              - lookupcache
+              - mcpoauthprovider
+              - mcpserver
+              - notification
+              - revision
+              - role
+              - script
+              - ssoclient
+              - stack
+              - supportshare
+              - sync
+              - tool
+              - user
+            x-enumDescriptions:
+              accesstoken: API access token resource.
+              agent: On-premise agent resource.
+              api: Custom API endpoint resource.
+              ashare: Workspace user access record (account share) resource.
+              asynchelper: Async helper resource used for long-running operations.
+              connection: Connection resource for authenticating to external systems.
+              dataset: Dataset resource for data storage.
+              ediprofile: EDI profile resource for trading partner interchange configuration.
+              environment: Environment variable resource.
+              export: Export resource for reading data from a source system.
+              file: Celigo Storage file resource.
+              filedefinition: File definition resource for parsing structured files.
+              flow: Flow resource for data integration pipelines.
+              folder: Celigo Storage folder resource.
+              group: End-user group resource.
+              iclient: iClient shared credential resource.
+              idpconfig: End-user identity provider configuration resource.
+              import: Import resource for writing data to a destination system.
+              integration: Integration workspace resource.
+              lookupcache: Lookup cache resource for in-memory key-value stores.
+              mcpoauthprovider: MCP OAuth provider resource.
+              mcpserver: MCP server resource for AI agent tool hosting.
+              notification: Notification subscription resource.
+              revision: Revision snapshot resource for version control.
+              role: End-user role resource.
+              script: Script resource for custom JavaScript hooks.
+              ssoclient: SSO client configuration resource.
+              stack: Stack resource for on-premise or Lambda execution environments.
+              supportshare: Support share access grant resource.
+              sync: Sync resource.
+              tool: Tool resource for reusable building blocks.
+              user: User access record resource.
+          description: Optional filter by resource type (singular form).
+        - name: _byUserId
+          in: query
+          required: false
+          schema:
+            type: string
+            x-celigo-refModel: users
+            examples:
+              - 624cb0346309dc3a543733a2
+          description: Optional filter by the user who performed the actions.
+        - name: _resourceId
+          in: query
+          required: false
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 60a2c4e6f321d800129a1a3c
+          description: Optional filter by resource id.
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+        - name: action
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - create
+              - update
+              - delete
+              - view
+              - restore
+              - purge
+              - signin
+              - signout
+              - purgelogs
+            x-enumDescriptions:
+              create: A resource was created.
+              update: A resource was modified.
+              delete: A resource was deleted (moved to recycle bin).
+              view: A resource was viewed or accessed.
+              restore: A resource was restored from the recycle bin.
+              purge: A resource was permanently purged from the recycle bin.
+              signin: A user signed in to the account.
+              signout: A user signed out of the account.
+              purgelogs: Execution logs were purged for a resource.
+          description: Action/event filter.
+        - name: source
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - ui
+              - api
+              - system
+              - connector
+              - script
+              - stack
+              - sso
+              - cli
+              - mcp
+              - ora
+            x-enumDescriptions:
+              ui: Change made through the Celigo web UI.
+              api: Change made via the REST API.
+              system: Change made automatically by the platform.
+              connector: Change made by an Integration App (connector) process.
+              script: Change made by a custom script execution.
+              stack: Change made by extension code hosted on a stack.
+              sso: Change triggered by an SSO authentication event.
+              cli: Change made via the Celigo CLI.
+              mcp: Change made through the Celigo Platform MCP server.
+              ora: Change made by the Ora AI assistant.
+          description: Source filter.
+      responses:
+        '200':
+          description: Signed URL response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SignedUrlResponse'
+              examples:
+                default:
+                  value:
+                    signedURL: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...
+                    hasMore: false
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          $ref: '#/components/responses/422-unprocessable-entity'
+    post:
+      x-internal: false
+      summary: Get signed URL for audit CSV with multi-select filters
+      operationId: queryAuditSignedUrlAll
+      tags:
+        - Audit Logs
+      description: |-
+        The POST variant of the CSV signed-URL download, accepting the same
+        multi-select filter body as `POST /v1/audit`. The response is identical
+        to the GET variant: a signed URL valid for ~15 minutes plus `hasMore`
+        for batching.
+
+        Sorting and time bounds stay in the query string — sending `from`/`to`
+        or pagination keys in the body fails with 400.
+      parameters:
+        - name: sort_order
+          in: query
+          required: false
+          description: Sort direction for the CSV rows by time.
+          schema:
+            type: string
+            enum:
+              - asc
+              - desc
+            default: desc
+            x-enumDescriptions:
+              asc: Oldest entries first.
+              desc: Newest entries first.
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuditQueryFilters'
+            examples:
+              by-source:
+                summary: CSV of API-sourced changes
+                value:
+                  source:
+                    - api
+      responses:
+        '200':
+          description: Signed URL response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SignedUrlResponse'
+              examples:
+                default:
+                  value:
+                    signedURL: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...
+                    hasMore: false
+        '400':
+          description: Pagination or time-bound parameters were sent in the request body.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          $ref: '#/components/responses/422-unprocessable-entity'
+  /v1/{resourceType}/{_id}/audit:
+    get:
+      x-internal: false
+      summary: Get audit log for a resource (and descendants)
+      operationId: getAuditForResource
+      tags:
+        - Audit Logs
+      description: |-
+        Returns audit log entries for a specific resource and its descendants. For example,
+        querying an integration returns changes to the integration, its flows, exports,
+        imports, and connections.
+
+        For account-wide searches, use `GET /v1/audit` instead.
+      parameters:
+        - name: resourceType
+          in: path
+          required: true
+          schema:
+            type: string
+            enum:
+              - accesstokens
+              - agents
+              - apis
+              - asynchelpers
+              - connections
+              - ediprofiles
+              - exports
+              - filedefinitions
+              - flows
+              - groups
+              - iclients
+              - idpconfigs
+              - imports
+              - integrations
+              - lookupcaches
+              - mcpoauthproviders
+              - mcpservers
+              - revisions
+              - roles
+              - scripts
+              - ssoclients
+              - stacks
+              - syncs
+              - tools
+            examples:
+              - integrations
+            x-enumDescriptions:
+              accesstokens: API access token resources.
+              agents: On-premise agent resources.
+              apis: Custom API endpoint resources.
+              asynchelpers: Async helper resources.
+              connections: Connection resources.
+              ediprofiles: EDI profile resources.
+              exports: Export resources.
+              filedefinitions: File definition resources.
+              flows: Flow resources.
+              groups: End-user group resources.
+              iclients: iClient shared credential resources.
+              idpconfigs: End-user identity provider configuration resources.
+              imports: Import resources.
+              integrations: Integration workspace resources.
+              lookupcaches: Lookup cache resources.
+              mcpoauthproviders: MCP OAuth provider resources.
+              mcpservers: MCP server resources.
+              revisions: Revision snapshot resources.
+              roles: End-user role resources.
+              scripts: Script resources.
+              ssoclients: SSO client configuration resources.
+              stacks: Stack resources.
+              syncs: Sync resources.
+              tools: Tool resources.
+          description: Plural resource type.
+        - name: _id
+          in: path
+          required: true
+          description: Resource id.
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 60a2c4e6f321d800129a1a3c
+        - name: limit
+          in: query
+          required: false
+          description: Maximum number of audit entries to return.
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 1000
+            default: 1000
+            examples:
+              - 100
+        - name: after
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`
+            response header's `rel="next"` URL rather than constructing it.
+          schema:
+            type: string
+            examples:
+              - W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+        - name: action
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - create
+              - update
+              - delete
+              - view
+              - restore
+              - purge
+              - signin
+              - signout
+              - purgelogs
+            examples:
+              - update
+            x-enumDescriptions:
+              create: A resource was created.
+              update: A resource was modified.
+              delete: A resource was deleted (moved to recycle bin).
+              view: A resource was viewed or accessed.
+              restore: A resource was restored from the recycle bin.
+              purge: A resource was permanently purged from the recycle bin.
+              signin: A user signed in to the account.
+              signout: A user signed out of the account.
+              purgelogs: Execution logs were purged for a resource.
+          description: Filter by action/event.
+        - name: source
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - ui
+              - api
+              - system
+              - connector
+              - script
+              - stack
+              - sso
+              - cli
+              - mcp
+              - ora
+            examples:
+              - ui
+            x-enumDescriptions:
+              ui: Change made through the Celigo web UI.
+              api: Change made via the REST API.
+              system: Change made automatically by the platform.
+              connector: Change made by an Integration App (connector) process.
+              script: Change made by a custom script execution.
+              stack: Change made by extension code hosted on a stack.
+              sso: Change triggered by an SSO authentication event.
+              cli: Change made via the Celigo CLI.
+              mcp: Change made through the Celigo Platform MCP server.
+              ora: Change made by the Ora AI assistant.
+          description: Filter by source.
+        - name: _byUserId
+          in: query
+          required: false
+          schema:
+            type: string
+            x-celigo-refModel: users
+            examples:
+              - 624cb0346309dc3a543733a2
+          description: Filter by the user who performed the action.
+      responses:
+        '200':
+          description: Audit entries
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination link. Includes `<...>; rel="next"` with an
+                `after` cursor when more entries exist; absent on the final page.
+              schema:
+                type: string
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AuditEntry'
+              examples:
+                default:
+                  value:
+                    - _id: 69f63df97009ea11abf0cb97
+                      resourceType: ediprofile
+                      _resourceId: 690146d901d66a7545038179
+                      source: api
+                      fieldChanges:
+                        - fieldPath: tpInterchangeId
+                          oldValue: 9253390501 test
+                          newValue: '9253390501'
+                      event: update
+                      time: '2026-05-02T18:10:01.832Z'
+                      byUser:
+                        _id: 624cb0346309dc3a543733a2
+                        email: jane.doe@example.com
+                        name: Jane Doe
+        '204':
+          description: No audit entries found
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+        '422':
+          $ref: '#/components/responses/422-unprocessable-entity'
+    post:
+      x-internal: false
+      summary: Query a resource's audit log with multi-select filters
+      operationId: queryAuditForResource
+      tags:
+        - Audit Logs
+      description: |-
+        The POST variant of the resource-and-descendants audit query, accepting
+        the same multi-select filter body as `POST /v1/audit`. Body filters apply
+        within the resource's descendant set — e.g. filter an integration's audit
+        trail to specific actions or sources. Response shape matches the GET
+        variant.
+
+        Pagination, sorting, and time bounds stay in the query string — sending
+        them in the body fails with 400 `invalid_request_body`.
+      parameters:
+        - name: resourceType
+          in: path
+          required: true
+          schema:
+            type: string
+            enum:
+              - accesstokens
+              - agents
+              - apis
+              - asynchelpers
+              - connections
+              - ediprofiles
+              - exports
+              - filedefinitions
+              - flows
+              - groups
+              - iclients
+              - idpconfigs
+              - imports
+              - integrations
+              - lookupcaches
+              - mcpoauthproviders
+              - mcpservers
+              - revisions
+              - roles
+              - scripts
+              - ssoclients
+              - stacks
+              - syncs
+              - tools
+            examples:
+              - integrations
+            x-enumDescriptions:
+              accesstokens: API access token resources.
+              agents: On-premise agent resources.
+              apis: Custom API endpoint resources.
+              asynchelpers: Async helper resources.
+              connections: Connection resources.
+              ediprofiles: EDI profile resources.
+              exports: Export resources.
+              filedefinitions: File definition resources.
+              flows: Flow resources.
+              groups: End-user group resources.
+              iclients: iClient shared credential resources.
+              idpconfigs: End-user identity provider configuration resources.
+              imports: Import resources.
+              integrations: Integration workspace resources.
+              lookupcaches: Lookup cache resources.
+              mcpoauthproviders: MCP OAuth provider resources.
+              mcpservers: MCP server resources.
+              revisions: Revision snapshot resources.
+              roles: End-user role resources.
+              scripts: Script resources.
+              ssoclients: SSO client configuration resources.
+              stacks: Stack resources.
+              syncs: Sync resources.
+              tools: Tool resources.
+          description: Plural resource type.
+        - name: _id
+          in: path
+          required: true
+          description: Resource id.
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 60a2c4e6f321d800129a1a3c
+        - name: limit
+          in: query
+          required: false
+          description: Maximum number of audit entries to return.
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 1000
+            default: 1000
+            examples:
+              - 100
+        - name: after
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`
+            response header's `rel="next"` URL rather than constructing it. Mutually exclusive
+            with `before`.
+          schema:
+            type: string
+        - name: before
+          in: query
+          required: false
+          description: |-
+            Opaque pagination cursor for the previous page, from the `Link` response
+            header. Mutually exclusive with `after` — sending both returns 422.
+          schema:
+            type: string
+        - name: sort_by
+          in: query
+          required: false
+          description: Field to sort by. Only `time` is accepted; other values return 422.
+          schema:
+            type: string
+            enum:
+              - time
+            default: time
+            x-enumDescriptions:
+              time: Sort by the entry timestamp.
+        - name: sort_order
+          in: query
+          required: false
+          description: Sort direction for `time`.
+          schema:
+            type: string
+            enum:
+              - asc
+              - desc
+            default: desc
+            x-enumDescriptions:
+              asc: Oldest entries first.
+              desc: Newest entries first.
+        - name: from
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-01-01T00:00:00.000Z'
+          description: Start timestamp (ISO-8601).
+        - name: to
+          in: query
+          required: false
+          schema:
+            type: string
+            format: date-time
+            examples:
+              - '2025-12-31T23:59:59.999Z'
+          description: End timestamp (ISO-8601).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuditQueryFilters'
+            examples:
+              actions:
+                summary: Only creates and updates within this resource's tree
+                value:
+                  action:
+                    - create
+                    - update
+      responses:
+        '200':
+          description: Audit entries
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination link. Includes `<...>; rel="next"` with an
+                `after` cursor when more entries exist; absent on the final page.
+              schema:
+                type: string
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AuditEntry'
+              examples:
+                default:
+                  value:
+                    - _id: 69f63df97009ea11abf0cb97
+                      resourceType: ediprofile
+                      _resourceId: 690146d901d66a7545038179
+                      source: api
+                      fieldChanges:
+                        - fieldPath: tpInterchangeId
+                          oldValue: 9253390501 test
+                          newValue: '9253390501'
+                      event: update
+                      time: '2026-05-02T18:10:01.832Z'
+                      byUser:
+                        _id: 624cb0346309dc3a543733a2
+                        email: jane.doe@example.com
+                        name: Jane Doe
+        '204':
+          description: No audit entries match the filters.
+        '400':
+          description: |-
+            Pagination parameters were sent in the request body, or the path is
+            invalid (`_id` malformed, or a resource type without audit support).
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+        '422':
+          description: |-
+            A filter value is invalid, a filter that must be an array was sent as
+            another type, or the `after`/`before` cursor is malformed.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+  /v1/{resourceType}/audit/signedURL:
+    post:
+      x-internal: false
+      summary: Get signed URL to download audit logs CSV (for selected resources)
+      operationId: getAuditSignedUrlForResources
+      tags:
+        - Audit Logs
+      description: |-
+        Generates a signed URL for downloading a CSV export of audit logs for specific
+        resources and their descendants.
+
+        The signed URL expires after 15 minutes. When `hasMore` is true, pass
+        the last CSV row's timestamp as `to` in the request body to fetch the
+        next batch.
+      parameters:
+        - name: resourceType
+          in: path
+          required: true
+          schema:
+            type: string
+            enum:
+              - accesstokens
+              - agents
+              - apis
+              - asynchelpers
+              - connections
+              - ediprofiles
+              - exports
+              - filedefinitions
+              - flows
+              - groups
+              - iclients
+              - idpconfigs
+              - imports
+              - integrations
+              - lookupcaches
+              - mcpoauthproviders
+              - mcpservers
+              - revisions
+              - roles
+              - scripts
+              - ssoclients
+              - stacks
+              - syncs
+              - tools
+            x-enumDescriptions:
+              accesstokens: API access token resources.
+              agents: On-premise agent resources.
+              apis: Custom API endpoint resources.
+              asynchelpers: Async helper resources.
+              connections: Connection resources.
+              ediprofiles: EDI profile resources.
+              exports: Export resources.
+              filedefinitions: File definition resources.
+              flows: Flow resources.
+              groups: End-user group resources.
+              iclients: iClient shared credential resources.
+              idpconfigs: End-user identity provider configuration resources.
+              imports: Import resources.
+              integrations: Integration workspace resources.
+              lookupcaches: Lookup cache resources.
+              mcpoauthproviders: MCP OAuth provider resources.
+              mcpservers: MCP server resources.
+              revisions: Revision snapshot resources.
+              roles: End-user role resources.
+              scripts: Script resources.
+              ssoclients: SSO client configuration resources.
+              stacks: Stack resources.
+              syncs: Sync resources.
+              tools: Tool resources.
+          description: Plural resource type.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuditDownloadRequest'
+            examples:
+              minimal:
+                summary: Minimal — just resource IDs
+                value:
+                  _resourceIds:
+                    - 60a2c4e6f321d800129a1a3c
+                    - 60a2c4e6f321d800129a1a4d
+              filtered:
+                summary: With time range and action filter
+                value:
+                  _resourceIds:
+                    - 60a2c4e6f321d800129a1a3c
+                  from: '2025-01-01T00:00:00.000Z'
+                  to: '2025-12-31T23:59:59.999Z'
+                  action: update
+      responses:
+        '200':
+          description: Signed URL response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SignedUrlResponse'
+              examples:
+                default:
+                  value:
+                    signedURL: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...
+                    hasMore: false
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          $ref: '#/components/responses/422-unprocessable-entity'
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+  schemas:
+    FieldChange:
+      type: object
+      description: A single field-level change within an audit entry.
+      properties:
+        fieldPath:
+          type: string
+          description: Dot-path to the changed field (e.g., `settings.foo.bar`).
+          examples:
+            - http.auth.token.token
+        oldValue:
+          description: Previous value (may be any JSON type).
+        newValue:
+          description: New value (may be any JSON type).
+    DeletedInfo:
+      type: object
+      description: Extra context recorded for delete events (when available).
+      properties:
+        name:
+          type: string
+          description: Name of the deleted resource (if available).
+          examples:
+            - My HTTP Connection
+        _integrationId:
+          type: string
+          format: objectId
+          x-celigo-refModel: integrations
+          description: Integration id context (for flow/sync-related events).
+          examples:
+            - 60a2c4e6f321d800129a1a3c
+        _abstractFlowId:
+          type: string
+          format: objectId
+          x-celigo-refModel: flows
+          description: Abstract flow id (for instance flow events).
+          examples:
+            - 6610a2c4e6f321d800129b2d
+        _syncId:
+          type: string
+          format: objectId
+          x-celigo-refModel: syncs
+          description: Sync id context (for dataset events).
+          examples:
+            - 66b3c5d7e8f901a2b3c4d5e6
+    AuditEntry:
+      type: object
+      required:
+        - _id
+        - event
+        - resourceType
+        - source
+        - time
+        - byUser
+        - fieldChanges
+      description: An audit log entry.
+      properties:
+        _id:
+          type: string
+          format: objectId
+          readOnly: true
+          description: Audit entry id.
+          examples:
+            - 69fe3b7833f18c171d7e91b9
+        byUser:
+          type: object
+          readOnly: true
+          description: The user who performed the action. Populated at read time from the current user record.
+          properties:
+            _id:
+              type: string
+              format: objectId
+              x-celigo-refModel: users
+              description: User id of the actor.
+              examples:
+                - 624cb0346309dc3a543733a2
+            email:
+              type: string
+              description: Actor's current email address.
+              examples:
+                - jane.doe@example.com
+            name:
+              type: string
+              description: Actor's current display name.
+              examples:
+                - Jane Doe
+        resourceType:
+          type: string
+          readOnly: true
+          description: Resource type that the audit entry applies to.
+          enum:
+            - accesstoken
+            - agent
+            - api
+            - ashare
+            - asynchelper
+            - connection
+            - dataset
+            - ediprofile
+            - environment
+            - export
+            - file
+            - filedefinition
+            - flow
+            - folder
+            - group
+            - iclient
+            - idpconfig
+            - import
+            - integration
+            - lookupcache
+            - mcpoauthprovider
+            - mcpserver
+            - notification
+            - revision
+            - role
+            - script
+            - ssoclient
+            - stack
+            - supportshare
+            - sync
+            - tool
+            - user
+          x-enumDescriptions:
+            accesstoken: API access token resource.
+            agent: On-premise agent resource.
+            api: Custom API endpoint resource.
+            ashare: Workspace user access record (account share) resource.
+            asynchelper: Async helper resource used for long-running operations.
+            connection: Connection resource for authenticating to external systems.
+            dataset: Dataset resource for data storage.
+            ediprofile: EDI profile resource for trading partner interchange configuration.
+            environment: Environment variable resource.
+            export: Export resource for reading data from a source system.
+            file: Celigo Storage file resource.
+            filedefinition: File definition resource for parsing structured files.
+            flow: Flow resource for data integration pipelines.
+            folder: Celigo Storage folder resource.
+            group: End-user group resource.
+            iclient: iClient shared credential resource.
+            idpconfig: End-user identity provider configuration resource.
+            import: Import resource for writing data to a destination system.
+            integration: Integration workspace resource.
+            lookupcache: Lookup cache resource for in-memory key-value stores.
+            mcpoauthprovider: MCP OAuth provider resource.
+            mcpserver: MCP server resource for AI agent tool hosting.
+            notification: Notification subscription resource.
+            revision: Revision snapshot resource for version control.
+            role: End-user role resource.
+            script: Script resource for custom JavaScript hooks.
+            ssoclient: SSO client configuration resource.
+            stack: Stack resource for on-premise or Lambda execution environments.
+            supportshare: Support share access grant resource.
+            sync: Sync resource.
+            tool: Tool resource for reusable building blocks.
+            user: User access record resource.
+        _resourceId:
+          type: string
+          format: objectId
+          readOnly: true
+          description: Resource id the audit entry applies to.
+          examples:
+            - 69497ca1b40d3e24522a7f3c
+        source:
+          type: string
+          readOnly: true
+          description: Source of the change.
+          enum:
+            - ui
+            - api
+            - system
+            - connector
+            - script
+            - stack
+            - sso
+            - cli
+            - mcp
+            - ora
+          x-enumDescriptions:
+            ui: Change made through the Celigo web UI.
+            api: Change made via the REST API.
+            system: Change made automatically by the platform.
+            connector: Change made by an Integration App (connector) process.
+            stack: Change made by extension code hosted on a stack.
+            script: Change made by a custom script execution.
+            sso: Change triggered by an SSO authentication event.
+            cli: Change made via the Celigo CLI.
+            mcp: Change made through the Celigo Platform MCP server.
+            ora: Change made by the Ora AI assistant.
+        support:
+          type: boolean
+          readOnly: true
+          description: When true, the action was performed by support tooling/context.
+        fieldChanges:
+          type: array
+          readOnly: true
+          description: List of field-level changes (when applicable).
+          items:
+            $ref: '#/components/schemas/FieldChange'
+        deletedInfo:
+          $ref: '#/components/schemas/DeletedInfo'
+        event:
+          type: string
+          readOnly: true
+          description: Audit event type.
+          enum:
+            - create
+            - update
+            - delete
+            - view
+            - restore
+            - purge
+            - signin
+            - signout
+            - purgelogs
+          x-enumDescriptions:
+            create: A resource was created.
+            update: A resource was modified.
+            delete: A resource was deleted (moved to recycle bin).
+            view: A resource was viewed or accessed.
+            restore: A resource was restored from the recycle bin.
+            purge: A resource was permanently purged from the recycle bin.
+            signin: A user signed in to the account.
+            signout: A user signed out of the account.
+            purgelogs: Execution logs were purged for a resource.
+        time:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Timestamp when the action occurred.
+          examples:
+            - '2026-05-08T19:37:27.436Z'
+    Error:
+      type: object
+      description: Standard error response envelope returned by integrator.io APIs.
+      properties:
+        errors:
+          type: array
+          description: List of errors that occurred while processing the request.
+          items:
+            type: object
+            properties:
+              code:
+                oneOf:
+                  - type: string
+                  - type: integer
+                description: |-
+                  Machine-readable error code. Usually a string like
+                  `invalid_ref`, `missing_required_field`, or `unauthorized`;
+                  may be an **integer** when the error mirrors an upstream HTTP
+                  status (e.g. `500`) — most commonly returned by connection-ping
+                  and adaptor-proxy responses.
+              message:
+                type: string
+                description: Human-readable description of the error.
+              field:
+                type: string
+                description: |-
+                  Optional pointer to the document field that caused the error.
+                  Used by structural validation errors (`missing_required_field`,
+                  `invalid_ref`) to indicate which field is at fault
+                  (e.g. `_id`, `type`, `http.baseURI`).
+              source:
+                type: string
+                description: |-
+                  Optional origin layer for the error — e.g. `application` when
+                  the error came from the remote system the adaptor called,
+                  `connector` when the adaptor itself rejected the request.
+            required:
+              - message
+      required:
+        - errors
+    AuditQueryFilters:
+      type: object
+      description: |-
+        Multi-select audit filters for the POST query endpoints. Every filter is
+        an array — send multiple values to match any of them. Pagination
+        (`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds
+        (`from`, `to`) belong in the query string, not this body — including
+        them here fails with 400 `invalid_request_body`.
+      properties:
+        resourceType:
+          type: array
+          description: Match entries for any of these resource types (singular form).
+          items:
+            type: string
+            enum:
+              - accesstoken
+              - agent
+              - api
+              - ashare
+              - asynchelper
+              - connection
+              - dataset
+              - ediprofile
+              - environment
+              - export
+              - file
+              - filedefinition
+              - flow
+              - folder
+              - group
+              - iclient
+              - idpconfig
+              - import
+              - integration
+              - lookupcache
+              - mcpoauthprovider
+              - mcpserver
+              - notification
+              - revision
+              - role
+              - script
+              - ssoclient
+              - stack
+              - supportshare
+              - sync
+              - tool
+              - user
+            x-enumDescriptions:
+              accesstoken: API access token resource.
+              agent: On-premise agent resource.
+              api: Custom API endpoint resource.
+              ashare: Workspace user access record (account share) resource.
+              asynchelper: Async helper resource used for long-running operations.
+              connection: Connection resource for authenticating to external systems.
+              dataset: Dataset resource for data storage.
+              ediprofile: EDI profile resource for trading partner interchange configuration.
+              environment: Environment variable resource.
+              export: Export resource for reading data from a source system.
+              file: Celigo Storage file resource.
+              filedefinition: File definition resource for parsing structured files.
+              flow: Flow resource for data integration pipelines.
+              folder: Celigo Storage folder resource.
+              group: End-user group resource.
+              iclient: iClient shared credential resource.
+              idpconfig: End-user identity provider configuration resource.
+              import: Import resource for writing data to a destination system.
+              integration: Integration workspace resource.
+              lookupcache: Lookup cache resource for in-memory key-value stores.
+              mcpoauthprovider: MCP OAuth provider resource.
+              mcpserver: MCP server resource for AI agent tool hosting.
+              notification: Notification subscription resource.
+              revision: Revision snapshot resource for version control.
+              role: End-user role resource.
+              script: Script resource for custom JavaScript hooks.
+              ssoclient: SSO client configuration resource.
+              stack: Stack resource for on-premise or Lambda execution environments.
+              supportshare: Support share access grant resource.
+              sync: Sync resource.
+              tool: Tool resource for reusable building blocks.
+              user: User access record resource.
+          examples:
+            - - connection
+              - agent
+        source:
+          type: array
+          description: Match entries produced by any of these sources.
+          items:
+            type: string
+            enum:
+              - ui
+              - api
+              - system
+              - connector
+              - script
+              - stack
+              - sso
+              - cli
+              - mcp
+              - ora
+            x-enumDescriptions:
+              ui: Change made through the Celigo web UI.
+              api: Change made via the REST API.
+              system: Change made automatically by the platform.
+              connector: Change made by an Integration App (connector) process.
+              script: Change made by a custom script execution.
+              stack: Change made by extension code hosted on a stack.
+              sso: Change triggered by an SSO authentication event.
+              cli: Change made via the Celigo CLI.
+              mcp: Change made through the Celigo Platform MCP server.
+              ora: Change made by the Ora AI assistant.
+          examples:
+            - - api
+              - system
+        action:
+          type: array
+          description: Match entries recording any of these actions.
+          items:
+            type: string
+            enum:
+              - create
+              - update
+              - delete
+              - view
+              - restore
+              - purge
+              - signin
+              - signout
+              - purgelogs
+            x-enumDescriptions:
+              create: A resource was created.
+              update: A resource was modified.
+              delete: A resource was deleted (moved to recycle bin).
+              view: A resource was viewed or accessed.
+              restore: A resource was restored from the recycle bin.
+              purge: A resource was permanently purged from the recycle bin.
+              signin: A user signed in to the account.
+              signout: A user signed out of the account.
+              purgelogs: Execution logs were purged for a resource.
+          examples:
+            - - create
+              - update
+        resourceName:
+          type: array
+          description: |-
+            Restrict results to specific resources, each identified by its id and
+            type. Entries missing either key, or naming a type without audit
+            support, fail with 422.
+          items:
+            type: object
+            required:
+              - _resourceId
+              - resourceType
+            properties:
+              _resourceId:
+                type: string
+                format: objectId
+                description: Id of the resource to include.
+                examples:
+                  - 60a2c4e6f321d800129a1a3c
+              resourceType:
+                type: string
+                description: Singular resource type of `_resourceId`.
+                examples:
+                  - connection
+    SignedUrlResponse:
+      type: object
+      description: |-
+        Response containing a signed URL for downloading an audit CSV export.
+
+        Each CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,
+        pass the timestamp of the last row as the `to` query parameter on the
+        next request to fetch the next batch.
+      properties:
+        signedURL:
+          type: string
+          description: Signed URL to download the CSV. The link expires after 15 minutes.
+          examples:
+            - https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630a1b2c3d4e5f60/audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Credential=AKIAEXAMPLE123%2F20260613%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260613T120000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=4f9b2c1e8a3d7f0b5c6e9a2d4f8b1c3e7a0d5f2b9c4e6a8d1f3b7c0e5a9d2f4b
+        hasMore:
+          type: boolean
+          description: |-
+            `true` when the result set exceeded the per-file row limit (~20 000 rows)
+            and additional batches remain. To paginate, take the timestamp of the
+            last CSV row and pass it as the `to` query parameter on your next request.
+    AuditDownloadRequest:
+      type: object
+      description: Request body for `POST /v1/{resourceType}/audit/signedURL`.
+      properties:
+        _resourceIds:
+          type: array
+          description: List of resource ids to include in the audit export.
+          items:
+            type: string
+        from:
+          type: string
+          format: date-time
+          description: Start timestamp (ISO-8601).
+          examples:
+            - '2025-01-01T00:00:00.000Z'
+        to:
+          type: string
+          format: date-time
+          description: End timestamp (ISO-8601).
+          examples:
+            - '2025-12-31T23:59:59.999Z'
+        action:
+          type: string
+          enum:
+            - create
+            - update
+            - delete
+            - view
+            - restore
+            - purge
+            - signin
+            - signout
+            - purgelogs
+          x-enumDescriptions:
+            create: A resource was created.
+            update: A resource was modified.
+            delete: A resource was deleted (moved to recycle bin).
+            view: A resource was viewed or accessed.
+            restore: A resource was restored from the recycle bin.
+            purge: A resource was permanently purged from the recycle bin.
+            signin: A user signed in to the account.
+            signout: A user signed out of the account.
+            purgelogs: Execution logs were purged for a resource.
+          description: Event/action filter.
+        resourceType:
+          type: string
+          description: Resource type filter (singular form).
+          enum:
+            - accesstoken
+            - agent
+            - api
+            - ashare
+            - asynchelper
+            - connection
+            - dataset
+            - ediprofile
+            - environment
+            - export
+            - file
+            - filedefinition
+            - flow
+            - folder
+            - group
+            - iclient
+            - idpconfig
+            - import
+            - integration
+            - lookupcache
+            - mcpoauthprovider
+            - mcpserver
+            - notification
+            - revision
+            - role
+            - script
+            - ssoclient
+            - stack
+            - supportshare
+            - sync
+            - tool
+            - user
+          x-enumDescriptions:
+            accesstoken: API access token resource.
+            agent: On-premise agent resource.
+            api: Custom API endpoint resource.
+            ashare: Workspace user access record (account share) resource.
+            asynchelper: Async helper resource used for long-running operations.
+            connection: Connection resource for authenticating to external systems.
+            dataset: Dataset resource for data storage.
+            ediprofile: EDI profile resource for trading partner interchange configuration.
+            environment: Environment variable resource.
+            export: Export resource for reading data from a source system.
+            file: Celigo Storage file resource.
+            filedefinition: File definition resource for parsing structured files.
+            flow: Flow resource for data integration pipelines.
+            folder: Celigo Storage folder resource.
+            group: End-user group resource.
+            iclient: iClient shared credential resource.
+            idpconfig: End-user identity provider configuration resource.
+            import: Import resource for writing data to a destination system.
+            integration: Integration workspace resource.
+            lookupcache: Lookup cache resource for in-memory key-value stores.
+            mcpoauthprovider: MCP OAuth provider resource.
+            mcpserver: MCP server resource for AI agent tool hosting.
+            notification: Notification subscription resource.
+            revision: Revision snapshot resource for version control.
+            role: End-user role resource.
+            script: Script resource for custom JavaScript hooks.
+            ssoclient: SSO client configuration resource.
+            stack: Stack resource for on-premise or Lambda execution environments.
+            supportshare: Support share access grant resource.
+            sync: Sync resource.
+            tool: Tool resource for reusable building blocks.
+            user: User access record resource.
+        source:
+          type: string
+          enum:
+            - ui
+            - api
+            - system
+            - connector
+            - script
+            - sso
+            - cli
+            - mcp
+            - ora
+          x-enumDescriptions:
+            ui: Change made through the Celigo web UI.
+            api: Change made via the REST API.
+            system: Change made automatically by the platform.
+            connector: Change made by an Integration App (connector) process.
+            script: Change made by a custom script execution.
+            sso: Change triggered by an SSO authentication event.
+            cli: Change made via the Celigo CLI.
+            mcp: Change made through the Celigo Platform MCP server.
+            ora: Change made by the Ora AI assistant.
+          description: Source filter.
+        _byUserId:
+          type: string
+          x-celigo-refModel: users
+          description: Filter by actor user id (or `support`).
+          examples:
+            - 624cb0346309dc3a543733a2
+      required:
+        - _resourceIds
+      x-celigo-ai-guidance:
+        - |-
+          - Provide `_resourceIds` as a list of ids you want audit logs for.
+          - You can optionally include filters like time range and event/action.
+  responses:
+    400-bad-request:
+      description: |
+        Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            default:
+              value:
+                errors:
+                  - code: invalid_request
+                    message: The request body failed validation.
+    401-unauthorized:
+      description: |-
+        Unauthorized. The request lacks a valid bearer token, or the provided token
+        failed to authenticate.
+
+        Note: the 401 response is produced by the auth middleware **before** the
+        request reaches the endpoint handler, so it does **not** follow the
+        standard `{errors: [...]}` envelope. Instead the body is a bare
+        `{message: string}` object with no `code`, no `errors` array. Callers
+        handling 401s should key off the HTTP status and the `message` string,
+        not try to destructure an `errors[]`.
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+                description: |-
+                  Human-readable description of the auth failure. Known values:
+                  - `"Unauthorized"` — no `Authorization` header on the request.
+                  - `"Bearer Authentication Failed"` — header present but token
+                    is invalid, revoked, or expired.
+            required:
+              - message
+          examples:
+            missing_token:
+              summary: No Authorization header sent
+              value:
+                message: Unauthorized
+            invalid_token:
+              summary: Bearer token invalid or revoked
+              value:
+                message: Bearer Authentication Failed
+    422-unprocessable-entity:
+      description: |
+        Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            default:
+              value:
+                errors:
+                  - code: unprocessable_entity
+                    message: The request could not be processed due to a semantic error.
+    404-not-found:
+      description: |
+        Not found. The requested resource does not exist or is not visible to the caller.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            default:
+              value:
+                errors:
+                  - code: not_found
+                    message: The requested resource was not found.
+x-enable-proxy: true
+x-internal: false