@celigo/api-specs 0.2.146 → 0.2.148

package/dist/api.yml

@@ -5385,7 +5385,7 @@ components:
               x-celigo-ai-guidance:
                 - To change throughput while this is true, write `targetConcurrencyLevel`; a `concurrencyLevel` sent in a PUT returns 200 and changes nothing.
                 - Turning it on copies `concurrencyLevel` into `targetConcurrencyLevel`; turning it off unsets the target and leaves `concurrencyLevel` at its current value, which may be below the old target if a recovery was in progress. A `targetConcurrencyLevel` written while this is false is unset by the save.
-                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT must re-send the credentials — omitting them or echoing their masked `******` values clears them.
+                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT replaces the whole document, so send each secret back as its masked `******` value (that keeps it) or as a new value, and never drop one to keep it — an omitted password or `http.encrypted` is cleared, and a static token left out (with no `refreshMethod`) fails the PUT with 422.
             enableMicroBatchForOneToMany:
               type: boolean
               default: true
@@ -7036,7 +7036,9 @@ components:
                     - svc_account
                 password:
                   type: string
-                  description: Password for Basic/Digest/WSSE authentication (encrypted at rest).
+                  description: |-
+                    Password for Basic/Digest/WSSE authentication (encrypted at rest). On update, the
+                    masked `"******"` sent back keeps the stored password; a new value replaces it.
                   writeOnly: true
                   examples:
                     - s3cr3t-p4ssw0rd
@@ -7053,6 +7055,7 @@ components:
                   type: string
                   description: |
                     The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+                    On update, the mask sent back keeps the stored token; a new value replaces it.
                     Required unless automatic token refresh is configured.
                   examples:
                     - my-api-token-EXAMPLE
@@ -7515,7 +7518,8 @@ components:
             Encrypted custom fields for storing sensitive configuration values (API secrets,
             private keys, etc.) that don't fit standard auth fields. Sent as an object of
             field-name/value pairs; values are encrypted at rest. Returned as the masked
-            string `"******"` on responses. Field definitions are specified in encryptedFields.
+            string `"******"` on responses; on update, that mask sent back keeps the stored values,
+            and a new object replaces them. Field definitions are specified in encryptedFields.
           examples:
             - apiSecret: s3cr3t-value
               signingKey: another-s3cr3t
@@ -9257,6 +9261,7 @@ components:
           type: string
           description: |
             The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+            On update, the mask sent back keeps the stored token; a new value replaces it.
             Required unless automatic token refresh is configured.
           examples:
             - my-api-token-EXAMPLE

package/dist/connection.yml

@@ -830,8 +830,11 @@ paths:
       description: |
         Updates an existing connection configuration. This is a full-replace operation —
         send the complete connection document, not just the fields you want to change; a field
-        omitted from the body is cleared, including credentials (re-send them, or the masked
-        `"******"` value clears them too).
+        omitted from the body is cleared. A stored secret sent back as the masked `"******"` value a
+        GET returns keeps its stored value; send a new value to change it. Don't leave a secret out
+        to keep it: an omitted `http.auth.basic.password` or `http.encrypted` is cleared, and a
+        static-token connection (no `http.auth.token.refreshMethod`) sent without
+        `http.auth.token.token` is rejected with 422 `Expected field: refreshMethod to be present.`
 
         Three settings are the exception and survive an omission: `endUserProvidedFields`
         (send `null` to clear it — `[]` is treated like an omission), and on `ftp` connections
@@ -985,9 +988,11 @@ paths:
       x-celigo-ai-guidance:
         - |-
           PUT replaces the document: GET it first, change what you need, and send the whole body
-          back with the real credential values (masked "******" values clear the stored secret).
-          To change only name, debug window, or concurrency settings without touching credentials,
-          use PATCH instead.
+          back. Leave each secret's masked "******" value exactly as the GET returned it (that keeps
+          the stored secret) or put a new value in its place. Never drop a secret field to keep it:
+          an omitted password or `http.encrypted` is cleared, and a static token left out (with no
+          `refreshMethod`) fails the PUT with 422. To change only name, debug window, or concurrency
+          settings without touching credentials, use PATCH instead.
     patch:
       x-internal: false
       summary: Patch a connection
@@ -4240,7 +4245,7 @@ components:
               x-celigo-ai-guidance:
                 - To change throughput while this is true, write `targetConcurrencyLevel`; a `concurrencyLevel` sent in a PUT returns 200 and changes nothing.
                 - Turning it on copies `concurrencyLevel` into `targetConcurrencyLevel`; turning it off unsets the target and leaves `concurrencyLevel` at its current value, which may be below the old target if a recovery was in progress. A `targetConcurrencyLevel` written while this is false is unset by the save.
-                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT must re-send the credentials — omitting them or echoing their masked `******` values clears them.
+                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT replaces the whole document, so send each secret back as its masked `******` value (that keeps it) or as a new value, and never drop one to keep it — an omitted password or `http.encrypted` is cleared, and a static token left out (with no `refreshMethod`) fails the PUT with 422.
             enableMicroBatchForOneToMany:
               type: boolean
               default: true
@@ -5891,7 +5896,9 @@ components:
                     - svc_account
                 password:
                   type: string
-                  description: Password for Basic/Digest/WSSE authentication (encrypted at rest).
+                  description: |-
+                    Password for Basic/Digest/WSSE authentication (encrypted at rest). On update, the
+                    masked `"******"` sent back keeps the stored password; a new value replaces it.
                   writeOnly: true
                   examples:
                     - s3cr3t-p4ssw0rd
@@ -5908,6 +5915,7 @@ components:
                   type: string
                   description: |
                     The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+                    On update, the mask sent back keeps the stored token; a new value replaces it.
                     Required unless automatic token refresh is configured.
                   examples:
                     - my-api-token-EXAMPLE
@@ -6370,7 +6378,8 @@ components:
             Encrypted custom fields for storing sensitive configuration values (API secrets,
             private keys, etc.) that don't fit standard auth fields. Sent as an object of
             field-name/value pairs; values are encrypted at rest. Returned as the masked
-            string `"******"` on responses. Field definitions are specified in encryptedFields.
+            string `"******"` on responses; on update, that mask sent back keeps the stored values,
+            and a new object replaces them. Field definitions are specified in encryptedFields.
           examples:
             - apiSecret: s3cr3t-value
               signingKey: another-s3cr3t
@@ -8112,6 +8121,7 @@ components:
           type: string
           description: |
             The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+            On update, the mask sent back keeps the stored token; a new value replaces it.
             Required unless automatic token refresh is configured.
           examples:
             - my-api-token-EXAMPLE

package/dist/enduser.yml

@@ -2357,7 +2357,7 @@ components:
               x-celigo-ai-guidance:
                 - To change throughput while this is true, write `targetConcurrencyLevel`; a `concurrencyLevel` sent in a PUT returns 200 and changes nothing.
                 - Turning it on copies `concurrencyLevel` into `targetConcurrencyLevel`; turning it off unsets the target and leaves `concurrencyLevel` at its current value, which may be below the old target if a recovery was in progress. A `targetConcurrencyLevel` written while this is false is unset by the save.
-                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT must re-send the credentials — omitting them or echoing their masked `******` values clears them.
+                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT replaces the whole document, so send each secret back as its masked `******` value (that keeps it) or as a new value, and never drop one to keep it — an omitted password or `http.encrypted` is cleared, and a static token left out (with no `refreshMethod`) fails the PUT with 422.
             enableMicroBatchForOneToMany:
               type: boolean
               default: true
@@ -4008,7 +4008,9 @@ components:
                     - svc_account
                 password:
                   type: string
-                  description: Password for Basic/Digest/WSSE authentication (encrypted at rest).
+                  description: |-
+                    Password for Basic/Digest/WSSE authentication (encrypted at rest). On update, the
+                    masked `"******"` sent back keeps the stored password; a new value replaces it.
                   writeOnly: true
                   examples:
                     - s3cr3t-p4ssw0rd
@@ -4025,6 +4027,7 @@ components:
                   type: string
                   description: |
                     The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+                    On update, the mask sent back keeps the stored token; a new value replaces it.
                     Required unless automatic token refresh is configured.
                   examples:
                     - my-api-token-EXAMPLE
@@ -4487,7 +4490,8 @@ components:
             Encrypted custom fields for storing sensitive configuration values (API secrets,
             private keys, etc.) that don't fit standard auth fields. Sent as an object of
             field-name/value pairs; values are encrypted at rest. Returned as the masked
-            string `"******"` on responses. Field definitions are specified in encryptedFields.
+            string `"******"` on responses; on update, that mask sent back keeps the stored values,
+            and a new object replaces them. Field definitions are specified in encryptedFields.
           examples:
             - apiSecret: s3cr3t-value
               signingKey: another-s3cr3t
@@ -6229,6 +6233,7 @@ components:
           type: string
           description: |
             The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+            On update, the mask sent back keeps the stored token; a new value replaces it.
             Required unless automatic token refresh is configured.
           examples:
             - my-api-token-EXAMPLE

package/dist/export.yml

@@ -984,10 +984,13 @@ components:
       description: |-
         Configures incremental exports that retrieve only records created or modified since the last
         successful run. Required when the export's type is "delta"; omit for other export types.
-        When no cutoff is supplied, the platform-managed last-successful-run timestamp (exposed as
-        {{lastExportDateTime}}) is the lower bound — the first run behaves like a full export, and
-        after a failed run the next run reuses the last successful timestamp so changed records are
-        not missed.
+        The platform-managed last-successful-run timestamp (exposed as {{lastExportDateTime}}) is the
+        lower bound, and after a failed run the next run reuses the last successful timestamp so
+        changed records are not missed. A first run is not a full export: with no `startDate`, its
+        {{lastExportDateTime}} is the run's own timestamp (the value {{currentExportDateTime}} also
+        holds), so it picks up no earlier changes. Set `startDate` to reach back further. On success,
+        when `POST /v1/flows/{_id}/run` sends `export.endDate`, the flow's checkpoint is left at that
+        value, so an end date in the past moves the next run's lower bound back.
       x-celigo-ai-guidance:
         - |-
           This object is REQUIRED when the export's type field is set to "delta" and
@@ -1023,7 +1026,7 @@ components:
 
           2. The system automatically maintains the last successful run timestamp
               - No need to store or manage timestamps in your own code
-              - First run fetches all records (equivalent to a standard export)
+              - A first run without ``startDate`` fetches nothing older than the run itself
               - Subsequent runs use this timestamp as the starting point
 
           3. Error handling and recovery:
@@ -1245,9 +1248,9 @@ components:
             - 'null'
           format: date-time
           description: |-
-            Explicit lower-bound cutoff for the first run, overriding the default of starting from the
-            beginning of time. Subsequent runs use the platform-managed last-successful-run timestamp.
-            Set it to backfill from a specific point rather than exporting all history.
+            Lower-bound cutoff for the first run. Omitting it doesn't export history: the first run
+            then starts at its own timestamp. Set it to the earliest change the first run should pick
+            up. Subsequent runs use the platform-managed last-successful-run timestamp.
           x-celigo-ai-guidance:
             - |-
               Initial cutoff timestamp for the first export run, in ISO-8601 UTC format (e.g.
@@ -6001,7 +6004,9 @@ components:
           description: |-
             Topic this listener subscribes to. Create or look it up with `GET /v1/topics`; the
             topic must belong to the same account. Pointing an existing listener at a different
-            topic starts a new subscription, read from `startPosition`.
+            topic starts a new subscription, read from `startPosition`. A clone made in the same
+            environment — of this export, or of a flow that contains it — keeps `_topicId`, so the
+            copy becomes another listener on the topic once its flow is enabled.
           x-celigo-ai-guidance:
             - |-
               An id that is not a topic in the account fails the save with 422 `invalid_ref`
@@ -16517,7 +16522,10 @@ components:
             - 'null'
           format: objectId
           x-celigo-refModel: integrations
-          description: Integration this export belongs to.
+          description: |-
+            Not stored on an export: a value sent on create or on a full update is dropped, and a GET
+            doesn't return the field. An export isn't owned by an integration; to find the flows and
+            other resources that use it, call `GET /v1/exports/{_id}/dependencies`.
         _connectorId:
           type: string
           format: objectId

package/dist/filestorage.yml

@@ -2047,12 +2047,12 @@ paths:
       x-internal: false
       summary: Get audit log for a file
       description: |-
-        Returns the change history for a file — creation (recorded once the
-        upload finalizes), renames and description edits, moves, content
-        replacements, downloads, deletes, restores, and purges — newest first.
-        Each entry records who made the change, when, and which fields were
-        affected. History survives purging, so a purged file's entries stay
-        readable. Folders have their own route, `GET /v1/folders/{_id}/audit`.
+        Returns the audit entries recorded for a file, newest first, or 204 with
+        no body when it has none. File operations are no longer written to this
+        audit log, so only entries recorded before that change are returned, and
+        a file created since has none. Each entry records who made the change,
+        when, and which fields were affected. Entries survive purging. Folders
+        have their own route, `GET /v1/folders/{_id}/audit`.
       tags:
         - File Storage
       operationId: getStorageFileAudit
@@ -2166,11 +2166,12 @@ paths:
       x-internal: false
       summary: Get audit log for a folder
       description: |-
-        Returns the change history for a folder — creation, renames and
-        description edits, moves, deletes, restores, and purges — newest first.
-        Each entry records who made the change, when, and which fields were
-        affected. History survives purging, so a purged folder's entries stay
-        readable. Files have their own route, `GET /v1/files/{_id}/audit`.
+        Returns the audit entries recorded for a folder, newest first, or 204
+        with no body when it has none. Folder operations are no longer written
+        to this audit log, so only entries recorded before that change are
+        returned, and a folder created since has none. Each entry records who
+        made the change, when, and which fields were affected. Entries survive
+        purging. Files have their own route, `GET /v1/files/{_id}/audit`.
       tags:
         - File Storage
       operationId: getStorageFolderAudit

package/dist/flow.yml

@@ -824,8 +824,9 @@ paths:
 
         The request body is optional. When omitted, the flow runs with its configured schedule behavior —
         for delta flows this means using the current `lastExportDateTime` as the lower bound. Pass
-        `export.startDate` / `export.endDate` to override the delta window for this run only (the flow's
-        checkpoint still advances on success). Pass `_exportIds` to limit execution to a subset of the flow's
+        `export.startDate` / `export.endDate` to set this run's delta window. On success, when
+        `export.endDate` is sent, the flow's checkpoint is left at that value, so an end date in the past
+        moves the next run's lower bound back. Pass `_exportIds` to limit execution to a subset of the flow's
         generators (useful for flows with many independent sources).
 
         Flow-level preconditions enforced by the platform:
@@ -835,8 +836,9 @@ paths:
 
         To trace a run end-to-end, arm debug logging before calling this, then use the returned
         `_jobId` with the execution-log endpoints. For delta backfills, prefer passing explicit
-        `startDate`/`endDate` over editing the export's `lastExportDateTime` — the override is
-        scoped to one run. A flow runs one instance at a time: a run requested while another
+        `startDate`/`endDate` over editing the export's `lastExportDateTime`, and read the checkpoint
+        first (`GET /v1/flows/{_id}/lastExportDateTime`): the override doesn't stay with one run, since
+        a successful run that sends `endDate` leaves the checkpoint there. A flow runs one instance at a time: a run requested while another
         instance is queued or running is refused with `409 job_already_queued` ("Another instance
         for this flow is already queued or running"), and a run-next-flow trigger that arrives in
         that state is dropped rather than queued.
@@ -1080,11 +1082,14 @@ paths:
         generators (exports) in the flow. This value is what gets substituted into the `{{lastExportDateTime}}`
         Handlebars variable on the next delta run of any export in the flow.
 
-        The checkpoint advances automatically at the end of a successful delta run. It can be overridden per
-        run by passing `export.startDate` / `export.endDate` to `POST /v1/flows/{_id}/run`.
+        The checkpoint advances automatically at the end of a successful delta run. On success, when
+        `POST /v1/flows/{_id}/run` sends `export.endDate`, the checkpoint is left at that value, so an end
+        date in the past moves the next run's lower bound back.
 
-        A missing or very old value means the next delta run will re-scan the full history window from
-        the source. This is the flow-scoped checkpoint; per-export checkpoints (for flows with multiple
+        A missing value (`null`, a flow that has never run) is not a full re-scan: the next delta run's
+        `{{lastExportDateTime}}` is the export's `delta.startDate` when set, and otherwise the run's own
+        timestamp, which picks up no earlier changes. A very old value re-reads everything changed since
+        then. This is the flow-scoped checkpoint; per-export checkpoints (for flows with multiple
         generators that advance independently) are exposed on the export record's `delta` block.
       parameters:
         - name: _id

package/dist/iclient.yml

@@ -324,9 +324,8 @@ paths:
         account: every update must include the full JSON key. An Azure
         service principal keeps its stored `clientSecret` or `certificate`
         when the field is omitted — only a new value replaces it, and
-        `certificate` is never returned. Connections work the other way:
-        re-sending the mask on `PUT /v1/connections/{_id}` clears the stored
-        credential.
+        `certificate` is never returned. A connection keeps a secret re-sent
+        as the mask the same way (`PUT /v1/connections/{_id}`).
       operationId: updateIClient
       tags:
         - iClients

package/dist/import.yml

@@ -8507,7 +8507,8 @@ components:
           x-celigo-ui-override: 'Required by the Event Streams publisher form (fieldDefinitions/resources/imports/import.js: ''topic._topicId'' is required:true, validWhen isNot ''''). The API saves a TopicImport without it, so the requirement is encoded on the request schema to mirror the form and keep publishers bound to a topic.'
           description: |-
             Topic the records are published to. Create or look it up with `GET /v1/topics`; the
-            topic must belong to the same account.
+            topic must belong to the same account. A clone of the import made in the same
+            environment keeps `_topicId`.
           x-celigo-ai-guidance:
             - |-
               An id that is not a topic in the account fails the save with 422 `invalid_ref`
@@ -15842,9 +15843,10 @@ components:
             - 'null'
           format: objectId
           x-celigo-refModel: integrations
-          description: Integration this import belongs to.
-          examples:
-            - 60a2c4e6f321d800129a1a3c
+          description: |-
+            Not stored on an import: a value sent on create or on a full update is dropped, and a GET
+            doesn't return the field. An import isn't owned by an integration; to find the flows and
+            other resources that use it, call `GET /v1/imports/{_id}/dependencies`.
         _connectorId:
           type: string
           format: objectId

package/dist/integration.yml

@@ -4450,8 +4450,8 @@ components:
                 Maintained by the platform: added through the integration's topic `register` operations,
                 `POST /v1/topics` with `__integrationIds`, or automatically when a flow in the integration
                 is saved with a step bound to a topic; removed by the `DELETE …/register` operation or when
-                the topic is deleted. Client-sent values are ignored (PUT-verified). Absent on integrations
-                that have never had a topic registered.
+                the topic is deleted. Client-sent values are ignored (PUT-verified). With no topic
+                registered it is an empty array, or absent on older integrations.
               items:
                 type: string
                 format: objectId

package/dist/mcp-server.yml

@@ -4188,7 +4188,7 @@ components:
               x-celigo-ai-guidance:
                 - To change throughput while this is true, write `targetConcurrencyLevel`; a `concurrencyLevel` sent in a PUT returns 200 and changes nothing.
                 - Turning it on copies `concurrencyLevel` into `targetConcurrencyLevel`; turning it off unsets the target and leaves `concurrencyLevel` at its current value, which may be below the old target if a recovery was in progress. A `targetConcurrencyLevel` written while this is false is unset by the save.
-                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT must re-send the credentials — omitting them or echoing their masked `******` values clears them.
+                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT replaces the whole document, so send each secret back as its masked `******` value (that keeps it) or as a new value, and never drop one to keep it — an omitted password or `http.encrypted` is cleared, and a static token left out (with no `refreshMethod`) fails the PUT with 422.
             enableMicroBatchForOneToMany:
               type: boolean
               default: true
@@ -5839,7 +5839,9 @@ components:
                     - svc_account
                 password:
                   type: string
-                  description: Password for Basic/Digest/WSSE authentication (encrypted at rest).
+                  description: |-
+                    Password for Basic/Digest/WSSE authentication (encrypted at rest). On update, the
+                    masked `"******"` sent back keeps the stored password; a new value replaces it.
                   writeOnly: true
                   examples:
                     - s3cr3t-p4ssw0rd
@@ -5856,6 +5858,7 @@ components:
                   type: string
                   description: |
                     The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+                    On update, the mask sent back keeps the stored token; a new value replaces it.
                     Required unless automatic token refresh is configured.
                   examples:
                     - my-api-token-EXAMPLE
@@ -6318,7 +6321,8 @@ components:
             Encrypted custom fields for storing sensitive configuration values (API secrets,
             private keys, etc.) that don't fit standard auth fields. Sent as an object of
             field-name/value pairs; values are encrypted at rest. Returned as the masked
-            string `"******"` on responses. Field definitions are specified in encryptedFields.
+            string `"******"` on responses; on update, that mask sent back keeps the stored values,
+            and a new object replaces them. Field definitions are specified in encryptedFields.
           examples:
             - apiSecret: s3cr3t-value
               signingKey: another-s3cr3t
@@ -8060,6 +8064,7 @@ components:
           type: string
           description: |
             The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+            On update, the mask sent back keeps the stored token; a new value replaces it.
             Required unless automatic token refresh is configured.
           examples:
             - my-api-token-EXAMPLE

package/dist/tool.yml

@@ -7568,7 +7568,7 @@ components:
               x-celigo-ai-guidance:
                 - To change throughput while this is true, write `targetConcurrencyLevel`; a `concurrencyLevel` sent in a PUT returns 200 and changes nothing.
                 - Turning it on copies `concurrencyLevel` into `targetConcurrencyLevel`; turning it off unsets the target and leaves `concurrencyLevel` at its current value, which may be below the old target if a recovery was in progress. A `targetConcurrencyLevel` written while this is false is unset by the save.
-                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT must re-send the credentials — omitting them or echoing their masked `******` values clears them.
+                - These four settings (`concurrencyLevel`, `targetConcurrencyLevel`, `_borrowConcurrencyFromConnectionId`, this flag) accept a credential-free `PATCH /v1/connections/{_id}`. A PUT replaces the whole document, so send each secret back as its masked `******` value (that keeps it) or as a new value, and never drop one to keep it — an omitted password or `http.encrypted` is cleared, and a static token left out (with no `refreshMethod`) fails the PUT with 422.
             enableMicroBatchForOneToMany:
               type: boolean
               default: true
@@ -9219,7 +9219,9 @@ components:
                     - svc_account
                 password:
                   type: string
-                  description: Password for Basic/Digest/WSSE authentication (encrypted at rest).
+                  description: |-
+                    Password for Basic/Digest/WSSE authentication (encrypted at rest). On update, the
+                    masked `"******"` sent back keeps the stored password; a new value replaces it.
                   writeOnly: true
                   examples:
                     - s3cr3t-p4ssw0rd
@@ -9236,6 +9238,7 @@ components:
                   type: string
                   description: |
                     The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+                    On update, the mask sent back keeps the stored token; a new value replaces it.
                     Required unless automatic token refresh is configured.
                   examples:
                     - my-api-token-EXAMPLE
@@ -9698,7 +9701,8 @@ components:
             Encrypted custom fields for storing sensitive configuration values (API secrets,
             private keys, etc.) that don't fit standard auth fields. Sent as an object of
             field-name/value pairs; values are encrypted at rest. Returned as the masked
-            string `"******"` on responses. Field definitions are specified in encryptedFields.
+            string `"******"` on responses; on update, that mask sent back keeps the stored values,
+            and a new object replaces them. Field definitions are specified in encryptedFields.
           examples:
             - apiSecret: s3cr3t-value
               signingKey: another-s3cr3t
@@ -11440,6 +11444,7 @@ components:
           type: string
           description: |
             The API key or bearer token value (encrypted at rest); returned masked as `"******"`.
+            On update, the mask sent back keeps the stored token; a new value replaces it.
             Required unless automatic token refresh is configured.
           examples:
             - my-api-token-EXAMPLE
@@ -19890,7 +19895,8 @@ components:
           x-celigo-ui-override: 'Required by the Event Streams publisher form (fieldDefinitions/resources/imports/import.js: ''topic._topicId'' is required:true, validWhen isNot ''''). The API saves a TopicImport without it, so the requirement is encoded on the request schema to mirror the form and keep publishers bound to a topic.'
           description: |-
             Topic the records are published to. Create or look it up with `GET /v1/topics`; the
-            topic must belong to the same account.
+            topic must belong to the same account. A clone of the import made in the same
+            environment keeps `_topicId`.
           x-celigo-ai-guidance:
             - |-
               An id that is not a topic in the account fails the save with 422 `invalid_ref`
@@ -24718,9 +24724,10 @@ components:
             - 'null'
           format: objectId
           x-celigo-refModel: integrations
-          description: Integration this import belongs to.
-          examples:
-            - 60a2c4e6f321d800129a1a3c
+          description: |-
+            Not stored on an import: a value sent on create or on a full update is dropped, and a GET
+            doesn't return the field. An import isn't owned by an integration; to find the flows and
+            other resources that use it, call `GET /v1/imports/{_id}/dependencies`.
         _connectorId:
           type: string
           format: objectId
@@ -25826,10 +25833,13 @@ components:
       description: |-
         Configures incremental exports that retrieve only records created or modified since the last
         successful run. Required when the export's type is "delta"; omit for other export types.
-        When no cutoff is supplied, the platform-managed last-successful-run timestamp (exposed as
-        {{lastExportDateTime}}) is the lower bound — the first run behaves like a full export, and
-        after a failed run the next run reuses the last successful timestamp so changed records are
-        not missed.
+        The platform-managed last-successful-run timestamp (exposed as {{lastExportDateTime}}) is the
+        lower bound, and after a failed run the next run reuses the last successful timestamp so
+        changed records are not missed. A first run is not a full export: with no `startDate`, its
+        {{lastExportDateTime}} is the run's own timestamp (the value {{currentExportDateTime}} also
+        holds), so it picks up no earlier changes. Set `startDate` to reach back further. On success,
+        when `POST /v1/flows/{_id}/run` sends `export.endDate`, the flow's checkpoint is left at that
+        value, so an end date in the past moves the next run's lower bound back.
       x-celigo-ai-guidance:
         - |-
           This object is REQUIRED when the export's type field is set to "delta" and
@@ -25865,7 +25875,7 @@ components:
 
           2. The system automatically maintains the last successful run timestamp
               - No need to store or manage timestamps in your own code
-              - First run fetches all records (equivalent to a standard export)
+              - A first run without ``startDate`` fetches nothing older than the run itself
               - Subsequent runs use this timestamp as the starting point
 
           3. Error handling and recovery:
@@ -26087,9 +26097,9 @@ components:
             - 'null'
           format: date-time
           description: |-
-            Explicit lower-bound cutoff for the first run, overriding the default of starting from the
-            beginning of time. Subsequent runs use the platform-managed last-successful-run timestamp.
-            Set it to backfill from a specific point rather than exporting all history.
+            Lower-bound cutoff for the first run. Omitting it doesn't export history: the first run
+            then starts at its own timestamp. Set it to the earliest change the first run should pick
+            up. Subsequent runs use the platform-managed last-successful-run timestamp.
           x-celigo-ai-guidance:
             - |-
               Initial cutoff timestamp for the first export run, in ISO-8601 UTC format (e.g.
@@ -30403,7 +30413,9 @@ components:
           description: |-
             Topic this listener subscribes to. Create or look it up with `GET /v1/topics`; the
             topic must belong to the same account. Pointing an existing listener at a different
-            topic starts a new subscription, read from `startPosition`.
+            topic starts a new subscription, read from `startPosition`. A clone made in the same
+            environment — of this export, or of a flow that contains it — keeps `_topicId`, so the
+            copy becomes another listener on the topic once its flow is enabled.
           x-celigo-ai-guidance:
             - |-
               An id that is not a topic in the account fails the save with 422 `invalid_ref`
@@ -37517,7 +37529,10 @@ components:
             - 'null'
           format: objectId
           x-celigo-refModel: integrations
-          description: Integration this export belongs to.
+          description: |-
+            Not stored on an export: a value sent on create or on a full update is dropped, and a GET
+            doesn't return the field. An export isn't owned by an integration; to find the flows and
+            other resources that use it, call `GET /v1/exports/{_id}/dependencies`.
         _connectorId:
           type: string
           format: objectId

package/dist/topic.yml

@@ -616,9 +616,11 @@ paths:
       summary: Purge retained messages
       description: |-
         Removes every retained message from the topic while keeping the topic, its retention setting,
-        and its subscriptions; the purge cannot be undone. Records an audit entry with `event: purge`
-        and `fieldChanges[0].fieldPath: messages`. To remove the topic itself, use
-        `DELETE /v1/topics/{_id}`.
+        and its subscriptions; the purge cannot be undone. Positions keep counting: the next message
+        published takes the next offset, subscribed listeners receive it as before, and a listener
+        whose saved position was purged resumes from the earliest message still retained. Records an
+        audit entry with `event: purge` and `fieldChanges[0].fieldPath: messages`. To remove the topic
+        itself, use `DELETE /v1/topics/{_id}`.
       operationId: purgeTopicMessages
       tags:
         - Topics
@@ -977,15 +979,19 @@ paths:
                         purge: Retained messages were purged, or the topic was permanently removed from the recycle bin.
                     source:
                       type: string
-                      description: How the change was initiated. Restores from the recycle bin are recorded as `system`.
+                      description: |-
+                        How the change was initiated. A change made through the Celigo CLI is recorded as
+                        `cli` — deletes, restores from the recycle bin, and message purges included.
                       enum:
                         - api
                         - ui
                         - system
+                        - cli
                       x-enumDescriptions:
                         api: Change made via the REST API.
                         ui: Change made through the Celigo UI.
                         system: Change made by an automated platform process.
+                        cli: Change made through the Celigo CLI.
                     time:
                       type: string
                       format: date-time
@@ -1651,13 +1657,16 @@ components:
         hasCursor:
           type: boolean
           description: |-
-            When true, the export has committed a read position on this topic and its next run resumes
-            from `offset`. False when the export has never consumed the topic, when its last committed
-            position has expired from the stream, or when it does not listen to this topic at all — a
-            listener without a cursor starts from its own `topic.startPosition` (`latest` or `earliest`).
-            A listener whose flow is disabled keeps its position; a listener saved without
-            `type: "stream"`, or whose flow has not been enabled since the listener was saved, has
-            never subscribed and reports false.
+            When true, the listener is subscribed to this topic and its next run resumes from `offset`.
+            The position appears when the listener's flow goes from disabled to enabled, before anything
+            is read: at the end of the stream under `topic.startPosition: latest`, at the first retained
+            message under `earliest`. False when the listener has never subscribed — it was saved
+            without `type: "stream"`, its flow has not gone from disabled to enabled since it was saved
+            (a flow created enabled never subscribes), or it does not listen to this topic. A listener
+            whose flow is disabled keeps its position. When the message at that position is no longer
+            retained — it expired past `retentionMs` or was purged — the listener still reports true
+            with the old `offset`, and its next run resumes from the earliest message still retained,
+            whatever its `startPosition`.
           examples:
             - true
             - false
@@ -1666,8 +1675,9 @@ components:
           minimum: -1
           description: |-
             Zero-based position of the next message the export will read. `-1` when `hasCursor` is
-            false. The position counts from the start of the stream, so while no message has expired
-            the retained message count minus `offset` is the listener's backlog.
+            false. The position counts from the start of the stream and keeps counting after a purge,
+            so while no message has expired or been purged the retained message count minus `offset`
+            is the listener's backlog.
           examples:
             - 1287
             - -1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.146",
+  "version": "0.2.148",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "debaf90f",
+		"iasCommit": "c5f16e90",
 		"generatedAt": "2026-10-21"
 	},
 	"roots": {