@celigo/api-specs 0.2.165 → 0.2.167

package/dist/user.yml

@@ -30,7 +30,8 @@ tags:
 
       The account owner is not included — only invited users appear, plus any
       the identity provider provisioned through SCIM (`provisionedBy: scim`).
-      Users can be disabled (reversible) or permanently removed.
+      Users can be disabled (reversible) or permanently removed. The license
+      sets no user or seat limit.
 
       ## User schema
 
@@ -223,14 +224,20 @@ paths:
       description: |-
         Replaces a workspace user's access settings. The body must grant access
         through `accessLevel` or a non-empty `integrationAccessLevel`, and
-        `integrationAccessLevel` and `accountMFARequired` are cleared when
-        omitted — send every value to keep. `accountSSORequired` is the
-        exception: it changes only when the body carries it, and is ignored
-        while the account enforces SSO for every user. `disabled` is not
-        applied here; toggle it with `PUT /v1/ashares/{_userId}/disable`.
-        Read-only fields echoed from the GET response are ignored, except
-        `userType`, which is rejected. The user's email cannot be changed after
-        invite. Callable from the production environment only.
+        `accessLevel`, `integrationAccessLevel` and `accountMFARequired` are
+        cleared when omitted — send every value to keep. The other settings
+        change only when the body carries them and keep their stored values
+        when omitted: `accountSSORequired` (also ignored while the account
+        enforces SSO for every user), `allowToEditRetryData`,
+        `allowIntegrationWorkspaceCreation` (both applied only to monitor and
+        integration-level users, and only when the owner or an administrator
+        sends them), `mcpServerAccessLevel` (send `[]` to clear it) and
+        `allMcpServerAccess`. `allowAccessToAPIM` isn't changed here at all.
+        `disabled` is not applied here; toggle it with
+        `PUT /v1/ashares/{_userId}/disable`. Read-only fields echoed from the
+        GET response are ignored, except `userType`, which is rejected. The
+        user's email cannot be changed after invite. A production
+        administrator's record can be changed only from production.
 
         End-user access records share this route with a different body — see
         the End Users API.
@@ -297,17 +304,7 @@ paths:
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
-          description: The call was made from a sandbox environment.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                sandboxEnvironment:
-                  value:
-                    errors:
-                      - code: access_restricted
-                        message: This request can only be made through the production environment.
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
@@ -346,6 +343,8 @@ paths:
           description: User removed from the account.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
   /v1/ashares/{_userId}/disable:
@@ -358,9 +357,14 @@ paths:
       description: |-
         Toggles the `disabled` flag on a user's access record. Call again to
         re-enable — there is no separate `/enable` path, and this is the only
-        way to change `disabled` (the update operation does not apply it). A
-        pending invitation cannot be toggled until the invited user accepts or
-        declines it.
+        way to change `disabled` (the update operation does not apply it). Only
+        an accepted workspace invitation toggles: a pending one is refused with
+        400, and a declined one (`dismissed: true`) answers 204 without changing
+        anything — delete it, or re-send it with
+        `PUT /v1/ashares/{_id}/reinvite`. The
+        user is emailed on every toggle. Disabling a production administrator
+        also disables their records in the other environments, and only
+        production can toggle one.
 
         End-user access records share this route — see the End Users API.
       parameters:
@@ -386,7 +390,7 @@ paths:
                 value: {}
       responses:
         '204':
-          description: User access toggled.
+          description: User access toggled, or the invitation was declined and nothing changed.
         '400':
           description: The invitation is still pending.
           content:
@@ -401,6 +405,8 @@ paths:
                         message: You can't disable this invitation without it being accepted or dismissed by the invited user.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           description: User not found.
           content:
@@ -421,6 +427,11 @@ paths:
         Re-sends the invitation to a user who previously dismissed it. Only
         works on users with `dismissed: true` in the user record. After
         reinviting, the user returns to a pending state awaiting acceptance.
+
+        There is no re-send for an invitation that is still pending: this
+        route refuses it, and inviting the address again answers
+        `invalid_invite`. Delete the pending record and invite the address
+        again with the same access settings.
       operationId: reinviteUser
       tags:
         - Users
@@ -458,9 +469,11 @@ paths:
                   value:
                     errors:
                       - code: invalid_request
-                        message: User has not dismissed the invite.
+                        message: You can reinvite a user only if he/she has dismissed you previous invite.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
   /v1/ashares/{_id}/accept:
@@ -559,6 +572,16 @@ paths:
         Invite one or more users by email. Each entry in the response array
         corresponds to the email at the same index — check `statusCode` per
         entry for partial failures.
+
+        An address that already has an access record in this environment —
+        accepted, still pending, or declined — fails in its entry with 400
+        `invalid_invite`: nothing changes and no email is sent. Change an
+        existing user with `PUT /v1/ashares/{_id}`, and re-send a declined
+        invitation with `PUT /v1/ashares/{_id}/reinvite`. A pending
+        invitation has no re-send: delete it and invite the address again.
+
+        Each call takes at most five addresses; the account itself has no user
+        limit.
       operationId: inviteUsers
       tags:
         - Users
@@ -598,11 +621,27 @@ paths:
                     statusCode:
                       type: integer
                       description: |-
-                        Per-entry result code. `201` on success, `400` if
-                        the user already has access (use `PUT /v1/ashares/{_id}`
-                        to update permissions instead).
+                        Per-entry result code. `201` on success; `400`
+                        (`invalid_invite`) if the address already has an access
+                        record in this environment. For an accepted user, change
+                        access with `PUT /v1/ashares/{_id}`; re-send a declined
+                        invitation with `PUT /v1/ashares/{_id}/reinvite`; a
+                        pending invitation can't be re-sent (delete it and invite
+                        again).
                     doc:
                       $ref: '#/components/schemas/User'
+                    errors:
+                      type: array
+                      description: Why this address failed. Present instead of `doc` when `statusCode` isn't `201`.
+                      items:
+                        type: object
+                        properties:
+                          code:
+                            type: string
+                            description: Machine-readable error code, such as `invalid_invite`.
+                          message:
+                            type: string
+                            description: Human-readable description of the error.
               examples:
                 default:
                   value:
@@ -630,10 +669,49 @@ paths:
                         sharedWithUser:
                           _id: 6a02b1859a09438890230aab
                           email: user2@example.com
+                alreadyInvited:
+                  summary: The second address already has a (pending) access record
+                  value:
+                    - statusCode: 201
+                      doc:
+                        _id: 6a02b1869a09438890230ae2
+                        accessLevel: monitor
+                        integrationAccessLevel: []
+                        lastModified: '2026-05-12T04:50:14.342Z'
+                        createdAt: '2026-05-12T04:50:14.330Z'
+                        createdVia: existing_account_invite
+                        sharedWithUser:
+                          _id: 6a02b1859a09438890230a9f
+                          email: user1@example.com
+                    - statusCode: 400
+                      errors:
+                        - code: invalid_invite
+                          message: The user already has access to this environment. Please use the edit permissions option to update the permissions for the user.
         '400':
           $ref: '#/components/responses/400-bad-request'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          description: |-
+            `emails` is empty, holds more than five addresses, or repeats one; nothing is
+            invited. Also returned when the caller may not invite users.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                tooMany:
+                  summary: More than five addresses
+                  value:
+                    errors:
+                      - code: limit_exceeded
+                        message: Number of invites in the request exceeds maximum allowed limit 5.
+                duplicate:
+                  summary: An address listed twice
+                  value:
+                    errors:
+                      - code: duplicate_emails
+                        message: Duplicate emails found in the request.
 components:
   securitySchemes:
     bearerAuth:
@@ -659,9 +737,11 @@ components:
 
             If per-integration level permissions are needed, omit `accessLevel` and instead populate `integrationAccessLevel`.
 
-            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `integrationAccessLevel`
-            and `accountMFARequired` are cleared when omitted, so resend them to keep them. `accountSSORequired`
-            is different — it changes only when the body carries it.
+            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `accessLevel`,
+            `integrationAccessLevel` and `accountMFARequired` are cleared when omitted, so resend them to keep
+            them. `accountSSORequired`, `allowToEditRetryData`, `allowIntegrationWorkspaceCreation`,
+            `mcpServerAccessLevel` and `allMcpServerAccess` are different — each changes only when the body
+            carries it. An update never writes `allowAccessToAPIM`.
 
             `none` is written by SCIM provisioning for a user who has no account-wide grant; do not send it
             yourself — omit `accessLevel` and use `integrationAccessLevel` for integration-only access.
@@ -673,9 +753,10 @@ components:
               created later, so pairing it with `integrationAccessLevel` widens access rather than
               limiting it.
             - |-
-              On PUT, "omit" means "clear" for integrationAccessLevel and accountMFARequired — GET the
-              record first and resend both with the new accessLevel. accountSSORequired keeps its stored
-              value when omitted.
+              On PUT, "omit" means "clear" for accessLevel, integrationAccessLevel and accountMFARequired —
+              GET the record first and resend all three. accountSSORequired, allowToEditRetryData,
+              allowIntegrationWorkspaceCreation, mcpServerAccessLevel and allMcpServerAccess keep their
+              stored values when omitted, and allowAccessToAPIM is never written by a PUT.
           enum:
             - monitor
             - manage
@@ -725,6 +806,14 @@ components:
             leaves the stored value unchanged. While the account enforces SSO for every
             user, the value sent is ignored and the stored value is kept until that
             enforcement is turned off.
+
+            While SSO applies to the user (here or account-wide) and the account's SSO
+            provider is enabled, requests made through the user's access record — signed in
+            to the UI, or with a personal access token, which acts through its creator's
+            record — are refused with 403 `access_restricted` ("You are required to sign in
+            via SSO configured for the account to access it.") when the user's login isn't
+            linked to that provider. Account API tokens don't act through a user's access
+            record, so SSO settings don't affect them.
           examples:
             - false
           x-celigo-ai-guidance:
@@ -740,7 +829,11 @@ components:
             - The invite body takes it too, so require MFA in the invite itself rather than with a follow-up update, which must resend `integrationAccessLevel` and this flag or clears them.
         allowAccessToAPIM:
           type: boolean
-          description: When true, the user can access API Management (APIM) features for this account.
+          readOnly: true
+          description: |-
+            When true, the user has been set up in API Management (APIM) for this account. The platform
+            sets it the first time an administrator opens API Management; `PUT /v1/ashares/{_id}` never
+            writes it.
         allowToEditRetryData:
           type: boolean
           description: |-
@@ -753,9 +846,15 @@ components:
             This setting only applies when:
             - `accessLevel` is `monitor`, or
             - an entry in `integrationAccessLevel` grants `monitor` access for a specific integration.
+
+            On update it changes only when the body carries it, only for such a user, and only when the
+            owner or an administrator sends it; omitted, the stored value is kept.
         allowIntegrationWorkspaceCreation:
           type: boolean
-          description: When true, the user can create integration workspaces.
+          description: |-
+            When true, a monitor or integration-level user can create integration workspaces, which
+            includes installing templates. Written on update only when the body carries it, by the
+            owner or an administrator; omitted, the stored value is kept.
     ResourceGrant:
       type: object
       description: |-
@@ -1190,7 +1289,13 @@ components:
               description: Single email address to invite (use with `POST /v1/invite`).
             emails:
               type: array
-              description: Email addresses to invite (use with `POST /v1/invite/multiple`).
+              minItems: 1
+              maxItems: 5
+              uniqueItems: true
+              description: |-
+                Email addresses to invite (use with `POST /v1/invite/multiple`): one to five
+                distinct addresses. An empty list, more than five, or a repeated address refuses
+                the whole request with 403 (`no_emails`, `limit_exceeded`, `duplicate_emails`).
               items:
                 type: string
                 format: email
@@ -1244,6 +1349,21 @@ components:
                 errors:
                   - code: not_found
                     message: The requested resource was not found.
+    403-production-administrator:
+      description: |-
+        The user is an administrator of the production environment, whose access record is
+        repeated in every environment, and the request came from a non-production environment.
+        Change, disable, re-invite or remove a production administrator from production.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            productionAdministrator:
+              value:
+                errors:
+                  - code: access_restricted
+                    message: This request can only be made through the production environment.
     400-bad-request:
       description: |
         Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.165",
+  "version": "0.2.167",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "ab4f8f83",
+		"iasCommit": "560182fc",
 		"generatedAt": "2026-10-22"
 	},
 	"roots": {