@celigo/api-specs 0.2.166 → 0.2.168

package/dist/environment.yml

@@ -41,6 +41,14 @@ paths:
         `feature_not_enabled`. Every account with the feature has at least
         one environment (Production). The full list is returned in a single
         unpaginated response.
+
+        Listing works from production for the account owner and administrators.
+        Outside production, only an API token created in that environment can
+        list (it acts as the environment's own user); a workspace user working
+        in a non-production environment, signed in or with a personal access
+        token, gets 403 `access_restricted`. Every other environment operation
+        is production-only and answers that 403 to any caller outside
+        production.
       responses:
         '200':
           description: List of environments.
@@ -70,8 +78,39 @@ paths:
                       createdAt: '2025-11-12T22:28:22.433Z'
         '204':
           description: No environments exist in the account
+        '400':
+          description: The account doesn't have the environments feature.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              example:
+                errors:
+                  - code: feature_not_enabled
+                    message: The environment feature is not enabled for the account.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          description: |-
+            A manage or monitor user in production, or a workspace user (signed in, or with a
+            personal access token) working in a non-production environment.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                nonProductionEnvironment:
+                  summary: A workspace user working in a non-production environment
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: This request can only be made through the production environment.
+                notAdministrator:
+                  summary: A manage or monitor user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: You don't have the right to perform this action. Please contact your account administrator to receive manage permission for this account.
     post:
       x-internal: false
       summary: Create an environment
@@ -122,6 +161,8 @@ paths:
           $ref: '#/components/responses/400-bad-request'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-only'
         '422':
           $ref: '#/components/responses/422-unprocessable-entity'
   /v1/environments/{_id}:
@@ -174,6 +215,8 @@ paths:
                     createdAt: '2025-11-12T22:28:22.433Z'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-only'
         '404':
           $ref: '#/components/responses/404-not-found'
     put:
@@ -237,6 +280,8 @@ paths:
           $ref: '#/components/responses/400-bad-request'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-only'
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
@@ -286,6 +331,8 @@ paths:
                     message: Production environment cannot be disabled.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-only'
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
@@ -297,7 +344,7 @@ paths:
               example:
                 errors:
                   - code: resolve_pending_invitation
-                    message: Please resolve pending invitations before disabling this environment.
+                    message: Please resolve any pending user invitations to disable the environment.
 components:
   securitySchemes:
     bearerAuth:
@@ -455,15 +502,6 @@ components:
               type: boolean
               readOnly: true
               description: When true, the environment has been migrated from legacy sandbox. Present only on enterprise accounts.
-    Request:
-      type: object
-      description: Fields for creating or updating an environment.
-      x-celigo-ai-guidance:
-        - Fields that can be sent when creating or updating a environment
-      required:
-        - name
-      allOf:
-        - $ref: '#/components/schemas/EnvironmentBase'
     Error:
       type: object
       description: Standard error response envelope returned by integrator.io APIs.
@@ -504,6 +542,15 @@ components:
               - message
       required:
         - errors
+    Request:
+      type: object
+      description: Fields for creating or updating an environment.
+      x-celigo-ai-guidance:
+        - Fields that can be sent when creating or updating a environment
+      required:
+        - name
+      allOf:
+        - $ref: '#/components/schemas/EnvironmentBase'
   responses:
     401-unauthorized:
       description: |-
@@ -552,6 +599,20 @@ components:
                 errors:
                   - code: invalid_request
                     message: The request body failed validation.
+    403-production-only:
+      description: |-
+        The request was made from a non-production environment -- with a token created there, or
+        by a workspace user working there. Environments are managed from production only.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            nonProductionEnvironment:
+              value:
+                errors:
+                  - code: access_restricted
+                    message: This request can only be made through the production environment.
     422-unprocessable-entity:
       description: |
         Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

package/dist/export.yml

@@ -5580,7 +5580,10 @@ components:
               description: |-
                 When true, a file whose records partially fail parsing against the file definition
                 still emits the records that did parse, instead of failing the entire file. Applies to
-                file-definition (fixed-width, EDI) parsing only.
+                file-definition (fixed-width, EDI) parsing only. For X12 and EDIFACT the unit is the
+                transaction set (ST–SE, UNH–UNT), and it takes effect only with an EDI profile linked:
+                a failed set is set aside and reported as an error while the file's other sets go on
+                as records. Without this flag, one failed set fails the whole file.
               examples:
                 - true
                 - false

package/dist/filedefinition.yml

@@ -1163,8 +1163,12 @@ components:
             Primarily relevant for EDI EDIFACT format.
         skipEDIValidation:
           type: boolean
+          default: true
           description: |
-            Whether to skip EDI structural validation during parsing.
+            Whether to skip EDI element validation during parsing: element lengths, data types,
+            code lists, mandatory elements and element relationships. Omitted means skipped, so
+            these checks run only when it is `false`. Profile checks (`skipEDIProfileValidation`)
+            and missing mandatory segments are separate and still apply.
         skipEDIProfileValidation:
           type: boolean
           default: false
@@ -1188,6 +1192,11 @@ components:
           `maxOccurrence` is 1 or unset, matches only the first row: in fixed-width and delimited
           files the parser drops the rest without an error, and an X12 parse fails at the next row,
           naming a mandatory segment as missing.
+        - |-
+          Cloning an export that uses a file definition also creates a new file definition, with the
+          same name, and points the cloned export at it: the export's clone preview lists it as a
+          `FileDefinition` object. Two definitions with one name can follow, so tell them apart by
+          `_id`.
     ResourceResponse:
       type: object
       description: Response

package/dist/integration.yml

@@ -1024,97 +1024,6 @@ paths:
                     errors:
                       - code: invalid_ref
                         message: Integration not found.
-  /v1/integrations/{_id}/clonefamily:
-    get:
-      x-internal: false
-      operationId: listIntegrationCloneFamily
-      tags:
-        - Integrations
-      summary: List an integration's clone family
-      description: |-
-        Returns every member of the integration's clone family -- the original plus every clone
-        (recursively, across environments). Used by ILM to decide which integrations can be pull/push
-        sources or targets for the current integration.
-
-        This endpoint requires the `integrator-ashareid` header to establish a shared-account context.
-        For simpler clone-relationship lookups, the integration's own `_sourceId` field points to the
-        parent it was cloned from, and `GET /v1/integrations?_sourceId=<id>` lists the children.
-      parameters:
-        - name: integrator-ashareid
-          in: header
-          required: true
-          description: |-
-            Account-share id that scopes the request to a specific shared-account context. The bearer
-            token's user must be the `sharedWithUser` of this ashare.
-          schema:
-            type: string
-            format: objectId
-            examples:
-              - 6798f4dc43db9184f4bc8ee0
-        - name: _id
-          in: path
-          required: true
-          description: Integration id.
-          schema:
-            type: string
-            format: objectId
-            x-celigo-refModel: integrations
-            examples:
-              - 6842261335b64c0bcb308e4f
-      responses:
-        '200':
-          description: Clone family members.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CloneFamilyResponse'
-              examples:
-                family:
-                  summary: Original integration plus one clone in another environment
-                  value:
-                    - _id: 6842261335b64c0bcb308e4f
-                      name: Shopify → NetSuite Orders
-                    - _id: 68f52162f00a35a1b26eaafb
-                      name: Clone - Shopify → NetSuite Orders
-                      _envId: 67b123456789abcdef012345
-        '401':
-          $ref: '#/components/responses/401-unauthorized'
-        '403':
-          description: |-
-            Either the `integrator-ashareid` header is malformed (code: `invalid_header_value`) or it
-            was omitted entirely (code: `get_not_allowed`, "GET resource not allowed for the given
-            model.").
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                get_not_allowed:
-                  summary: Header omitted entirely
-                  value:
-                    errors:
-                      - code: get_not_allowed
-                        message: GET resource not allowed for the given model.
-                invalid_header_value:
-                  summary: Header malformed (not a 24-char hex id)
-                  value:
-                    errors:
-                      - code: invalid_header_value
-                        message: The value provided for request header Integrator-AShareId is invalid.
-        '404':
-          description: |-
-            Integration unknown, or the `integrator-ashareid` references a share whose `sharedWithUser`
-            isn't the bearer token's user (code: `access_restricted`).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                access_restricted:
-                  value:
-                    errors:
-                      - code: access_restricted
-                        message: Your access to an integrator.io environment or account has been disabled. For more information, contact account administrator.
   /v1/integrations/{_id}/flows:
     get:
       x-internal: false
@@ -2575,103 +2484,6 @@ paths:
           $ref: '#/components/responses/401-unauthorized'
         '404':
           $ref: '#/components/responses/404-not-found'
-  /v1/integrations/{_id}/iLMIgnore:
-    get:
-      x-internal: false
-      operationId: getIntegrationILMIgnoreFields
-      tags:
-        - Integrations
-      summary: List available ILM ignore fields
-      description: |-
-        Returns the catalog of *available* fields that can be ignored when pulling changes between
-        related integrations. Keys are lowercase resource types (`integration`, `flow`, `export`,
-        `import`, `connection`, `script`, ...); values are arrays of dot-path field names that can be
-        excluded from an ILM pull/revert. The key set is platform-driven — treat the response, not
-        the example list, as the authoritative catalog.
-
-        This endpoint requires the `integrator-ashareid` header to establish a shared-account context.
-        The current ignore configuration lives on the integration's `iLMIgnore` field (readable via
-        `GET /v1/integrations/{_id}`); this endpoint only returns the menu of what *can* be ignored.
-        To change the configuration, PATCH the integration with
-        `[{op:"replace", path:"/iLMIgnore", value:{...}}]`.
-      parameters:
-        - name: integrator-ashareid
-          in: header
-          required: true
-          description: |-
-            Account-share id that scopes the request to a specific shared-account context. The bearer
-            token's user must be the `sharedWithUser` of this ashare.
-          schema:
-            type: string
-            format: objectId
-            examples:
-              - 6798f4dc43db9184f4bc8ee0
-        - name: _id
-          in: path
-          required: true
-          description: Integration id.
-          schema:
-            type: string
-            format: objectId
-            x-celigo-refModel: integrations
-            examples:
-              - 6842261335b64c0bcb308e4f
-      responses:
-        '200':
-          description: Available ignore fields per resource type.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ILMIgnoreResponse'
-              examples:
-                default:
-                  value:
-                    integration:
-                      - name
-                      - description
-                    flow:
-                      - disabled
-                      - name
-                    export:
-                      - name
-                      - http.body
-        '401':
-          $ref: '#/components/responses/401-unauthorized'
-        '403':
-          description: |-
-            Either the `integrator-ashareid` header is malformed (code: `invalid_header_value`) or it
-            was omitted entirely (code: `get_not_allowed`).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                get_not_allowed:
-                  summary: Header omitted entirely
-                  value:
-                    errors:
-                      - code: get_not_allowed
-                        message: GET resource not allowed for the given model.
-                invalid_header_value:
-                  summary: Header malformed (not a 24-char hex id)
-                  value:
-                    errors:
-                      - code: invalid_header_value
-                        message: The value provided for request header Integrator-AShareId is invalid.
-        '404':
-          description: |-
-            Integration unknown, or the `integrator-ashareid` references a share whose `sharedWithUser`
-            isn't the bearer token's user (code: `access_restricted`).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                access_restricted:
-                  value:
-                    errors:
-                      - code: access_restricted
-                        message: Your access to an integrator.io environment or account has been disabled. For more information, contact account administrator.
   /v1/integrations/{_id}/template:
     get:
       x-internal: false
@@ -4957,36 +4769,6 @@ components:
             type: string
             examples:
               - '6044134138'
-    CloneFamilyResponse:
-      type: array
-      description: |-
-        Members of an integration's clone family — the original integration plus every clone (including
-        clones of clones, across environments). Used by ILM to decide which integrations can pull from or
-        push to the current one.
-      items:
-        type: object
-        description: One integration in the clone family.
-        properties:
-          _id:
-            type: string
-            format: objectId
-            description: Integration id.
-            x-celigo-refModel: integrations
-            examples:
-              - 6842261335b64c0bcb308e4f
-          name:
-            type: string
-            description: Display name of the integration.
-            examples:
-              - Shopify → NetSuite Orders
-          _envId:
-            type: string
-            format: objectId
-            x-celigo-refModel: environments
-            examples:
-              - 67b123456789abcdef012345
-            description: Environment id the integration belongs to.
-        additionalProperties: true
     LookupCacheBase:
       type: object
       description: Writable fields shared by the request and response schemas.
@@ -5345,38 +5127,6 @@ components:
             - To register an existing topic instead, use `PUT /v1/integrations/{_id}/topics/{_topicId}/register`.
           examples:
             - - 6ab1f4a138d7733b45998d99
-    ILMIgnoreResponse:
-      type: object
-      description: |-
-        Catalog of resource-type → field-path lists that are *available* to be ignored during ILM pulls
-        and reverts. This is the full menu of what can be configured — to see the current ignore
-        configuration, read the `iLMIgnore` field on the integration itself via
-        `GET /v1/integrations/{_id}`.
-
-        Keys are lowercase resource type names (e.g. `integration`, `flow`, `export`, `import`,
-        `connection`, `script`). Each value is an array of dot-path strings naming fields that can be
-        excluded. Only resource types that have configurable ignores appear as keys.
-      additionalProperties:
-        type: array
-        description: Field paths (dotted) that can be ignored for this resource type.
-        items:
-          type: string
-      example:
-        integration:
-          - settings.general.description
-          - settings.general.name
-        flow:
-          - scheduling.startTime
-          - disabled
-        export:
-          - http.relativeURI
-          - delta.dateField
-        import:
-          - http.relativeURI
-          - mapping
-        connection:
-          - http.baseURI
-          - http.auth.token.token
     DependencyEntry:
       type: object
       description: A single resource that depends on the queried resource.

package/dist/recyclebin.yml

@@ -419,9 +419,13 @@ paths:
         Resources are auto-purged after 30 days. A purge removes only the
         named resource: purge the bin entries that still reference it first
         (a deleted flow references its integration and the exports and imports
-        it used). An integration's Celigo Storage system folder is the
-        exception: the folder and everything in it go to the bin with the
-        integration and are purged with it.
+        it used). Purging a flow leaves its integration, exports, imports and
+        scripts where they are. A few purges remove more than the named
+        document: an integration's Celigo Storage system folder (with
+        everything in it) goes to the bin with the integration and is purged
+        with it; purging a connection first deletes the end users' own copies
+        of it (their MCP connections) for good; and purging a topic deletes
+        its stored messages.
       parameters:
         - $ref: '#/components/parameters/ResourceType'
         - name: _id

package/dist/sync.yml

@@ -242,7 +242,10 @@ paths:
           description: |-
             Validation failed. `source._connectionId` is missing
             (`missing_source_connection`), the integration was not created with
-            `syncs: true` (`integration_not_for_sync`), the destination duplicates another sync
+            `syncs: true` (`integration_not_for_sync`), `destination._connectionId` isn't a
+            connection in the account (`missing_destination_connection`), the destination
+            connection is offline while a `database` or `schema` is set
+            (`offline_destination_connection`), the destination duplicates another sync
             (`duplicate_destination_host`), the destination connector rejected the
             sync configuration (`invalid_destination_sync_config`), two enabled
             datasets resolve to the same destination table
@@ -444,14 +447,21 @@ paths:
           description: |-
             Validation failed. `source._connectionId` is missing
             (`missing_source_connection`), the sync is not ready to enable
-            (`sync_not_enabled`), the destination duplicates another sync
+            (`sync_not_enabled`), the update drops the saved destination connection or names a
+            connection that doesn't exist (`missing_destination_connection`, "Destination
+            connection is missing in the request"), the new destination connection is another
+            warehouse type than the saved one (`duplicate_destination_type`, "Destination
+            connection type is not same as the previous destination connection type"), a new
+            `database` or `schema` was sent while the destination connection is offline
+            (`offline_destination_connection` — the platform creates the schema when the
+            destination is saved), the destination duplicates another sync
             (`duplicate_destination_host`), the destination connector rejected the
             sync configuration (`invalid_destination_sync_config`), two enabled
             datasets resolve to the same destination table
             (`conflicting_table_name`), a field exceeds its size limit
             (`size_limit_exceeded`), the drift policy is inconsistent
             (`drift_policy_invalid_setup`), or the destination's application differs from
-            the integration's other syncs or from the sync's saved destination.
+            the integration's other syncs.
           content:
             application/json:
               schema:
@@ -798,8 +808,9 @@ paths:
           description: |-
             Bad request. The body is not a non-empty array (`INVALID_REQUEST_BODY` /
             `EMPTY_REQUEST_BODY`), an item has both or neither of `_id`/`externalId`
-            (`dataset_externalId_id_required`), an `externalId` already exists or an `_id`
-            does not belong to the sync, `tableName` values collide
+            (`dataset_externalId_id_required`), an `externalId` already exists on the sync
+            (`create_dataset_present`) or an `_id` does not belong to it
+            (`update_dataset_not_present`), `tableName` values collide
             (`duplicate_dataset_table_names`), or an export dataset's export uses a
             different connection than the sync (`connection_mismatch`).
           content:
@@ -3016,8 +3027,10 @@ paths:
                       deltaFields:
                         type: array
                         description: |-
-                          Column names usable as the incremental-extraction cursor
-                          (`exportProperties.delta.dateField`).
+                          Column names usable as the incremental-extraction cursor. A
+                          Salesforce dataset uses the first entry itself; a NetSuite
+                          saved-search dataset names its cursor in
+                          `exportProperties.delta.dateField`.
                         items:
                           type: string
                         examples:
@@ -3438,7 +3451,8 @@ paths:
                           type: boolean
                           description: |-
                             Only present (as `true`) when the export no longer uses the
-                            sync's source connection.
+                            sync's source connection, or is no longer among the source
+                            connection's exports (for example, it was deleted).
                           examples:
                             - true
                         totalFieldCount:
@@ -4421,8 +4435,10 @@ components:
                   type: string
                   description: |-
                     Source field that carries each record's last-modified timestamp, used as
-                    the delta cursor. Required for NetSuite datasets that extract via a
-                    `netsuite.recordType`; Salesforce datasets derive it automatically.
+                    the delta cursor. Used by NetSuite saved-search datasets, where it is
+                    required when a `netsuite.recordType` is set. Salesforce datasets take the
+                    first entry of the column read's `deltaFields` instead, and HTTP-connector
+                    datasets have no date field: their delta filter is part of the request.
                   examples:
                     - lastmodifieddate
             netsuite:
@@ -4431,9 +4447,13 @@ components:
               properties:
                 recordType:
                   type: string
+                  writeOnly: true
                   description: |-
                     NetSuite record type backing a saved-search dataset. When set with
-                    `exportProperties.type: delta`, a `delta.dateField` is required.
+                    `exportProperties.type: delta`, a `delta.dateField` is required. Write-only:
+                    dataset reads don't return it, so an update item built from a read-back
+                    clears it; the sync's next run restores a missing value from the saved
+                    search's catalog entry (`appSpecificProperties.recordType`).
                   examples:
                     - salesorder
         driftPolicy:
@@ -4466,8 +4486,10 @@ components:
           readOnly: true
           description: |-
             Only present (as `true`) in list responses, on export-backed datasets whose
-            export no longer uses the sync's source connection. Repoint the export or
-            recreate the dataset to resume replicating it.
+            export no longer uses the sync's source connection. The source catalog listing
+            also flags an export-backed dataset whose export it no longer lists, such as a
+            deleted export. Repoint the export or recreate the dataset to resume replicating
+            it.
           examples:
             - true
     DatasetUpsertItem:
@@ -4595,8 +4617,10 @@ components:
                   type: string
                   description: |-
                     Source field carrying each record's last-modified timestamp, used as the
-                    delta cursor. Required for NetSuite datasets extracted via a
-                    `netsuite.recordType`; Salesforce datasets derive it automatically.
+                    delta cursor. Used by NetSuite saved-search datasets, where it is required
+                    when a `netsuite.recordType` is set; it isn't checked against the column
+                    read's `deltaFields`. Salesforce datasets take the first `deltaFields` entry
+                    instead, and HTTP-connector datasets take no date field.
                   examples:
                     - lastmodifieddate
             netsuite:
@@ -4606,8 +4630,11 @@ components:
                 recordType:
                   type: string
                   description: |-
-                    NetSuite record type backing a saved-search dataset. When set with
-                    `exportProperties.type: delta`, a `delta.dateField` is required.
+                    NetSuite record type backing a saved-search dataset, from the saved search's
+                    catalog entry (`appSpecificProperties.recordType`). When set with
+                    `exportProperties.type: delta`, a `delta.dateField` is required. Reads never
+                    return it, so an update item built from a read-back clears it unless you add
+                    it back; the sync's next run restores a missing value from the catalog.
                   examples:
                     - salesorder
         driftPolicy:
@@ -4649,7 +4676,11 @@ components:
             Scopes this run to these datasets on the sync. Omit the field to run every
             enabled dataset; an empty array is rejected. Each id must belong to this sync
             and be enabled, and subset selection on a normal run is rejected unless the
-            account has partial normal sync enabled.
+            account has partial normal sync enabled. A selection larger than the per-run
+            maximum is accepted here but stops the run as it starts: no table runs, and
+            the sync's errors record `max_datasets_exceeded` ("Selected datasets exceed the
+            maximum allowed per run (N). Reduce the selection and retry."). Split a large
+            selection across runs.
           items:
             type: string
             format: objectId

package/dist/tool.yml

@@ -30253,7 +30253,10 @@ components:
               description: |-
                 When true, a file whose records partially fail parsing against the file definition
                 still emits the records that did parse, instead of failing the entire file. Applies to
-                file-definition (fixed-width, EDI) parsing only.
+                file-definition (fixed-width, EDI) parsing only. For X12 and EDIFACT the unit is the
+                transaction set (ST–SE, UNH–UNT), and it takes effect only with an EDI profile linked:
+                a failed set is set aside and reported as an error while the file's other sets go on
+                as records. Without this flag, one failed set fails the whole file.
               examples:
                 - true
                 - false

package/dist/user.yml

@@ -30,7 +30,8 @@ tags:
 
       The account owner is not included — only invited users appear, plus any
       the identity provider provisioned through SCIM (`provisionedBy: scim`).
-      Users can be disabled (reversible) or permanently removed.
+      Users can be disabled (reversible) or permanently removed. The license
+      sets no user or seat limit.
 
       ## User schema
 
@@ -223,14 +224,20 @@ paths:
       description: |-
         Replaces a workspace user's access settings. The body must grant access
         through `accessLevel` or a non-empty `integrationAccessLevel`, and
-        `integrationAccessLevel` and `accountMFARequired` are cleared when
-        omitted — send every value to keep. `accountSSORequired` is the
-        exception: it changes only when the body carries it, and is ignored
-        while the account enforces SSO for every user. `disabled` is not
-        applied here; toggle it with `PUT /v1/ashares/{_userId}/disable`.
-        Read-only fields echoed from the GET response are ignored, except
-        `userType`, which is rejected. The user's email cannot be changed after
-        invite. Callable from the production environment only.
+        `accessLevel`, `integrationAccessLevel` and `accountMFARequired` are
+        cleared when omitted — send every value to keep. The other settings
+        change only when the body carries them and keep their stored values
+        when omitted: `accountSSORequired` (also ignored while the account
+        enforces SSO for every user), `allowToEditRetryData`,
+        `allowIntegrationWorkspaceCreation` (both applied only to monitor and
+        integration-level users, and only when the owner or an administrator
+        sends them), `mcpServerAccessLevel` (send `[]` to clear it) and
+        `allMcpServerAccess`. `allowAccessToAPIM` isn't changed here at all.
+        `disabled` is not applied here; toggle it with
+        `PUT /v1/ashares/{_userId}/disable`. Read-only fields echoed from the
+        GET response are ignored, except `userType`, which is rejected. The
+        user's email cannot be changed after invite. A production
+        administrator's record can be changed only from production.
 
         End-user access records share this route with a different body — see
         the End Users API.
@@ -297,17 +304,7 @@ paths:
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
-          description: The call was made from a sandbox environment.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                sandboxEnvironment:
-                  value:
-                    errors:
-                      - code: access_restricted
-                        message: This request can only be made through the production environment.
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
@@ -346,6 +343,8 @@ paths:
           description: User removed from the account.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
   /v1/ashares/{_userId}/disable:
@@ -358,9 +357,14 @@ paths:
       description: |-
         Toggles the `disabled` flag on a user's access record. Call again to
         re-enable — there is no separate `/enable` path, and this is the only
-        way to change `disabled` (the update operation does not apply it). A
-        pending invitation cannot be toggled until the invited user accepts or
-        declines it.
+        way to change `disabled` (the update operation does not apply it). Only
+        an accepted workspace invitation toggles: a pending one is refused with
+        400, and a declined one (`dismissed: true`) answers 204 without changing
+        anything — delete it, or re-send it with
+        `PUT /v1/ashares/{_id}/reinvite`. The
+        user is emailed on every toggle. Disabling a production administrator
+        also disables their records in the other environments, and only
+        production can toggle one.
 
         End-user access records share this route — see the End Users API.
       parameters:
@@ -386,7 +390,7 @@ paths:
                 value: {}
       responses:
         '204':
-          description: User access toggled.
+          description: User access toggled, or the invitation was declined and nothing changed.
         '400':
           description: The invitation is still pending.
           content:
@@ -401,6 +405,8 @@ paths:
                         message: You can't disable this invitation without it being accepted or dismissed by the invited user.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           description: User not found.
           content:
@@ -421,6 +427,11 @@ paths:
         Re-sends the invitation to a user who previously dismissed it. Only
         works on users with `dismissed: true` in the user record. After
         reinviting, the user returns to a pending state awaiting acceptance.
+
+        There is no re-send for an invitation that is still pending: this
+        route refuses it, and inviting the address again answers
+        `invalid_invite`. Delete the pending record and invite the address
+        again with the same access settings.
       operationId: reinviteUser
       tags:
         - Users
@@ -458,9 +469,11 @@ paths:
                   value:
                     errors:
                       - code: invalid_request
-                        message: User has not dismissed the invite.
+                        message: You can reinvite a user only if he/she has dismissed you previous invite.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          $ref: '#/components/responses/403-production-administrator'
         '404':
           $ref: '#/components/responses/404-not-found'
   /v1/ashares/{_id}/accept:
@@ -559,6 +572,16 @@ paths:
         Invite one or more users by email. Each entry in the response array
         corresponds to the email at the same index — check `statusCode` per
         entry for partial failures.
+
+        An address that already has an access record in this environment —
+        accepted, still pending, or declined — fails in its entry with 400
+        `invalid_invite`: nothing changes and no email is sent. Change an
+        existing user with `PUT /v1/ashares/{_id}`, and re-send a declined
+        invitation with `PUT /v1/ashares/{_id}/reinvite`. A pending
+        invitation has no re-send: delete it and invite the address again.
+
+        Each call takes at most five addresses; the account itself has no user
+        limit.
       operationId: inviteUsers
       tags:
         - Users
@@ -598,11 +621,27 @@ paths:
                     statusCode:
                       type: integer
                       description: |-
-                        Per-entry result code. `201` on success, `400` if
-                        the user already has access (use `PUT /v1/ashares/{_id}`
-                        to update permissions instead).
+                        Per-entry result code. `201` on success; `400`
+                        (`invalid_invite`) if the address already has an access
+                        record in this environment. For an accepted user, change
+                        access with `PUT /v1/ashares/{_id}`; re-send a declined
+                        invitation with `PUT /v1/ashares/{_id}/reinvite`; a
+                        pending invitation can't be re-sent (delete it and invite
+                        again).
                     doc:
                       $ref: '#/components/schemas/User'
+                    errors:
+                      type: array
+                      description: Why this address failed. Present instead of `doc` when `statusCode` isn't `201`.
+                      items:
+                        type: object
+                        properties:
+                          code:
+                            type: string
+                            description: Machine-readable error code, such as `invalid_invite`.
+                          message:
+                            type: string
+                            description: Human-readable description of the error.
               examples:
                 default:
                   value:
@@ -630,10 +669,49 @@ paths:
                         sharedWithUser:
                           _id: 6a02b1859a09438890230aab
                           email: user2@example.com
+                alreadyInvited:
+                  summary: The second address already has a (pending) access record
+                  value:
+                    - statusCode: 201
+                      doc:
+                        _id: 6a02b1869a09438890230ae2
+                        accessLevel: monitor
+                        integrationAccessLevel: []
+                        lastModified: '2026-05-12T04:50:14.342Z'
+                        createdAt: '2026-05-12T04:50:14.330Z'
+                        createdVia: existing_account_invite
+                        sharedWithUser:
+                          _id: 6a02b1859a09438890230a9f
+                          email: user1@example.com
+                    - statusCode: 400
+                      errors:
+                        - code: invalid_invite
+                          message: The user already has access to this environment. Please use the edit permissions option to update the permissions for the user.
         '400':
           $ref: '#/components/responses/400-bad-request'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          description: |-
+            `emails` is empty, holds more than five addresses, or repeats one; nothing is
+            invited. Also returned when the caller may not invite users.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                tooMany:
+                  summary: More than five addresses
+                  value:
+                    errors:
+                      - code: limit_exceeded
+                        message: Number of invites in the request exceeds maximum allowed limit 5.
+                duplicate:
+                  summary: An address listed twice
+                  value:
+                    errors:
+                      - code: duplicate_emails
+                        message: Duplicate emails found in the request.
 components:
   securitySchemes:
     bearerAuth:
@@ -659,9 +737,11 @@ components:
 
             If per-integration level permissions are needed, omit `accessLevel` and instead populate `integrationAccessLevel`.
 
-            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `integrationAccessLevel`
-            and `accountMFARequired` are cleared when omitted, so resend them to keep them. `accountSSORequired`
-            is different — it changes only when the body carries it.
+            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `accessLevel`,
+            `integrationAccessLevel` and `accountMFARequired` are cleared when omitted, so resend them to keep
+            them. `accountSSORequired`, `allowToEditRetryData`, `allowIntegrationWorkspaceCreation`,
+            `mcpServerAccessLevel` and `allMcpServerAccess` are different — each changes only when the body
+            carries it. An update never writes `allowAccessToAPIM`.
 
             `none` is written by SCIM provisioning for a user who has no account-wide grant; do not send it
             yourself — omit `accessLevel` and use `integrationAccessLevel` for integration-only access.
@@ -673,9 +753,10 @@ components:
               created later, so pairing it with `integrationAccessLevel` widens access rather than
               limiting it.
             - |-
-              On PUT, "omit" means "clear" for integrationAccessLevel and accountMFARequired — GET the
-              record first and resend both with the new accessLevel. accountSSORequired keeps its stored
-              value when omitted.
+              On PUT, "omit" means "clear" for accessLevel, integrationAccessLevel and accountMFARequired —
+              GET the record first and resend all three. accountSSORequired, allowToEditRetryData,
+              allowIntegrationWorkspaceCreation, mcpServerAccessLevel and allMcpServerAccess keep their
+              stored values when omitted, and allowAccessToAPIM is never written by a PUT.
           enum:
             - monitor
             - manage
@@ -725,6 +806,14 @@ components:
             leaves the stored value unchanged. While the account enforces SSO for every
             user, the value sent is ignored and the stored value is kept until that
             enforcement is turned off.
+
+            While SSO applies to the user (here or account-wide) and the account's SSO
+            provider is enabled, requests made through the user's access record — signed in
+            to the UI, or with a personal access token, which acts through its creator's
+            record — are refused with 403 `access_restricted` ("You are required to sign in
+            via SSO configured for the account to access it.") when the user's login isn't
+            linked to that provider. Account API tokens don't act through a user's access
+            record, so SSO settings don't affect them.
           examples:
             - false
           x-celigo-ai-guidance:
@@ -740,7 +829,11 @@ components:
             - The invite body takes it too, so require MFA in the invite itself rather than with a follow-up update, which must resend `integrationAccessLevel` and this flag or clears them.
         allowAccessToAPIM:
           type: boolean
-          description: When true, the user can access API Management (APIM) features for this account.
+          readOnly: true
+          description: |-
+            When true, the user has been set up in API Management (APIM) for this account. The platform
+            sets it the first time an administrator opens API Management; `PUT /v1/ashares/{_id}` never
+            writes it.
         allowToEditRetryData:
           type: boolean
           description: |-
@@ -753,9 +846,15 @@ components:
             This setting only applies when:
             - `accessLevel` is `monitor`, or
             - an entry in `integrationAccessLevel` grants `monitor` access for a specific integration.
+
+            On update it changes only when the body carries it, only for such a user, and only when the
+            owner or an administrator sends it; omitted, the stored value is kept.
         allowIntegrationWorkspaceCreation:
           type: boolean
-          description: When true, the user can create integration workspaces.
+          description: |-
+            When true, a monitor or integration-level user can create integration workspaces, which
+            includes installing templates. Written on update only when the body carries it, by the
+            owner or an administrator; omitted, the stored value is kept.
     ResourceGrant:
       type: object
       description: |-
@@ -1190,7 +1289,13 @@ components:
               description: Single email address to invite (use with `POST /v1/invite`).
             emails:
               type: array
-              description: Email addresses to invite (use with `POST /v1/invite/multiple`).
+              minItems: 1
+              maxItems: 5
+              uniqueItems: true
+              description: |-
+                Email addresses to invite (use with `POST /v1/invite/multiple`): one to five
+                distinct addresses. An empty list, more than five, or a repeated address refuses
+                the whole request with 403 (`no_emails`, `limit_exceeded`, `duplicate_emails`).
               items:
                 type: string
                 format: email
@@ -1244,6 +1349,21 @@ components:
                 errors:
                   - code: not_found
                     message: The requested resource was not found.
+    403-production-administrator:
+      description: |-
+        The user is an administrator of the production environment, whose access record is
+        repeated in every environment, and the request came from a non-production environment.
+        Change, disable, re-invite or remove a production administrator from production.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            productionAdministrator:
+              value:
+                errors:
+                  - code: access_restricted
+                    message: This request can only be made through the production environment.
     400-bad-request:
       description: |
         Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.166",
+  "version": "0.2.168",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "ffb1b0f7",
+		"iasCommit": "80cddc9b",
 		"generatedAt": "2026-10-22"
 	},
 	"roots": {