@celigo/api-specs 0.2.170 → 0.2.172

package/dist/fileserver.yml

@@ -9,7 +9,9 @@ info:
       (`GET`/`PUT /v1/mft/fileserver`) and the partner accounts that log in to it
       (`/v1/mft/fileserver/accounts`), each chrooted to a Celigo Storage folder. Requires a
       full-access API token — folder-path-scoped and other restricted tokens answer 403
-      FILESERVER_FULL_ACCESS_TOKEN_REQUIRED on every route.
+      FILESERVER_FULL_ACCESS_TOKEN_REQUIRED on every route, and so does every personal access
+      token, whatever its creator's role. Only the account owner and administrators may manage
+      the server.
 servers:
   - url: https://api.integrator.io
     description: Production (US / default region)
@@ -24,7 +26,7 @@ security:
 tags:
   - name: File Server
     description: |-
-      Each environment can run a Celigo-hosted SFTP file server. Enabling it claims a permanent `identifier` that becomes part of every partner login (`<username>@<identifier>`) and exposes the shared endpoint and host-key fingerprints partners need to connect. Partner accounts are created under the server, each with its own password and a Celigo Storage folder that becomes the account's root, so files a partner uploads appear in that folder and files placed there are what the partner can download. The account's license must include the file server add-on (`fileserver.enabled`), and every call needs a full-access API token.
+      Each environment can run a Celigo-hosted SFTP file server. Enabling it claims a permanent `identifier` that becomes part of every partner login (`<username>@<identifier>`) and exposes the shared endpoint and host-key fingerprints partners need to connect. Partner accounts are created under the server, each with its own password and a Celigo Storage folder that becomes the account's root, so files a partner uploads appear in that folder and files placed there are what the partner can download. The account's license must include the file server add-on (`fileserver.enabled`), and every call needs a full-access API token: scoped tokens and personal access tokens are refused, and so are manage, monitor and integration-level users.
 
       ## File server and account schemas
 
@@ -87,7 +89,11 @@ paths:
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
-          description: The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`).
+          description: |-
+            The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`). A
+            personal access token is refused the same way as a scoped token, and a manage, monitor
+            or integration-level user gets `access_restricted`: only the owner and administrators
+            manage the file server.
           content:
             application/json:
               schema:
@@ -98,6 +104,12 @@ paths:
                     errors:
                       - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                         message: The file server management APIs require an API token with full access
+                notAdministrator:
+                  summary: A manage, monitor or integration-level user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: The role which you are associated with doesn't have the required permissions to perform the action.
         '404':
           description: The environment is entitled but its server has never been enabled (`FILESERVER_NOT_FOUND`).
           content:
@@ -220,7 +232,7 @@ paths:
           description: |-
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`),
             the account's license lacks the file server add-on or the environment is a
-            sandbox (`FILESERVER_NOT_ENTITLED`).
+            sandbox (`FILESERVER_NOT_ENTITLED`). A personal access token is refused the same way as a scoped token, and a manage, monitor or integration-level user gets `access_restricted`: only the owner and administrators manage the file server.
           content:
             application/json:
               schema:
@@ -231,6 +243,12 @@ paths:
                     errors:
                       - code: FILESERVER_NOT_ENTITLED
                         message: The file server add-on is not enabled for this account
+                notAdministrator:
+                  summary: A manage, monitor or integration-level user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: The role which you are associated with doesn't have the required permissions to perform the action.
         '404':
           description: A disable was sent for an environment whose server was never enabled (`FILESERVER_NOT_FOUND`).
           content:
@@ -396,7 +414,11 @@ paths:
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
-          description: The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`), or the environment is a sandbox (`FILESERVER_NOT_ENTITLED`).
+          description: |-
+            The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`), or
+            the environment is a sandbox (`FILESERVER_NOT_ENTITLED`). A personal access token is
+            refused the same way as a scoped token, and a manage, monitor or integration-level user
+            gets `access_restricted`: only the owner and administrators manage the file server.
           content:
             application/json:
               schema:
@@ -407,6 +429,12 @@ paths:
                     errors:
                       - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                         message: The file server management APIs require an API token with full access
+                notAdministrator:
+                  summary: A manage, monitor or integration-level user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: The role which you are associated with doesn't have the required permissions to perform the action.
         '422':
           description: The environment's server has never been enabled (`FILESERVER_NOT_ENABLED`); a disabled server is still manageable.
           content:
@@ -487,7 +515,7 @@ paths:
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`);
             the license lacks the add-on or the environment is a sandbox
             (`FILESERVER_NOT_ENTITLED`); or the environment already holds
-            `limits.maxAccounts` enabled accounts (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`).
+            `limits.maxAccounts` enabled accounts (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A personal access token is refused the same way as a scoped token, and a manage, monitor or integration-level user gets `access_restricted`: only the owner and administrators manage the file server.
           content:
             application/json:
               schema:
@@ -498,6 +526,12 @@ paths:
                     errors:
                       - code: FILESERVER_MAX_ACCOUNTS_EXCEEDED
                         message: The maximum number of enabled accounts for this environment has been reached
+                notAdministrator:
+                  summary: A manage, monitor or integration-level user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: The role which you are associated with doesn't have the required permissions to perform the action.
         '409':
           description: Another account in this environment already has that username, enabled or not (`FILESERVER_USERNAME_TAKEN`).
           content:
@@ -688,7 +722,7 @@ paths:
             The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`);
             the license lacks the add-on or the environment is a sandbox
             (`FILESERVER_NOT_ENTITLED`); or re-enabling would exceed `limits.maxAccounts`
-            (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`).
+            (`FILESERVER_MAX_ACCOUNTS_EXCEEDED`). A personal access token is refused the same way as a scoped token, and a manage, monitor or integration-level user gets `access_restricted`: only the owner and administrators manage the file server.
           content:
             application/json:
               schema:
@@ -699,6 +733,12 @@ paths:
                     errors:
                       - code: FILESERVER_MAX_ACCOUNTS_EXCEEDED
                         message: The maximum number of enabled accounts for this environment has been reached
+                notAdministrator:
+                  summary: A manage, monitor or integration-level user
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: The role which you are associated with doesn't have the required permissions to perform the action.
         '404':
           $ref: '#/components/responses/404-account-not-found'
         '409':
@@ -1407,7 +1447,12 @@ components:
               value:
                 message: Bearer Authentication Failed
     403-full-access-required:
-      description: The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`), or the license lacks the add-on / the environment is a sandbox (`FILESERVER_NOT_ENTITLED`).
+      description: |-
+        The token is not a full-access API token (`FILESERVER_FULL_ACCESS_TOKEN_REQUIRED`) --
+        a scoped API token, or any personal access token, which never counts as full access --
+        or the license lacks the add-on / the environment is a sandbox (`FILESERVER_NOT_ENTITLED`).
+        A manage, monitor or integration-level user is refused with `access_restricted`: only the
+        account owner and administrators manage the file server.
       content:
         application/json:
           schema:
@@ -1418,6 +1463,12 @@ components:
                 errors:
                   - code: FILESERVER_FULL_ACCESS_TOKEN_REQUIRED
                     message: The file server management APIs require an API token with full access
+            notAdministrator:
+              summary: A manage, monitor or integration-level user
+              value:
+                errors:
+                  - code: access_restricted
+                    message: The role which you are associated with doesn't have the required permissions to perform the action.
     404-account-not-found:
       description: No account with this id in the caller's environment, or the id is not a valid identifier (`FILESERVER_ACCOUNT_NOT_FOUND`).
       content:

package/dist/flow.yml

@@ -5523,6 +5523,17 @@ components:
             into a schedule (for example all wildcards, `? * * ? * *`), `422
             schedule_not_supported` when its runs would be less than a minute apart — which
             is also what free text such as `every 5 minutes` produces.
+
+            A save can store a later minute than it was sent. A minute field that is 0, 15,
+            30 or 45, a list made only of those minutes, a range that starts at minute 0, or a
+            `*/N` step with N above 5 is stored 5 minutes later: `? 0 6 ? * *` as
+            `? 5 6 ? * *`, `? 0,15,30,45 * ? * *` as `? 5,20,35,50 * ? * *`, `? 0-10 * ? * *`
+            as `? 5-15 * ? * *`, and `? */15 * ? * *` as `? 5-59/15 * ? * *`. Any other minute
+            field is kept as sent, including `? */5 * * * *` and lists that mix in other
+            minutes (`? 0,10,20,30,40,50 * ? * *`), and the other fields never change. POST,
+            PUT and PATCH all store it this way, the response and later reads return the
+            stored value, and scheduled runs start at the stored minutes, so a flow saved for
+            06:00 runs at 06:05 (live-verified 2026-10-22).
           x-celigo-ai-guidance:
             - |-
               Build `schedule` as a Celigo 6-field cron:
@@ -5544,20 +5555,22 @@ components:
               schedule (`? * * ? * *`) with 422 `invalid_value`. Fix or clear the schedule
               instead of disabling the flow to get past the error.
             - |-
-              Prefer explicit lists when AUTHORING a schedule — hourly or longer:
-              minute `5` with an explicit hour list
+              When AUTHORING a schedule, read `schedule` back after the save and give
+              the user the stored times, not the requested ones: a schedule written
+              for minute 0, 15, 30 or 45 can be stored, and run, 5 minutes later (see
+              the description), and an explicit list is moved the same way as a step
+              form. Hourly or longer: minute `5` with an explicit hour list
               (`? 5 0,4,8,12,16,20 ? * *` = every 4 hours;
-              `? 5 9 ? * 1,2,3,4,5` = weekdays 9 AM; `? 5 0 ? * *` = daily);
-              sub-hourly: an explicit minute list with hour `*`
-              (`? 0,15,30,45 * ? * *` = every 15 minutes). Lists match the UI's
-              schedule builder and make fire times unambiguous — the scheduler can
-              offset step expressions (the UI's sub-hourly presets fire at minutes
-              10/25/40/55).
+              `? 5 9 ? * 1,2,3,4,5` = weekdays 9:05 AM; `? 5 0 ? * *` = daily at
+              00:05); sub-hourly: an explicit minute list with hour `*`
+              (`? 5,20,35,50 * ? * *` = every 15 minutes) or a step form.
             - |-
               Wildcard/step/range forms (`? */5 * * * *`, `? 10-59/30 * * * *`) are
               valid and the scheduler runs them — never claim an existing schedule's
               format is invalid or the cause of missed runs, and never rewrite a
-              working schedule into a different format as a fix. A new scheduled
+              working schedule into a different format as a fix. A minute stored 5
+              minutes after the one written is the save's normal behavior, not a
+              fault, and a rewritten schedule is stored the same way. A new scheduled
               instance is not started while a previous run of the flow is still in
               progress (boundaries skipped during a long run are by design); missed
               runs on an enabled, unchanged flow with nothing running are a
@@ -6692,6 +6705,7 @@ components:
           x-celigo-ai-guidance:
             - Read the classification off the record; never infer it from the message text — the classifier is heuristic and identical messages can classify differently.
             - There is no setting, mapping, hook, or API that changes a classification; a wrong one is a Celigo Support matter.
+            - '`parse` also covers a request URL template that names a field the record lacks (`handlebars_template_parse_error`, `Failed to generate request url from template: … Details: "<field>" not defined in the model.`). That is missing data, not template syntax: nothing was sent, a retry of the same record fails the same way, and the fix is the record or how the import routes it (see an HTTP import''s `relativeURI`).'
         classifiedBy:
           type: string
           description: '`auto` on every classified error; absent on unclassified ones.'
@@ -7364,7 +7378,11 @@ components:
               type: integer
               readOnly: true
               description: |-
-                Number of records skipped, for example by an import's ignore-existing or ignore-missing rule.
+                Number of records skipped, by a filter or by an import's ignore-existing or ignore-missing
+                rule. Records an import's filter skips count in that import's child job; records an export's
+                output filter drops count in the export's child job, whose `numSuccess` then counts only the
+                records that passed (an export that read 6 records and dropped 3 reads `numSuccess` 3,
+                `numIgnore` 3; live-verified 2026-10-22). Filtered records raise no error.
                 Summed across steps on a parent flow job; per step on a child job.
               examples:
                 - 0
@@ -8072,16 +8090,18 @@ components:
           description: |-
             Execution stage whose data to return. `apiCall` holds the request and response an HTTP
             export or import sent. On a job whose `logMode` is `debug`, an export's transform and
-            output filter record under `transformation` and `outputFilter`, an import's mapping and
-            response mapping under `mapping` and `responseMapping`, and a script hook's `options` and
+            output filter record under `transformation` and `outputFilter`, an import's filter (its
+            `filter` field) under `inputFilter`, an import's mapping and response mapping under
+            `mapping` and `responseMapping`, and a script hook's `options` and
             return value under its hook type plus `Hook` (`preSavePageHook`, `preMapHook`,
             `postMapHook`, `postSubmitHook`, `postResponseMapHook`), whatever the function is called;
             neither the bare hook name (`preMap`) nor `<functionName>Hook` returns them (live-verified
-            2026-10-20).
+            2026-10-20; `inputFilter` 2026-10-22).
           examples:
             - apiCall
             - transformation
             - outputFilter
+            - inputFilter
             - mapping
             - responseMapping
             - preSavePageHook
@@ -8114,8 +8134,11 @@ components:
 
         - `apiCall`: the request's method and URI and the response's status code. A job whose `logMode` is
           `detailed` or `debug` also records each side's headers and body; a `basic` job does not.
-        - `mapping`, `transformation`, `outputFilter`, `responseMapping`: a per-record entry carrying the
-          record's `recordId`, the stage's `input`, and its `output` (`outputFilter` has `success` instead).
+        - `mapping`, `transformation`, `outputFilter`, `inputFilter`, `responseMapping`: a per-record entry
+          carrying the record's `recordId`, the stage's `input`, and its `output`. The filter stages
+          (`outputFilter` for an export's output filter, `inputFilter` for an import's filter) have
+          `success` instead, `false` for a record the filter dropped (`inputFilter` live-verified
+          2026-10-22).
         - `preSavePageHook`, `preMapHook`, `postMapHook`, `postSubmitHook`: one entry for the record's whole
           group, with no `recordId`. `input` is a one-element array holding the `options` the hook received,
           and `output` holds what the hook returned.

package/dist/guardrail.yml

@@ -594,9 +594,9 @@ components:
         LLM configuration for an `ai_agent` guardrail — which provider and model evaluate each
         record, with instructions, parameter tuning, and output format. Guardrails never invoke
         tools, so unlike an AI agent import no block here accepts a `tools` array. MCP `prompts`
-        and `resources` are accepted on save, but an unreachable MCP server doesn't fail the
-        run (verified on OpenAI), so put the policy the guardrail must apply in its
-        instructions. Providers come in two families with two configuration formats:
+        and `resources` are accepted on save but never used at run time, so put the policy the
+        guardrail must apply in its instructions. Providers come in two families with two
+        configuration formats:
 
         - **Built-in providers** — each has its own configuration block.
           - **openai**: OpenAI models (GPT-4.1, GPT-5, etc.). Configure via the `openai` object.
@@ -761,7 +761,7 @@ components:
           type: array
           description: |-
             MCP prompt entries saved with a catalog-provider guardrail (generic flat format).
-            Each entry references one MCP connection and the prompt names allowed from it.
+            Each entry references one MCP connection and prompt names; a guardrail's run never fetches them.
           items:
             type: object
             properties:
@@ -782,7 +782,7 @@ components:
                     description: Connection to the MCP server that exposes the prompts.
                   allowedPrompts:
                     type: array
-                    description: Prompt names the model may fetch from the server.
+                    description: Prompt names saved with the entry; a guardrail's run never fetches them.
                     items:
                       type: string
           x-celigo-ai-guidance:
@@ -1039,7 +1039,7 @@ components:
               type: array
               description: |-
                 MCP prompt entries saved with the guardrail. Each item references one
-                MCP connection and the prompt names allowed from it.
+                MCP connection and prompt names; a guardrail's run never fetches them.
               items:
                 type: object
                 properties:
@@ -1061,7 +1061,7 @@ components:
                         description: Connection to the MCP server.
                       allowedPrompts:
                         type: array
-                        description: Prompt names to allow from the MCP server.
+                        description: Prompt names saved with the entry; a guardrail's run never fetches them.
                         items:
                           type: string
             resources:
@@ -1228,7 +1228,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Gemini guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -1250,7 +1250,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -1450,7 +1450,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Claude guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -1472,7 +1472,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -1544,10 +1544,9 @@ components:
           (`aiAgent.tools`, `aiAgent.openai.tools`, `aiAgent.litellm._overrides.gemini.tools`,
           `aiAgent.litellm._overrides.anthropic.tools`) fails the save with 422
           `guardrail_tools_not_allowed`. MCP `prompts` and `resources` are still accepted on
-          save, but don't rely on them for the check: with their MCP server unreachable, a
-          guardrail runs on its instructions and input alone, with no error, where an AI agent's
-          run fails (verified on OpenAI). Put the policy the guardrail must apply in its
-          instructions.
+          save, but a guardrail's run never uses them: it gives the model only its instructions
+          and input, whether the MCP server can be reached or not. Put the policy the guardrail
+          must apply in its instructions.
       properties:
         type:
           type: string
@@ -1941,8 +1940,10 @@ components:
             - A dot path from the record root (e.g. `email`, `address.city`), read from the
               incoming record. A path that matches no field writes nothing.
             - Handlebars template (contains `{{`) for concatenation /
-              formatting / conditional logic (e.g.
-              `{{record.firstName}} {{record.lastName}}`).
+              formatting / conditional logic (e.g. `{{firstName}} {{lastName}}`,
+              `{{#if mobile}}{{mobile}}{{else}}{{phone}}{{/if}}`). The template reads the
+              record's fields by bare name: `{{record.firstName}}` and `{{data.firstName}}`
+              render nothing, so the field is left out even when the record has the value.
 
             A `$.` JSONPath (the Mapper 2.0 `mappings` syntax) reads nothing here, and a bare
             string is read as a field path, not a constant: set constants in `hardCodedValue`.
@@ -1983,8 +1984,9 @@ components:
           x-celigo-ai-guidance:
             - |-
               When true, skip this field entirely when ``extract`` / lookup
-              produces empty / null. Without this flag the destination field
-              receives null and may overwrite existing data.
+              produces an empty string, null or nothing. Without this flag an
+              empty string is written as ``""`` and null as null, either of which
+              may overwrite existing data; a missing source is left out either way.
         immutable:
           type: boolean
           description: When true, the mapped value cannot be overwritten by later mapping steps.
@@ -2001,7 +2003,15 @@ components:
           type:
             - string
             - 'null'
-          description: Fallback value used when the extract yields no value.
+          description: |-
+            Fallback value written when the source value is an empty string, null or
+            missing. Without a default, an empty string and null are written as they are
+            and a missing field is left out.
+          x-celigo-ai-guidance:
+            - |-
+              Use ``default``, not ``hardCodedValue``, for a fallback on a field that is
+              sometimes empty: ``hardCodedValue`` is written on every record and replaces
+              the values that exist.
         extractDateFormat:
           type: string
           description: Date format of the source value, used to parse it before conversion.
@@ -2177,7 +2187,8 @@ components:
             mapping:
               type: object
               description: |-
-                Mapper 1.0 input mapping that selects the field evaluated as `text`.
+                Mapper 1.0 input mapping that selects what is evaluated: a field mapped
+                to `text`, or an object mapped to `record` (evaluated as its JSON).
                 Served only when populated — a guardrail created without one has no
                 `mapping` in responses, and evaluates the whole record (or the
                 record's own top-level `text` field, when it has one).
@@ -2353,7 +2364,8 @@ components:
             record field to the `text` input (e.g.
             `{"fields": [{"extract": "employeeSummary", "generate": "text"}]}`);
             only that field is evaluated, and fields outside it are neither
-            scanned nor masked. Optional — when omitted the whole record is
+            scanned nor masked. A mapping can also generate `record`, an object
+            evaluated as its JSON. Optional — when omitted the whole record is
             evaluated, serialized as JSON, unless the record has its own
             top-level `text` field, which is then evaluated alone. The server
             serves this field only when populated.
@@ -2362,10 +2374,13 @@ components:
               Send the input selection here as `mapping`, not as Mapper 2.0
               `mappings` rows. Map the field explicitly when records carry their
               own `text` field.
+            - |-
+              A guardrail keeps no conversation history, so a mapped
+              `conversationHistoryId` changes nothing.
           properties:
             fields:
               type: array
-              description: Field-level mapping entries; `generate` targets the guardrail input (typically `text`).
+              description: Field-level mapping entries; `generate` targets the guardrail input (`text`, or `record` for an object).
               items:
                 $ref: '#/components/schemas/MappingField'
             lists:

package/dist/httpconnector.yml

@@ -1300,15 +1300,30 @@ components:
                 - `"lessthan"`: Value is less than specified value (is less than)
                 - `"lessthanequals"`: Value is less than or equal to specified value (is less than or equals)
                 - `"startswith"`: String starts with specified prefix (starts with)
+                - `"notstartswith"`: String does not start with specified prefix (does not start with)
                 - `"endswith"`: String ends with specified suffix (ends with)
+                - `"notendswith"`: String does not end with specified suffix (does not end with)
                 - `"contains"`: String contains specified substring (contains)
                 - `"doesnotcontain"`: String does not contain specified substring (does not contain)
                 - `"empty"`: Field is missing or empty (is empty)
                 - `"notempty"`: Field contains a value (is not empty)
-                - `"matches"`: Matches a regular expression (matches)
+                - `"matches"`: Matches a regular expression, ignoring case (matches)
 
-                `isempty`, `isnotempty` and `anyof` are not operators: they are refused with 422
-                "Invalid operation: <name>".
+                Operator names are case-insensitive: `NOTEMPTY` and `endsWith` work and are stored
+                as sent. `isempty`, `isnotempty`, `anyof`, `notcontains`, `doesnotstartwith`,
+                `doesnotendwith`, `notmatches`, `doesnotmatch` and `notequal` are not operators:
+                they are refused with 422 "Invalid operation: <name>", with the name in lowercase,
+                both when the filter is saved and by `POST /v1/processors/filter`. To negate a
+                condition, wrap it in `not`.
+
+                The string comparisons (`equals`, `contains`, `startswith`, `endswith` and their
+                negations) are case-sensitive; wrap the field in `lowercase` to compare without case.
+                `matches` is not: every pattern is compiled with the flags `gi`, so `^paid$` also
+                matches `PAID` and `[a-z]` matches capital letters. An inline flag such as `(?i)`
+                makes the pattern invalid. The filter still saves, but in a run every record fails
+                with `FILTER_EVALUATION_FAILED` ("Invalid regular expression: /(?i)…/gi: Invalid
+                group"), and `POST /v1/processors/filter` refuses the call with 422 (live-verified
+                2026-10-22).
 
                 **Logical Operators**
                 - `"and"`: All conditions must be true

package/dist/httpconnectorresource.yml

@@ -746,15 +746,30 @@ components:
                 - `"lessthan"`: Value is less than specified value (is less than)
                 - `"lessthanequals"`: Value is less than or equal to specified value (is less than or equals)
                 - `"startswith"`: String starts with specified prefix (starts with)
+                - `"notstartswith"`: String does not start with specified prefix (does not start with)
                 - `"endswith"`: String ends with specified suffix (ends with)
+                - `"notendswith"`: String does not end with specified suffix (does not end with)
                 - `"contains"`: String contains specified substring (contains)
                 - `"doesnotcontain"`: String does not contain specified substring (does not contain)
                 - `"empty"`: Field is missing or empty (is empty)
                 - `"notempty"`: Field contains a value (is not empty)
-                - `"matches"`: Matches a regular expression (matches)
-
-                `isempty`, `isnotempty` and `anyof` are not operators: they are refused with 422
-                "Invalid operation: <name>".
+                - `"matches"`: Matches a regular expression, ignoring case (matches)
+
+                Operator names are case-insensitive: `NOTEMPTY` and `endsWith` work and are stored
+                as sent. `isempty`, `isnotempty`, `anyof`, `notcontains`, `doesnotstartwith`,
+                `doesnotendwith`, `notmatches`, `doesnotmatch` and `notequal` are not operators:
+                they are refused with 422 "Invalid operation: <name>", with the name in lowercase,
+                both when the filter is saved and by `POST /v1/processors/filter`. To negate a
+                condition, wrap it in `not`.
+
+                The string comparisons (`equals`, `contains`, `startswith`, `endswith` and their
+                negations) are case-sensitive; wrap the field in `lowercase` to compare without case.
+                `matches` is not: every pattern is compiled with the flags `gi`, so `^paid$` also
+                matches `PAID` and `[a-z]` matches capital letters. An inline flag such as `(?i)`
+                makes the pattern invalid. The filter still saves, but in a run every record fails
+                with `FILTER_EVALUATION_FAILED` ("Invalid regular expression: /(?i)…/gi: Invalid
+                group"), and `POST /v1/processors/filter` refuses the call with 422 (live-verified
+                2026-10-22).
 
                 **Logical Operators**
                 - `"and"`: All conditions must be true