@celigo/api-specs 0.2.186 → 0.2.187

package/dist/api.yml

@@ -8017,7 +8017,23 @@ components:
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
             Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
             a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
-            Must belong to the same account as the connection. Omit for every other auth type.
+            Must belong to the same account as the connection — or be the iClient Celigo publishes
+            with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
+            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
+            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
+            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            is: `public` rides Celigo's published Shopify app (installed from the Shopify App
+            Store), `custom` rides the account's own iClient — the Shopify app the customer created
+            in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
+            connection with no `settings.appType` (saved before the App type existed) rides the
+            published app when its `_iClientId` is the connector's published iClient — the form
+            opens it with no App type selected and it keeps working — and an account-owned iClient
+            otherwise. A saved Public App connection, with or without a stored `settings.appType`,
+            moves to the customer's app by the same re-save: `settings.appType` `custom`, its own
+            `_iClientId` and scopes, then authorizing; the connection form does not offer the
+            reverse, because the Public App flow is authorized from the Shopify App Store and
+            creates a new connection. Integration App connections (`_connectorId`) stay on Celigo's
+            published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
           x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
@@ -8038,7 +8054,20 @@ components:
             - |-
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
-              same user."
+              same user." The one exception is the iClient a pre-built OAuth HTTP connector
+              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
+              connection saves with that id from the connecting account even though
+              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
+              connection on this rule.
+            - |-
+              On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
+              form does — `public` with the connector's published iClient, `custom` with an
+              account-owned iClient: the API saves either value of `settings.appType` beside either
+              iClient (and any other string under `settings.appType`) — nothing server-side checks
+              the pair, so the form's rule is the only guard. On an update never drop `_iClientId` from
+              an `auth.type` `oauth` connection: 422 invalid_field_update "Removing _iClientId is
+              not allowed for oauth connections due to security reasons." — switch it to another
+              iClient instead.
         _httpConnectorId:
           type: string
           format: objectId

package/dist/connection.yml

@@ -6636,7 +6636,23 @@ components:
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
             Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
             a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
-            Must belong to the same account as the connection. Omit for every other auth type.
+            Must belong to the same account as the connection — or be the iClient Celigo publishes
+            with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
+            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
+            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
+            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            is: `public` rides Celigo's published Shopify app (installed from the Shopify App
+            Store), `custom` rides the account's own iClient — the Shopify app the customer created
+            in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
+            connection with no `settings.appType` (saved before the App type existed) rides the
+            published app when its `_iClientId` is the connector's published iClient — the form
+            opens it with no App type selected and it keeps working — and an account-owned iClient
+            otherwise. A saved Public App connection, with or without a stored `settings.appType`,
+            moves to the customer's app by the same re-save: `settings.appType` `custom`, its own
+            `_iClientId` and scopes, then authorizing; the connection form does not offer the
+            reverse, because the Public App flow is authorized from the Shopify App Store and
+            creates a new connection. Integration App connections (`_connectorId`) stay on Celigo's
+            published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
           x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
@@ -6657,7 +6673,20 @@ components:
             - |-
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
-              same user."
+              same user." The one exception is the iClient a pre-built OAuth HTTP connector
+              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
+              connection saves with that id from the connecting account even though
+              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
+              connection on this rule.
+            - |-
+              On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
+              form does — `public` with the connector's published iClient, `custom` with an
+              account-owned iClient: the API saves either value of `settings.appType` beside either
+              iClient (and any other string under `settings.appType`) — nothing server-side checks
+              the pair, so the form's rule is the only guard. On an update never drop `_iClientId` from
+              an `auth.type` `oauth` connection: 422 invalid_field_update "Removing _iClientId is
+              not allowed for oauth connections due to security reasons." — switch it to another
+              iClient instead.
         _httpConnectorId:
           type: string
           format: objectId

package/dist/enduser.yml

@@ -4687,7 +4687,23 @@ components:
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
             Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
             a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
-            Must belong to the same account as the connection. Omit for every other auth type.
+            Must belong to the same account as the connection — or be the iClient Celigo publishes
+            with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
+            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
+            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
+            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            is: `public` rides Celigo's published Shopify app (installed from the Shopify App
+            Store), `custom` rides the account's own iClient — the Shopify app the customer created
+            in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
+            connection with no `settings.appType` (saved before the App type existed) rides the
+            published app when its `_iClientId` is the connector's published iClient — the form
+            opens it with no App type selected and it keeps working — and an account-owned iClient
+            otherwise. A saved Public App connection, with or without a stored `settings.appType`,
+            moves to the customer's app by the same re-save: `settings.appType` `custom`, its own
+            `_iClientId` and scopes, then authorizing; the connection form does not offer the
+            reverse, because the Public App flow is authorized from the Shopify App Store and
+            creates a new connection. Integration App connections (`_connectorId`) stay on Celigo's
+            published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
           x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
@@ -4708,7 +4724,20 @@ components:
             - |-
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
-              same user."
+              same user." The one exception is the iClient a pre-built OAuth HTTP connector
+              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
+              connection saves with that id from the connecting account even though
+              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
+              connection on this rule.
+            - |-
+              On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
+              form does — `public` with the connector's published iClient, `custom` with an
+              account-owned iClient: the API saves either value of `settings.appType` beside either
+              iClient (and any other string under `settings.appType`) — nothing server-side checks
+              the pair, so the form's rule is the only guard. On an update never drop `_iClientId` from
+              an `auth.type` `oauth` connection: 422 invalid_field_update "Removing _iClientId is
+              not allowed for oauth connections due to security reasons." — switch it to another
+              iClient instead.
         _httpConnectorId:
           type: string
           format: objectId

package/dist/iclient.yml

@@ -595,6 +595,14 @@ components:
           type: string
           description: Authentication provider that determines which credential fields apply.
           x-celigo-ai-guidance:
+            - |-
+              An OAuth app the customer registers for a pre-built HTTP connector — a Shopify Custom
+              App created in the Shopify dev dashboard, for example — is a `custom_oauth2` iClient
+              with `_httpConnectorId` (and `_httpConnectorApiId`) pointing at that connector: the
+              shape the connection form's iClient editor saves, and the one its OAuth iClient picker
+              lists (subForms/httpOAuth.js filters on provider custom_oauth2). The API also accepts a
+              connector-named provider such as `shopify` on an account-created iClient, but the form
+              never saves one, so prefer `custom_oauth2`.
             - |-
               ## IMPORTANT NOTES:
               - This is not a human/vendor label — it is the provider key that selects an authentication method.

package/dist/mcp-server.yml

@@ -6523,7 +6523,23 @@ components:
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
             Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
             a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
-            Must belong to the same account as the connection. Omit for every other auth type.
+            Must belong to the same account as the connection — or be the iClient Celigo publishes
+            with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
+            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
+            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
+            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            is: `public` rides Celigo's published Shopify app (installed from the Shopify App
+            Store), `custom` rides the account's own iClient — the Shopify app the customer created
+            in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
+            connection with no `settings.appType` (saved before the App type existed) rides the
+            published app when its `_iClientId` is the connector's published iClient — the form
+            opens it with no App type selected and it keeps working — and an account-owned iClient
+            otherwise. A saved Public App connection, with or without a stored `settings.appType`,
+            moves to the customer's app by the same re-save: `settings.appType` `custom`, its own
+            `_iClientId` and scopes, then authorizing; the connection form does not offer the
+            reverse, because the Public App flow is authorized from the Shopify App Store and
+            creates a new connection. Integration App connections (`_connectorId`) stay on Celigo's
+            published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
           x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
@@ -6544,7 +6560,20 @@ components:
             - |-
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
-              same user."
+              same user." The one exception is the iClient a pre-built OAuth HTTP connector
+              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
+              connection saves with that id from the connecting account even though
+              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
+              connection on this rule.
+            - |-
+              On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
+              form does — `public` with the connector's published iClient, `custom` with an
+              account-owned iClient: the API saves either value of `settings.appType` beside either
+              iClient (and any other string under `settings.appType`) — nothing server-side checks
+              the pair, so the form's rule is the only guard. On an update never drop `_iClientId` from
+              an `auth.type` `oauth` connection: 422 invalid_field_update "Removing _iClientId is
+              not allowed for oauth connections due to security reasons." — switch it to another
+              iClient instead.
         _httpConnectorId:
           type: string
           format: objectId

package/dist/tool.yml

@@ -10057,7 +10057,23 @@ components:
             `auth.type` `oauth` (including the `azureserviceprincipal` service principal an Azure
             Data Lake Storage Gen2 connection authenticates with and the `googleserviceaccount` key
             a Google Cloud Storage connection uses), or the `awsIam` role for `auth.type` `awsiam`.
-            Must belong to the same account as the connection. Omit for every other auth type.
+            Must belong to the same account as the connection — or be the iClient Celigo publishes
+            with a pre-built OAuth HTTP connector (pre-configured by the connector; from the
+            connecting account `GET /v1/iclients/{_id}` on it is 404 resource_not_found and
+            `GET /v1/iclients` does not list it, yet the connection saves with it). Omit for every
+            other auth type. On a Shopify connection `settings.appType` says which of the two it
+            is: `public` rides Celigo's published Shopify app (installed from the Shopify App
+            Store), `custom` rides the account's own iClient — the Shopify app the customer created
+            in the Shopify dev dashboard — with `auth.oauth.scope` chosen on the connection. A
+            connection with no `settings.appType` (saved before the App type existed) rides the
+            published app when its `_iClientId` is the connector's published iClient — the form
+            opens it with no App type selected and it keeps working — and an account-owned iClient
+            otherwise. A saved Public App connection, with or without a stored `settings.appType`,
+            moves to the customer's app by the same re-save: `settings.appType` `custom`, its own
+            `_iClientId` and scopes, then authorizing; the connection form does not offer the
+            reverse, because the Public App flow is authorized from the Shopify App Store and
+            creates a new connection. Integration App connections (`_connectorId`) stay on Celigo's
+            published app and carry no `settings.appType`.
           examples:
             - 6203a7e4f321d800129a1b8e
           x-celigo-ui-override: 'Required by the connection form for oauth (subForms/httpOAuth.js: required true, iClient filter provider custom_oauth2, or googleserviceaccount / azureserviceprincipal for the GCS and ADLS Gen2 variants) and for awsIam (subForms/httpAwsIam.js: required true, filter provider awsIam). For oauth the API creates the connection without it and the authorization is completed afterward; for awsiam the API also rejects its absence (see the if/then rule on this schema).'
@@ -10078,7 +10094,20 @@ components:
             - |-
               The iClient must belong to the same account as the connection — an iClient id from
               another account fails with 422 invalid_ref "The referenced IClient must belong to the
-              same user."
+              same user." The one exception is the iClient a pre-built OAuth HTTP connector
+              pre-configures (Celigo's published app — the Shopify Public App's, for one): the
+              connection saves with that id from the connecting account even though
+              `GET /v1/iclients/{_id}` on it is 404 there, so do not refuse a `public` Shopify
+              connection on this rule.
+            - |-
+              On a Shopify connection keep `settings.appType` and `_iClientId` in step the way the
+              form does — `public` with the connector's published iClient, `custom` with an
+              account-owned iClient: the API saves either value of `settings.appType` beside either
+              iClient (and any other string under `settings.appType`) — nothing server-side checks
+              the pair, so the form's rule is the only guard. On an update never drop `_iClientId` from
+              an `auth.type` `oauth` connection: 422 invalid_field_update "Removing _iClientId is
+              not allowed for oauth connections due to security reasons." — switch it to another
+              iClient instead.
         _httpConnectorId:
           type: string
           format: objectId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.186",
+  "version": "0.2.187",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "5527b75e",
+		"iasCommit": "a032b028",
 		"generatedAt": "2026-10-23"
 	},
 	"roots": {