@celigo/api-specs 0.2.204 → 0.2.205

package/dist/connection.yml

@@ -1185,7 +1185,9 @@ paths:
         - |-
           Soft-deletes the connection into the recycle bin (restorable for 30 days). Check
           `GET /v1/connections/{_id}/dependencies` first — a connection still referenced by flows,
-          exports, imports, or a borrowing connection is rejected with 422.
+          exports, imports, a borrowing connection, or MCP servers (a tool override, or a
+          `connections[]` entry that requires end-user credentials) is rejected with 422
+          `dependencies_not_deleted`.
   /v1/connections/{_id}/ping:
     get:
       x-internal: false

package/dist/mcp-server.yml

@@ -20,7 +20,7 @@ info:
       - Carries **permission sets** ("Capability Sets" in the UI) — named bundles of its tools, APIs, prompts, and resources granted to end users via `pset:<_id>` capability strings on end-user, group, and role resource grants
       - Carries optional **traffic limits** (`policies[]`) — a server-level rate limit, a per-user rate limit for OAuth end users, and a usage quota — enforced before a tool runs; a rejected call gets HTTP 429 with `Retry-After`
       - Can proxy **upstream MCP servers** (`upstreamMcpConnections[]`, attached through `mcp`-type connections) and whitelist which of their tools, prompts, and resources it exposes
-      - Lists the **connections** its tools run through (`connections[]`) and flags the ones each end user must supply their own credentials for (`requiresEndUserCredentials`)
+      - Lists the **connections** each end user must supply their own credentials for (`connections[]`); only entries with `requiresEndUserCredentials: true` are kept
       - Can be pinned to a **network policy** (`_networkPolicyId`) that restricts which IP ranges may reach it
 servers:
   - url: https://api.integrator.io
@@ -2468,17 +2468,23 @@ components:
     ServerConnection:
       type: object
       description: |-
-        One connection the server's tools use, with the flag that decides whether
-        each end user must supply their own credentials for it. Connections named
-        here and in `tools[].overrides.connections[]` together form the set that
-        `GET /v1/mcpservers/{_id}/connections` lists.
+        One connection each end user must supply their own credentials for.
+        Connections named here and in `tools[].overrides.connections[]`
+        together form the set that `GET /v1/mcpservers/{_id}/connections` lists.
       x-celigo-ai-guidance:
         - |-
           Reference a live connection owned by this account: an unknown id fails
           with 422 "resource_not_found" and the same connection listed twice with
-          422 "resource_invalid".
+          422 "resource_invalid" — even on an entry sent with the flag false, which
+          is then dropped.
+        - |-
+          A stored entry makes the connection a dependency of the server:
+          DELETE /v1/connections/{_id} fails with 422 "dependencies_not_deleted"
+          ("mcpserver <id> must be deleted before you can delete connection <id>")
+          until a PUT removes the entry or clears its flag.
       required:
         - _connectionId
+        - requiresEndUserCredentials
       properties:
         _connectionId:
           type: string
@@ -2493,14 +2499,15 @@ components:
             - 6ab1ebb94db5688fd8c7189f
         requiresEndUserCredentials:
           type: boolean
-          default: false
           description: |-
             When true, each end user must supply their own values for the fields
             the connection's `endUserProvidedFields` names (through the MCP setup
             page) before calling tools that use it; those values are stored as a
-            per-user `mcpChild` connection. The platform contract is that clearing
-            the flag, or dropping the connection from every server that set it,
-            invalidates the end users' `mcpChild` connections for it.
+            per-user `mcpChild` connection. Only `true` is stored — an entry sent
+            with `false` is dropped on save, so clearing the flag removes the
+            entry. The platform contract is that clearing the flag, or dropping
+            the connection from every server that set it, invalidates the end
+            users' `mcpChild` connections for it.
           examples:
             - true
     Annotations:
@@ -3716,6 +3723,20 @@ components:
           description: |-
             Connection of type `mcp` that holds the upstream server URL and
             credentials. Each connection can be attached to a server once.
+            When the upstream server rejects a proxied `tools/call`, `prompts/get`,
+            or `resources/read`, the MCP client gets a JSON-RPC error with HTTP
+            status 200: -32008 `Upstream server denied access` for an upstream 403,
+            -32004 `Upstream rate limit exceeded` for a 429, and for a 401 either
+            -32007 `Upstream connection requires re-authorization` or -32603. A
+            `token` or `custom` connection answers -32007. An `oauth` connection
+            first refreshes its token and retries once: -32007 when the connection
+            can't be refreshed (for example, it holds no refresh token), when the
+            token endpoint rejects the grant (for example, with 400), or when the
+            retry is still 401; -32603 when the refresh fails any other way, such
+            as the token endpoint answering 5xx. -32007, -32008, and -32004 carry
+            this id in
+            `error.data._connectionId`; -32603, which an upstream 5xx also answers,
+            carries no `error.data`.
           examples:
             - 6a6655fce52f3c30d0a53926
         alias:
@@ -4140,13 +4161,17 @@ components:
             - Order Processing Server
         relativeURI:
           type: string
-          maxLength: 131072
+          maxLength: 128
           pattern: ^\/[a-zA-Z0-9_\-]+$
           description: |-
             URI path segment for the MCP server endpoint. Must be unique per account —
             duplicates are rejected with 422 `mcp_server_duplicate_relative_uri`. Only letters,
             numbers, dashes, and underscores after the leading slash (the server's error message
-            also claims colons and dots are allowed, but they are rejected in practice). Creation
+            also claims colons and dots are allowed, but they are rejected in practice). The
+            length limit counts the leading slash; a longer value is rejected with 422
+            `mcp_server_relative_uri_too_long`. `/registry`, `/oidc`, and `/portal`, in any letter
+            case, are reserved for platform endpoints under the account alias and are rejected
+            with 422 `mcp_server_reserved_relative_uri`. PUT applies both checks too. Creation
             also requires the account to have an account alias set (422
             `mcp_server_account_alias_required` otherwise).
           x-celigo-ai-guidance:
@@ -4188,11 +4213,19 @@ components:
         connections:
           type: array
           description: |-
-            Connections the server's tools run through, each flagged for whether
-            end users must supply their own credentials. Always returned — an
-            empty array when none is listed — and cleared when omitted on PUT.
-            Together with `tools[].overrides.connections[]` this is the set
+            Connections each end user must supply their own credentials for. Only
+            entries with `requiresEndUserCredentials: true` are kept — any other
+            entry is validated, then dropped on save. Always returned (an empty
+            array when none is listed) and cleared when omitted on PUT; together
+            with `tools[].overrides.connections[]` it forms the set
             `GET /v1/mcpservers/{_id}/connections` reports.
+          x-celigo-ai-guidance:
+            - |-
+              List a connection here only to make each end user supply their own credentials
+              for it, with requiresEndUserCredentials set to true. A connection the tools run on
+              the account's own credentials needs no entry: an entry sent with the flag false
+              still gets 201/200, but it is absent from the response and from every later
+              GET — do not resend it.
           items:
             $ref: '#/components/schemas/ServerConnection'
         tools:
@@ -11196,7 +11229,13 @@ components:
           type:
             - string
             - 'null'
-          description: Category of the failure. Null when the request succeeded or was blocked.
+          description: |-
+            Category of the failure. Null when the request succeeded or was blocked.
+            For a proxied request, `authentication` when the upstream connection needs
+            re-authorization (JSON-RPC -32007) or the upstream server denied access
+            (-32008), `rateLimit` when it answered HTTP 429 (-32004), `upstreamError`
+            for another upstream failure such as a 5xx (-32603), and `internal` when an
+            `oauth` connection's token refresh failed (-32603).
           examples:
             - null
         traceId:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.204",
+  "version": "0.2.205",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "bbd50898",
+		"iasCommit": "c89a0221",
 		"generatedAt": "2026-10-28"
 	},
 	"roots": {
@@ -8332,7 +8332,8 @@
 				"requiresEndUserCredentials": 8
 			},
 			"r": [
-				"_connectionId"
+				"_connectionId",
+				"requiresEndUserCredentials"
 			]
 		},
 		{