@celigo/api-specs 0.2.232 → 0.2.233

package/dist/api.yml

@@ -8720,8 +8720,9 @@ components:
           description: |
             NetSuite TBA token ID (encrypted at rest). Required when authType is "token".
 
-            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the
-            integrator.io application and the user and role the connection should act as.
+            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the Application
+            the connection signs its requests with — `integrator.io` unless `_iClientId` names another
+            integration record — and the user and role the connection should act as.
             Must be paired with the corresponding tokenSecret.
           x-celigo-ai-guidance:
             - Not needed when authType is "token-auto" — integrator.io manages the token wiring in that mode.
@@ -8730,6 +8731,11 @@ components:
               (HTTP 200, `errors[].code`, source `application`) and the save sets the connection offline;
               the response carries no detail of what NetSuite refused — that detail is in NetSuite's
               Login Audit Trail (the Detail column), not in the connection's error.
+            - |-
+              A token created for a different Application than the one the connection signs with is
+              refused the same way, so when a freshly created token is refused, which Application it
+              was created for is the first question; a missing iClient is not the cause on a connection
+              that has none — it signs with Celigo's `integrator.io` record.
           writeOnly: true
         tokenSecret:
           type: string
@@ -8748,7 +8754,11 @@ components:
           type: string
           examples:
             - '1234'
-          description: NetSuite entity/user ID associated with the token.
+          description: |-
+            NetSuite internal id of the user (entity) whose access token the connection logs in
+            with. On a token-authenticated connection the platform records it from the token
+            NetSuite accepted, together with `roleId` and `roleName`; a value that still names the
+            previous token's user after a refused login is the symptom of the refusal, not its cause.
         tokenName:
           type: string
           examples:
@@ -8758,11 +8768,19 @@ components:
           type: string
           examples:
             - '3'
-          description: |
-            NetSuite role ID that determines the permissions for this connection.
-
-            The role controls which records, fields, and operations are accessible.
-            Must match the role associated with the access token in NetSuite.
+          description: |-
+            NetSuite internal id of the role the connection's access token logs in as — the role
+            selected when the token was created (`token`) or chosen on NetSuite's consent page during
+            Save & authorize (`token-auto`). The platform records it from the token NetSuite accepted,
+            together with `roleName` and `entityId`; the connection form has no role field for token
+            authentication, and a value that still names the previous token's role after a refused
+            login is the symptom of the refusal, not its cause.
+          x-celigo-ai-guidance:
+            - |-
+              On a token-authenticated connection a value sent on create or update is stored but has no
+              effect on the login — NetSuite applies the role bound to the token — and is replaced from
+              the token at the next successful login; never write it to "match" a new token or offer
+              to. The token is the change.
         requestLevelCredentials:
           type: boolean
           default: false
@@ -8805,7 +8823,9 @@ components:
           type: string
           examples:
             - Administrator
-          description: Human-readable name of the NetSuite role (display purposes only).
+          description: |-
+            Display name of the role in `roleId`, recorded with it from the token NetSuite accepted
+            (display purposes only).
         wsdlVersion:
           type: string
           examples:
@@ -8883,7 +8903,13 @@ components:
           x-celigo-refModel: iclients
           examples:
             - 66a1b2c3d4e5f60718293a4b
-          description: ID of the iClient used for token-based authentication.
+          description: |-
+            iClient holding the consumer key and secret of the NetSuite integration record the
+            connection signs its requests with, when that record is not Celigo's own — an Integration
+            App's record (set by the app's install) or the account's own; access tokens are then created
+            for that record's Application. Absent on a standalone connection, which signs with Celigo's
+            `integrator.io` record (no client ID or secret is entered anywhere) and whose access tokens
+            must be created for Application `integrator.io`.
     Salesforce:
       type: object
       description: |-

package/dist/connection.yml

@@ -4532,8 +4532,9 @@ components:
           description: |
             NetSuite TBA token ID (encrypted at rest). Required when authType is "token".
 
-            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the
-            integrator.io application and the user and role the connection should act as.
+            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the Application
+            the connection signs its requests with — `integrator.io` unless `_iClientId` names another
+            integration record — and the user and role the connection should act as.
             Must be paired with the corresponding tokenSecret.
           x-celigo-ai-guidance:
             - Not needed when authType is "token-auto" — integrator.io manages the token wiring in that mode.
@@ -4542,6 +4543,11 @@ components:
               (HTTP 200, `errors[].code`, source `application`) and the save sets the connection offline;
               the response carries no detail of what NetSuite refused — that detail is in NetSuite's
               Login Audit Trail (the Detail column), not in the connection's error.
+            - |-
+              A token created for a different Application than the one the connection signs with is
+              refused the same way, so when a freshly created token is refused, which Application it
+              was created for is the first question; a missing iClient is not the cause on a connection
+              that has none — it signs with Celigo's `integrator.io` record.
           writeOnly: true
         tokenSecret:
           type: string
@@ -4560,7 +4566,11 @@ components:
           type: string
           examples:
             - '1234'
-          description: NetSuite entity/user ID associated with the token.
+          description: |-
+            NetSuite internal id of the user (entity) whose access token the connection logs in
+            with. On a token-authenticated connection the platform records it from the token
+            NetSuite accepted, together with `roleId` and `roleName`; a value that still names the
+            previous token's user after a refused login is the symptom of the refusal, not its cause.
         tokenName:
           type: string
           examples:
@@ -4570,11 +4580,19 @@ components:
           type: string
           examples:
             - '3'
-          description: |
-            NetSuite role ID that determines the permissions for this connection.
-
-            The role controls which records, fields, and operations are accessible.
-            Must match the role associated with the access token in NetSuite.
+          description: |-
+            NetSuite internal id of the role the connection's access token logs in as — the role
+            selected when the token was created (`token`) or chosen on NetSuite's consent page during
+            Save & authorize (`token-auto`). The platform records it from the token NetSuite accepted,
+            together with `roleName` and `entityId`; the connection form has no role field for token
+            authentication, and a value that still names the previous token's role after a refused
+            login is the symptom of the refusal, not its cause.
+          x-celigo-ai-guidance:
+            - |-
+              On a token-authenticated connection a value sent on create or update is stored but has no
+              effect on the login — NetSuite applies the role bound to the token — and is replaced from
+              the token at the next successful login; never write it to "match" a new token or offer
+              to. The token is the change.
         requestLevelCredentials:
           type: boolean
           default: false
@@ -4617,7 +4635,9 @@ components:
           type: string
           examples:
             - Administrator
-          description: Human-readable name of the NetSuite role (display purposes only).
+          description: |-
+            Display name of the role in `roleId`, recorded with it from the token NetSuite accepted
+            (display purposes only).
         wsdlVersion:
           type: string
           examples:
@@ -4695,7 +4715,13 @@ components:
           x-celigo-refModel: iclients
           examples:
             - 66a1b2c3d4e5f60718293a4b
-          description: ID of the iClient used for token-based authentication.
+          description: |-
+            iClient holding the consumer key and secret of the NetSuite integration record the
+            connection signs its requests with, when that record is not Celigo's own — an Integration
+            App's record (set by the app's install) or the account's own; access tokens are then created
+            for that record's Application. Absent on a standalone connection, which signs with Celigo's
+            `integrator.io` record (no client ID or secret is entered anywhere) and whose access tokens
+            must be created for Application `integrator.io`.
     Salesforce:
       type: object
       description: |-

package/dist/enduser.yml

@@ -2557,8 +2557,9 @@ components:
           description: |
             NetSuite TBA token ID (encrypted at rest). Required when authType is "token".
 
-            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the
-            integrator.io application and the user and role the connection should act as.
+            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the Application
+            the connection signs its requests with — `integrator.io` unless `_iClientId` names another
+            integration record — and the user and role the connection should act as.
             Must be paired with the corresponding tokenSecret.
           x-celigo-ai-guidance:
             - Not needed when authType is "token-auto" — integrator.io manages the token wiring in that mode.
@@ -2567,6 +2568,11 @@ components:
               (HTTP 200, `errors[].code`, source `application`) and the save sets the connection offline;
               the response carries no detail of what NetSuite refused — that detail is in NetSuite's
               Login Audit Trail (the Detail column), not in the connection's error.
+            - |-
+              A token created for a different Application than the one the connection signs with is
+              refused the same way, so when a freshly created token is refused, which Application it
+              was created for is the first question; a missing iClient is not the cause on a connection
+              that has none — it signs with Celigo's `integrator.io` record.
           writeOnly: true
         tokenSecret:
           type: string
@@ -2585,7 +2591,11 @@ components:
           type: string
           examples:
             - '1234'
-          description: NetSuite entity/user ID associated with the token.
+          description: |-
+            NetSuite internal id of the user (entity) whose access token the connection logs in
+            with. On a token-authenticated connection the platform records it from the token
+            NetSuite accepted, together with `roleId` and `roleName`; a value that still names the
+            previous token's user after a refused login is the symptom of the refusal, not its cause.
         tokenName:
           type: string
           examples:
@@ -2595,11 +2605,19 @@ components:
           type: string
           examples:
             - '3'
-          description: |
-            NetSuite role ID that determines the permissions for this connection.
-
-            The role controls which records, fields, and operations are accessible.
-            Must match the role associated with the access token in NetSuite.
+          description: |-
+            NetSuite internal id of the role the connection's access token logs in as — the role
+            selected when the token was created (`token`) or chosen on NetSuite's consent page during
+            Save & authorize (`token-auto`). The platform records it from the token NetSuite accepted,
+            together with `roleName` and `entityId`; the connection form has no role field for token
+            authentication, and a value that still names the previous token's role after a refused
+            login is the symptom of the refusal, not its cause.
+          x-celigo-ai-guidance:
+            - |-
+              On a token-authenticated connection a value sent on create or update is stored but has no
+              effect on the login — NetSuite applies the role bound to the token — and is replaced from
+              the token at the next successful login; never write it to "match" a new token or offer
+              to. The token is the change.
         requestLevelCredentials:
           type: boolean
           default: false
@@ -2642,7 +2660,9 @@ components:
           type: string
           examples:
             - Administrator
-          description: Human-readable name of the NetSuite role (display purposes only).
+          description: |-
+            Display name of the role in `roleId`, recorded with it from the token NetSuite accepted
+            (display purposes only).
         wsdlVersion:
           type: string
           examples:
@@ -2720,7 +2740,13 @@ components:
           x-celigo-refModel: iclients
           examples:
             - 66a1b2c3d4e5f60718293a4b
-          description: ID of the iClient used for token-based authentication.
+          description: |-
+            iClient holding the consumer key and secret of the NetSuite integration record the
+            connection signs its requests with, when that record is not Celigo's own — an Integration
+            App's record (set by the app's install) or the account's own; access tokens are then created
+            for that record's Application. Absent on a standalone connection, which signs with Celigo's
+            `integrator.io` record (no client ID or secret is entered anywhere) and whose access tokens
+            must be created for Application `integrator.io`.
     Salesforce:
       type: object
       description: |-

package/dist/iclient.yml

@@ -3005,59 +3005,18 @@ components:
                   and can be referenced by resources within integrator.io through the iClient.
         netsuite:
           type: object
-          description: NetSuite token-based authentication credentials.
+          description: |-
+            Consumer key and consumer secret of a NetSuite integration record, for a connection that
+            signs its requests as that record rather than as Celigo's own `integrator.io` record — an
+            Integration App's record (its install creates the iClient) or one the account created. A
+            standalone NetSuite connection references no iClient; its access tokens are created for
+            Application `integrator.io`.
           x-celigo-ai-guidance:
             - |-
-              Configuration settings and credentials required to integrate with the NetSuite platform,
-              enabling seamless data synchronization and interaction with NetSuite's ERP and CRM services.
-              This property typically includes authentication details, API endpoints,
-              and any necessary parameters for establishing a secure connection.
-            - |-
-              ## IMPORTANT NOTES:
-              - Incorrect or outdated credentials will prevent successful integration.
-              - NetSuite API limits and governance should be considered to avoid throttling.
-              - Regularly review and rotate credentials to maintain security.
-              - Integration may require specific permissions within NetSuite roles.
-            - |-
-              ## IMPLEMENTATION GUIDANCE:
-              - Ensure sensitive credentials are stored securely and encrypted.
-              - Validate all required fields before attempting connection to NetSuite.
-              - Support environment-specific configurations (e.g., sandbox vs. production).
-              - Handle error responses gracefully to maintain integration stability.
-              - Keep the configuration up to date with NetSuite API version changes.
-            - |-
-              ## TECHNICAL DETAILS:
-              - Typically includes OAuth 1.0a or token-based authentication parameters.
-              - May require JSON or XML formatted configuration data.
-              - Supports both REST and SOAP API protocols depending on use case.
-              - Configuration format should align with NetSuite's API specification requirements.
-            - |-
-              ## FIELD BEHAVIOR:
-              - Holds all necessary information to authenticate and communicate with NetSuite APIs.
-              - Used to configure integration settings such as account ID, role, and environment.
-              - Enables data exchange between the application and NetSuite for operations like record creation, updates, and queries.
-              - May support multiple authentication methods, including token-based and OAuth.
-            - |-
-              ## EXAMPLES:
-              - API credentials including consumer key, consumer secret, token ID, and token secret.
-              - Account ID and role ID for specifying the NetSuite account and user role.
-              - URLs for NetSuite REST or SOAP API endpoints.
-              - Flags or settings indicating sandbox or production environment.
-            - |-
-              ## DEPENDENCY CHAIN:
-              - Dependent on secure storage mechanisms for credentials.
-              - Relies on network connectivity to NetSuite services.
-              - May depend on other configuration properties like logging or retry policies.
-            - |-
-              Configuration settings and credentials required to integrate with the NetSuite platform,
-              enabling seamless data synchronization and interaction with NetSuite's ERP and CRM services.
-              This property typically includes authentication details, API endpoints,
-              and any necessary parameters for establishing a secure connection.
-            - |-
-              Configuration settings and credentials required to integrate with the NetSuite platform,
-              enabling seamless data synchronization and interaction with NetSuite's ERP and CRM services.
-              This property typically includes authentication details, API endpoints,
-              and any necessary parameters for establishing a secure connection.
+              A connection that references a NetSuite iClient needs access tokens created for that
+              record's Application; a connection without one needs tokens created for `integrator.io`.
+              A missing iClient is not why a connection that has none is refused with
+              `invalid_login_attempt`.
           properties:
             consumerKey:
               type: string

package/dist/mcp-server.yml

@@ -5605,8 +5605,9 @@ components:
           description: |
             NetSuite TBA token ID (encrypted at rest). Required when authType is "token".
 
-            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the
-            integrator.io application and the user and role the connection should act as.
+            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the Application
+            the connection signs its requests with — `integrator.io` unless `_iClientId` names another
+            integration record — and the user and role the connection should act as.
             Must be paired with the corresponding tokenSecret.
           x-celigo-ai-guidance:
             - Not needed when authType is "token-auto" — integrator.io manages the token wiring in that mode.
@@ -5615,6 +5616,11 @@ components:
               (HTTP 200, `errors[].code`, source `application`) and the save sets the connection offline;
               the response carries no detail of what NetSuite refused — that detail is in NetSuite's
               Login Audit Trail (the Detail column), not in the connection's error.
+            - |-
+              A token created for a different Application than the one the connection signs with is
+              refused the same way, so when a freshly created token is refused, which Application it
+              was created for is the first question; a missing iClient is not the cause on a connection
+              that has none — it signs with Celigo's `integrator.io` record.
           writeOnly: true
         tokenSecret:
           type: string
@@ -5633,7 +5639,11 @@ components:
           type: string
           examples:
             - '1234'
-          description: NetSuite entity/user ID associated with the token.
+          description: |-
+            NetSuite internal id of the user (entity) whose access token the connection logs in
+            with. On a token-authenticated connection the platform records it from the token
+            NetSuite accepted, together with `roleId` and `roleName`; a value that still names the
+            previous token's user after a refused login is the symptom of the refusal, not its cause.
         tokenName:
           type: string
           examples:
@@ -5643,11 +5653,19 @@ components:
           type: string
           examples:
             - '3'
-          description: |
-            NetSuite role ID that determines the permissions for this connection.
-
-            The role controls which records, fields, and operations are accessible.
-            Must match the role associated with the access token in NetSuite.
+          description: |-
+            NetSuite internal id of the role the connection's access token logs in as — the role
+            selected when the token was created (`token`) or chosen on NetSuite's consent page during
+            Save & authorize (`token-auto`). The platform records it from the token NetSuite accepted,
+            together with `roleName` and `entityId`; the connection form has no role field for token
+            authentication, and a value that still names the previous token's role after a refused
+            login is the symptom of the refusal, not its cause.
+          x-celigo-ai-guidance:
+            - |-
+              On a token-authenticated connection a value sent on create or update is stored but has no
+              effect on the login — NetSuite applies the role bound to the token — and is replaced from
+              the token at the next successful login; never write it to "match" a new token or offer
+              to. The token is the change.
         requestLevelCredentials:
           type: boolean
           default: false
@@ -5690,7 +5708,9 @@ components:
           type: string
           examples:
             - Administrator
-          description: Human-readable name of the NetSuite role (display purposes only).
+          description: |-
+            Display name of the role in `roleId`, recorded with it from the token NetSuite accepted
+            (display purposes only).
         wsdlVersion:
           type: string
           examples:
@@ -5768,7 +5788,13 @@ components:
           x-celigo-refModel: iclients
           examples:
             - 66a1b2c3d4e5f60718293a4b
-          description: ID of the iClient used for token-based authentication.
+          description: |-
+            iClient holding the consumer key and secret of the NetSuite integration record the
+            connection signs its requests with, when that record is not Celigo's own — an Integration
+            App's record (set by the app's install) or the account's own; access tokens are then created
+            for that record's Application. Absent on a standalone connection, which signs with Celigo's
+            `integrator.io` record (no client ID or secret is entered anywhere) and whose access tokens
+            must be created for Application `integrator.io`.
     Salesforce:
       type: object
       description: |-

package/dist/tool.yml

@@ -8087,8 +8087,9 @@ components:
           description: |
             NetSuite TBA token ID (encrypted at rest). Required when authType is "token".
 
-            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the
-            integrator.io application and the user and role the connection should act as.
+            Generated in NetSuite under Setup > Users/Roles > Access Tokens, for the Application
+            the connection signs its requests with — `integrator.io` unless `_iClientId` names another
+            integration record — and the user and role the connection should act as.
             Must be paired with the corresponding tokenSecret.
           x-celigo-ai-guidance:
             - Not needed when authType is "token-auto" — integrator.io manages the token wiring in that mode.
@@ -8097,6 +8098,11 @@ components:
               (HTTP 200, `errors[].code`, source `application`) and the save sets the connection offline;
               the response carries no detail of what NetSuite refused — that detail is in NetSuite's
               Login Audit Trail (the Detail column), not in the connection's error.
+            - |-
+              A token created for a different Application than the one the connection signs with is
+              refused the same way, so when a freshly created token is refused, which Application it
+              was created for is the first question; a missing iClient is not the cause on a connection
+              that has none — it signs with Celigo's `integrator.io` record.
           writeOnly: true
         tokenSecret:
           type: string
@@ -8115,7 +8121,11 @@ components:
           type: string
           examples:
             - '1234'
-          description: NetSuite entity/user ID associated with the token.
+          description: |-
+            NetSuite internal id of the user (entity) whose access token the connection logs in
+            with. On a token-authenticated connection the platform records it from the token
+            NetSuite accepted, together with `roleId` and `roleName`; a value that still names the
+            previous token's user after a refused login is the symptom of the refusal, not its cause.
         tokenName:
           type: string
           examples:
@@ -8125,11 +8135,19 @@ components:
           type: string
           examples:
             - '3'
-          description: |
-            NetSuite role ID that determines the permissions for this connection.
-
-            The role controls which records, fields, and operations are accessible.
-            Must match the role associated with the access token in NetSuite.
+          description: |-
+            NetSuite internal id of the role the connection's access token logs in as — the role
+            selected when the token was created (`token`) or chosen on NetSuite's consent page during
+            Save & authorize (`token-auto`). The platform records it from the token NetSuite accepted,
+            together with `roleName` and `entityId`; the connection form has no role field for token
+            authentication, and a value that still names the previous token's role after a refused
+            login is the symptom of the refusal, not its cause.
+          x-celigo-ai-guidance:
+            - |-
+              On a token-authenticated connection a value sent on create or update is stored but has no
+              effect on the login — NetSuite applies the role bound to the token — and is replaced from
+              the token at the next successful login; never write it to "match" a new token or offer
+              to. The token is the change.
         requestLevelCredentials:
           type: boolean
           default: false
@@ -8172,7 +8190,9 @@ components:
           type: string
           examples:
             - Administrator
-          description: Human-readable name of the NetSuite role (display purposes only).
+          description: |-
+            Display name of the role in `roleId`, recorded with it from the token NetSuite accepted
+            (display purposes only).
         wsdlVersion:
           type: string
           examples:
@@ -8250,7 +8270,13 @@ components:
           x-celigo-refModel: iclients
           examples:
             - 66a1b2c3d4e5f60718293a4b
-          description: ID of the iClient used for token-based authentication.
+          description: |-
+            iClient holding the consumer key and secret of the NetSuite integration record the
+            connection signs its requests with, when that record is not Celigo's own — an Integration
+            App's record (set by the app's install) or the account's own; access tokens are then created
+            for that record's Application. Absent on a standalone connection, which signs with Celigo's
+            `integrator.io` record (no client ID or secret is entered anywhere) and whose access tokens
+            must be created for Application `integrator.io`.
     Salesforce:
       type: object
       description: |-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.232",
+  "version": "0.2.233",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "fb204127",
+		"iasCommit": "7cd4b255",
 		"generatedAt": "2026-11-04"
 	},
 	"roots": {