@celigo/api-specs 0.2.233 → 0.2.235

package/dist/audit.yml

@@ -153,7 +153,7 @@ paths:
               sync: Sync resource.
               tool: Tool resource for reusable building blocks.
               topic: Event Streams topic resource.
-              user: User access record resource.
+              user: User access record resource. Also carries account-setting changes, each identified by `fieldChanges[].fieldPath` (no separate settings resource type exists) — account-wide settings (company MFA, end-user MFA, API Management setup, execution logging, AI settings, the account alias, the API Builder timeout) with `_resourceId` = the account owner, a member's access settings (`accessLevel`, `disabled`, `accountMFARequired`) with `_resourceId` = that member — and user-level MFA events (setup, trusted devices, secret generated or viewed, reset) with `_resourceId` = the affected user, recorded in the audit log of that user's MFA master account (its "Account to reset MFA"), which is not always the account the change was made from.
           description: |-
             Filter by resource type (singular form). Unsupported values are
             rejected with 422 `audit_not_supported`.
@@ -214,10 +214,28 @@ paths:
             type: string
             examples:
               - http.auth.token.token
+              - authTypeMFA.trustDeviceForPeriod
+              - apim.subdomain
           description: |-
             Restrict the `fieldChanges` of returned entries to changes on this
-            field path. The value is not validated against known paths — an
-            unknown path simply matches nothing.
+            field path. The match is exact on the stored dot-path — `authTypeMFA`
+            does not match `authTypeMFA.trustDeviceForPeriod` — with no prefix or
+            wildcard form, and the filter stands alone or combines with
+            `resourceType`. The value is not validated against known paths — an
+            unknown path simply matches nothing. Account-setting changes are
+            `user` entries reached this way, one stored path each: company MFA
+            `authTypeMFA.dontAllowTrustedDevices` and
+            `authTypeMFA.trustDeviceForPeriod`; end-user MFA `endUserMfa.required`,
+            `endUserMfa.disallowTrustedDevices` and `endUserMfa.trustedDeviceDays`;
+            a user's own MFA
+            `authTypeMFA.enabled`, `authTypeMFA.trustedDevices`,
+            `authTypeMFA.secret` and `authTypeMFA._allowResetByUserId`; API
+            Management setup `apim.subdomain` and `apim.serviceAccountEmail`;
+            execution logging `logging.retentionPeriod` and
+            `logging.storePayload`; AI settings
+            `aiSettings.intelligentDocumentProcessing`; the account alias
+            `accountAlias`; the API Builder timeout `timeoutPeriod`; a member's
+            access `accessLevel`, `disabled` and `accountMFARequired`.
         - name: action
           in: query
           required: false
@@ -590,7 +608,7 @@ paths:
               sync: Sync resource.
               tool: Tool resource for reusable building blocks.
               topic: Event Streams topic resource.
-              user: User access record resource.
+              user: User access record resource. Also carries account-setting changes, each identified by `fieldChanges[].fieldPath` (no separate settings resource type exists) — account-wide settings (company MFA, end-user MFA, API Management setup, execution logging, AI settings, the account alias, the API Builder timeout) with `_resourceId` = the account owner, a member's access settings (`accessLevel`, `disabled`, `accountMFARequired`) with `_resourceId` = that member — and user-level MFA events (setup, trusted devices, secret generated or viewed, reset) with `_resourceId` = the affected user, recorded in the audit log of that user's MFA master account (its "Account to reset MFA"), which is not always the account the change was made from.
           description: Optional filter by resource type (singular form).
         - name: _byUserId
           in: query
@@ -1530,7 +1548,7 @@ components:
             sync: Sync resource.
             tool: Tool resource for reusable building blocks.
             topic: Event Streams topic resource.
-            user: User access record resource.
+            user: User access record resource. Also carries account-setting changes, each identified by `fieldChanges[].fieldPath` (no separate settings resource type exists) — account-wide settings (company MFA, end-user MFA, API Management setup, execution logging, AI settings, the account alias, the API Builder timeout) with `_resourceId` = the account owner, a member's access settings (`accessLevel`, `disabled`, `accountMFARequired`) with `_resourceId` = that member — and user-level MFA events (setup, trusted devices, secret generated or viewed, reset) with `_resourceId` = the affected user, recorded in the audit log of that user's MFA master account (its "Account to reset MFA"), which is not always the account the change was made from.
         _resourceId:
           type: string
           format: objectId
@@ -1744,7 +1762,7 @@ components:
               sync: Sync resource.
               tool: Tool resource for reusable building blocks.
               topic: Event Streams topic resource.
-              user: User access record resource.
+              user: User access record resource. Also carries account-setting changes, each identified by `fieldChanges[].fieldPath` (no separate settings resource type exists) — account-wide settings (company MFA, end-user MFA, API Management setup, execution logging, AI settings, the account alias, the API Builder timeout) with `_resourceId` = the account owner, a member's access settings (`accessLevel`, `disabled`, `accountMFARequired`) with `_resourceId` = that member — and user-level MFA events (setup, trusted devices, secret generated or viewed, reset) with `_resourceId` = the affected user, recorded in the audit log of that user's MFA master account (its "Account to reset MFA"), which is not always the account the change was made from.
           examples:
             - - connection
               - agent
@@ -1965,7 +1983,7 @@ components:
             sync: Sync resource.
             tool: Tool resource for reusable building blocks.
             topic: Event Streams topic resource.
-            user: User access record resource.
+            user: User access record resource. Also carries account-setting changes, each identified by `fieldChanges[].fieldPath` (no separate settings resource type exists) — account-wide settings (company MFA, end-user MFA, API Management setup, execution logging, AI settings, the account alias, the API Builder timeout) with `_resourceId` = the account owner, a member's access settings (`accessLevel`, `disabled`, `accountMFARequired`) with `_resourceId` = that member — and user-level MFA events (setup, trusted devices, secret generated or viewed, reset) with `_resourceId` = the affected user, recorded in the audit log of that user's MFA master account (its "Account to reset MFA"), which is not always the account the change was made from.
         source:
           type: string
           enum:

package/dist/export.yml

@@ -287,6 +287,7 @@ paths:
         |------|------------|-------------|
         | `/debugUntil` | `replace`, `add`, `remove` | Step debug-capture expiry (ISO-8601, at most 3600 seconds from now — a later value is rejected with 422 `update_not_allowed`); `remove` stops capture and succeeds even when the field is absent |
         | `/assistantMetadata` | `replace` | Assistant metadata object |
+        | `/_networkPolicyId` | `add`, `replace`, `remove` | Network policy on a `webhook` or `distributed` listener; `remove` clears the assignment. An id that is not one of the environment's network policies is rejected with 400 `network_policy_not_found` |
 
         All other paths are rejected with `422`.
       operationId: patchExport
@@ -1483,7 +1484,7 @@ components:
       required:
         - verify
       x-celigo-ui-override: 'verify is required by the webhook listener form for every provider (exports/webhook.js: verify required:true; on a connector-backed listener the form pre-fills it from the connector definition before saving). The API enforces it only when provider is custom or absent — 422 missing_required_field on webhook.verify, "verify is required for export type webhook, provider = custom". For the named providers probed (slack, shopify, github) it stores a listener posted with key and no verify (201 each; the GET carries provider, key and formType simple) and requires a credential instead: without key (and no token) each answers 422 missing_required_field on webhook.key — "key is required for slack verification" / "key is required for shopify verification" / "key is required for github verification"; a slack listener posted with token and no key saved. Other named providers are unprobed. The requirement is kept so an authored document matches a form-saved one.'
-      description: Configuration for webhook listeners that receive data through incoming HTTP requests. Required when the export's `type` is `webhook`; omit for other export types. Senders POST to the export's listener URL, `https://api.integrator.io/v1/exports/{_id}/data` (or the same path on the account's regional API host); the platform validates each request using the configured `verify` method, passes the payload to subsequent flow steps, and returns a configurable HTTP response to the caller. A request is answered 204 by default when accepted, 401 when it fails verification, and 403 `unable_to_run_flows` while every flow the export feeds is disabled; a refused request is not queued, so the sender must resend it.
+      description: Configuration for webhook listeners that receive data through incoming HTTP requests. Required when the export's `type` is `webhook`; omit for other export types. Senders POST to the export's listener URL, `https://api.integrator.io/v1/exports/{_id}/data` (or the same path on the account's regional API host); the platform validates each request using the configured `verify` method, passes the payload to subsequent flow steps, and returns a configurable HTTP response to the caller. A request is answered 204 by default when accepted, 401 when it fails verification, 403 `unable_to_run_flows` while every flow the export feeds is disabled, and 403 `access_denied` when the export's `_networkPolicyId` policy does not admit the sender's address (checked before verification, with a valid or an invalid token alike, where enforcement is enabled for the account); a refused request is not queued, so the sender must resend it once the cause is cleared.
       x-celigo-ai-guidance:
         - Configuration object for real-time event listeners that receive data via incoming HTTP requests.
         - |-
@@ -16883,10 +16884,18 @@ components:
             `webhook` object when `type` is `webhook`); an HTTP or SQL `delta` export saves without a
             `delta` object because its request carries `{{lastExportDateTime}}`, though
             `delta.startDate` sets its first window. It still needs `type: delta`: on an export
-            with no `type`, `{{lastExportDateTime}}` and `{{currentExportDateTime}}` render
-            empty on every run, so a request that carries them goes out with blank values each time
-            (live-verified 2026-10-22). Use `blob` only to transfer raw files without parsing their
-            contents.
+            with no `type` (or `all`, or `test`), `{{lastExportDateTime}}` and `{{currentExportDateTime}}` render
+            empty on every run, so a request that carries them bare goes out with blank values each
+            time, `dateFormat` on one renders the run's current time (the request asks for changes
+            since now), and `dateAdd` on one fails the whole render — on an HTTP export's body or
+            relative URI the run records `handlebars_template_parse_error`, "Failed to generate request
+            body (or url) from template … Details: Invalid time value" — before anything is sent
+            (live-verified 2026-10-22 and 2026-11-04). When incremental reads are intended, restoring
+            `type: delta` (with `delta.startDate` for the first window) makes the variables resolve;
+            when reading everything is intended, change the template — drop the variable or guard it
+            with `{{#if lastExportDateTime}}…{{else}}fallback{{/if}}`, whose else branch (a literal, in
+            practice a fixed start date) renders on an export with no `type`, `type: all` or
+            `type: test`. Use `blob` only to transfer raw files without parsing their contents.
           x-celigo-ai-guidance:
             - |-
               ## HOW TO PICK THE TYPE VALUE
@@ -17385,6 +17394,33 @@ components:
             - 'The listener must be an export with `type: "webhook"` and `webhook.provider: "integrator-extension"`; any other export id is rejected with `invalid_post_parse_listener`. On an HTTP export outside file mode the save is rejected with `post_parse_listener_not_supported`: "Listener for functional acknowledgment is only supported for AS2, FTP, S3 and HTTP file export."'
           examples:
             - 60a2c4e6f321d800129a1a3c
+        _networkPolicyId:
+          type:
+            - string
+            - 'null'
+          format: objectId
+          x-celigo-refModel: networkpolicies
+          description: |-
+            Network policy whose IP allow and deny lists gate the requests that deliver data to this
+            listener. Only `type` `webhook` or `distributed` exports accept it; any other type fails
+            with 422 `not_allowed`. An id that is not one of the environment's network policies,
+            including one in the recycle bin, fails with 400 `network_policy_not_found`. Preserved
+            when omitted on PUT; send `null`, or `remove` it with `PATCH /v1/exports/{_id}` (which
+            also accepts `add` and `replace` with an id), to clear it. Deleting the policy with
+            `?force=true` clears it too. Absent from responses when no policy is assigned.
+
+            Where network-policy enforcement is enabled for the account, a webhook delivery to the
+            listener's `/data` route from an address the policy does not admit is refused with 403
+            `access_denied` — with a valid verification token or an invalid one alike, never 401 —
+            before the listener's verification runs and before the payload is read, so nothing is
+            queued and no flow run starts; an authenticated `GET` or `HEAD` of that route from such an
+            address is refused the same way. Enforcement on listeners is enabled per account. The
+            assignment is recorded in the export's audit as a `_networkPolicyId` field change carrying
+            the policy id.
+          x-celigo-ai-guidance:
+            - 'Assign by sending the whole export document with `_networkPolicyId` set (the form''s own save does the same) and clear it with an explicit `null` — a PUT that omits the field keeps the current policy, so a removed key is a silent no-op, not an unassignment. Resolve the policy id from `GET /v1/networkpolicies` in the same environment first: an unknown or recycled id is refused only at save time with 400 `network_policy_not_found`.'
+          examples:
+            - 6ab1ebbfb9e4547494ff7558
         externalId:
           type:
             - string

package/dist/networkpolicy.yml

@@ -2,12 +2,13 @@ openapi: 3.2.0
 info:
   version: 1.0.0
   title: Network Policies
-  description: Manage IP allow and deny lists that restrict where API tokens, MCP servers, and users may connect from.
+  description: Manage IP allow and deny lists that restrict where API tokens, MCP servers, webhook listeners, and users may connect from.
   x-celigo-ai-guidance:
     - |-
       API for managing network policies — named IP allow/deny lists that are assigned to API tokens
-      (`_networkPolicyId`), MCP servers (`_networkPolicyId`), or account sign-in settings to restrict
-      the source addresses a caller may connect from. A policy restricts nothing until it is assigned.
+      (`_networkPolicyId`), MCP servers (`_networkPolicyId`), webhook and distributed listener exports
+      (`_networkPolicyId`), or account sign-in settings to restrict the source addresses a caller may
+      connect from. A policy restricts nothing until it is assigned.
 servers:
   - url: https://api.integrator.io
     description: Production (US / default region)
@@ -22,11 +23,11 @@ security:
 tags:
   - name: Network Policies
     description: |-
-      Network policies are named IP allow and deny lists that control where API tokens, MCP servers, and users may connect from. A policy takes effect only once it is assigned — through `_networkPolicyId` on an API token or MCP server, or in account settings for workspace-user and end-user sign-in — and each environment (production or sandbox) keeps its own library of policies. Network policies must be enabled for the account, and only the account owner and administrators can manage them.
+      Network policies are named IP allow and deny lists that control where API tokens, MCP servers, webhook listeners, and users may connect from. A policy takes effect only once it is assigned — through `_networkPolicyId` on an API token, an MCP server, or a webhook or distributed listener export, or in account settings for workspace-user and end-user sign-in — and each environment (production or sandbox) keeps its own library of policies. Network policies must be enabled for the account, and only the account owner and administrators can manage them.
 
-      Every policy that applies to a call must admit the caller. An API token's policy is checked when the token authenticates, before the request runs; an MCP server's policy is checked on every request to it, so a call to an MCP server passes both its token's policy and the server's. A personal access token has no policy of its own: it is checked against the workspace-user sign-in policy of the environment it belongs to. Sign-in policies are checked when a workspace user signs in or switches account or environment, and when an end user signs in to an MCP server.
+      Every policy that applies to a call must admit the caller. An API token's policy is checked when the token authenticates, before the request runs; an MCP server's policy is checked on every request to it, so a call to an MCP server passes both its token's policy and the server's. A personal access token has no policy of its own: it is checked against the workspace-user sign-in policy of the environment it belongs to. Sign-in policies are checked when a workspace user signs in or switches account or environment, and when an end user signs in to an MCP server. A webhook listener's policy is checked on every delivery to its `/data` route — the source system's deliveries carry no Celigo identity, so the listener's own policy is the only one that applies to them — before the listener's verification runs and before the payload is read, and on authenticated reads of that route; enforcement on listeners is enabled per account.
 
-      A refused call gets HTTP 403 with `{"errors": [{"code": "access_denied", "message": "Access denied."}]}` and nothing that names the policy or the address. An MCP server endpoint speaks JSON-RPC, so its 403 carries the MCP server's access-denied error (`-32006`) in a JSON-RPC envelope instead — `{"jsonrpc": "2.0", "error": {"code": -32006, "message": "Access denied."}, "id": <request id>}`, with `id` echoed when the request had one — and the server's request log records the call as blocked.
+      A refused call gets HTTP 403 with `{"errors": [{"code": "access_denied", "message": "Access denied."}]}` and nothing that names the policy or the address. An MCP server endpoint speaks JSON-RPC, so its 403 carries the MCP server's access-denied error (`-32006`) in a JSON-RPC envelope instead — `{"jsonrpc": "2.0", "error": {"code": -32006, "message": "Access denied."}, "id": <request id>}`, with `id` echoed when the request had one — and the server's request log records the call as blocked. A refused listener delivery is not queued and starts no flow run.
 
       ## Network policy schema
 
@@ -128,7 +129,7 @@ paths:
         validated and stored in normalized form — a bare address becomes `/32` or
         `/128`, IPv6 is compressed — and the response shows the stored values. The new
         policy restricts nothing until it is assigned to an API token, an MCP server,
-        or account sign-in.
+        a webhook or real-time listener export, or account sign-in.
       operationId: createNetworkPolicy
       tags:
         - Network Policies
@@ -243,7 +244,8 @@ paths:
         omitted `description` is removed and an omitted `ipAllowList` or `ipDenyList`
         becomes empty, which lifts every restriction that list imposed. Entries are
         validated and normalized exactly as on create. The change applies to every
-        token, MCP server, and sign-in setting the policy is assigned to.
+        token, MCP server, listener export, and sign-in setting the policy is
+        assigned to.
       operationId: updateNetworkPolicy
       tags:
         - Network Policies
@@ -399,8 +401,8 @@ paths:
       summary: Delete a network policy
       description: |-
         Moves the policy to the recycle bin, where it is retained for 30 days and can
-        be restored. A policy that is still assigned to an API token, MCP server, or
-        account sign-in setting is not deleted: the request fails with 409
+        be restored. A policy that is still assigned to an API token, MCP server,
+        listener export, or account sign-in setting is not deleted: the request fails with 409
         `network_policy_in_use` and `info` lists every assignment. Repeat with
         `force=true` to clear those assignments and delete the policy — every principal
         it was assigned to loses the restriction. Use `GET /v1/networkpolicies/{_id}/dependencies`
@@ -423,9 +425,9 @@ paths:
           in: query
           required: false
           description: |-
-            When true, clears the policy from every API token, MCP server, and account
-            sign-in setting it is assigned to, then deletes it. Without it, an assigned
-            policy returns 409 and nothing changes.
+            When true, clears the policy from every API token, MCP server, listener
+            export, and account sign-in setting it is assigned to, then deletes it.
+            Without it, an assigned policy returns 409 and nothing changes.
           schema:
             type: boolean
             default: false
@@ -448,8 +450,8 @@ paths:
         - Network Policies
       summary: List assignments of a network policy
       description: |-
-        Returns every API token, MCP server, and account sign-in setting the policy is
-        assigned to within its own environment. Call it before `DELETE` to see what a
+        Returns every API token, MCP server, listener export, and account sign-in setting
+        the policy is assigned to within its own environment. Call it before `DELETE` to see what a
         `force=true` delete would clear. Unlike other `/dependencies` endpoints, the
         response is a fixed object rather than a map keyed by resource type.
       parameters:
@@ -472,12 +474,15 @@ paths:
                 $ref: '#/components/schemas/NetworkPolicyDependencies'
               examples:
                 assigned:
-                  summary: Assigned to an MCP server
+                  summary: Assigned to an MCP server and a webhook listener
                   value:
                     mcpservers:
                       - _id: 6ab1f4a95af4c5a3ea6b0a28
                         name: Order lookup MCP server
                     accesstokens: []
+                    exports:
+                      - _id: 6aeb0ddf1f97adaf3db4152b
+                        name: Orders webhook listener
                     account:
                       workspaceUsers: false
                       workspaceUserEnvironments: []
@@ -488,6 +493,7 @@ paths:
                   value:
                     mcpservers: []
                     accesstokens: []
+                    exports: []
                     account:
                       workspaceUsers: false
                       workspaceUserEnvironments: []
@@ -1033,6 +1039,7 @@ components:
       required:
         - mcpservers
         - accesstokens
+        - exports
         - account
       properties:
         mcpservers:
@@ -1045,6 +1052,11 @@ components:
           description: API tokens whose `_networkPolicyId` is this policy. Personal access tokens never appear here; they inherit the account's workspace-user policy instead.
           items:
             $ref: '#/components/schemas/NetworkPolicyDependencyRef'
+        exports:
+          type: array
+          description: Webhook and distributed (real-time) listener exports whose `_networkPolicyId` is this policy. Each one is also listed under `info.exports` when a `DELETE` without `force=true` is refused.
+          items:
+            $ref: '#/components/schemas/NetworkPolicyDependencyRef'
         account:
           type: object
           description: Account sign-in assignments of this policy, resolved per environment.
@@ -1199,8 +1211,8 @@ components:
                     message: The requested resource was not found.
     409-in-use:
       description: |-
-        Conflict. The policy is still assigned to at least one API token, MCP server, or
-        account sign-in setting, so it was not deleted. `info` lists every assignment;
+        Conflict. The policy is still assigned to at least one API token, MCP server,
+        listener export, or account sign-in setting, so it was not deleted. `info` lists every assignment;
         repeat the request with `force=true` to clear them and delete the policy.
       content:
         application/json:
@@ -1224,6 +1236,7 @@ components:
                   accesstokens:
                     - _id: 6ab1f6a338d7733b4599ec83
                       name: Warehouse sync token
+                  exports: []
                   account:
                     workspaceUsers: false
                     workspaceUserEnvironments: []

package/dist/tool.yml

@@ -28044,7 +28044,7 @@ components:
       required:
         - verify
       x-celigo-ui-override: 'verify is required by the webhook listener form for every provider (exports/webhook.js: verify required:true; on a connector-backed listener the form pre-fills it from the connector definition before saving). The API enforces it only when provider is custom or absent — 422 missing_required_field on webhook.verify, "verify is required for export type webhook, provider = custom". For the named providers probed (slack, shopify, github) it stores a listener posted with key and no verify (201 each; the GET carries provider, key and formType simple) and requires a credential instead: without key (and no token) each answers 422 missing_required_field on webhook.key — "key is required for slack verification" / "key is required for shopify verification" / "key is required for github verification"; a slack listener posted with token and no key saved. Other named providers are unprobed. The requirement is kept so an authored document matches a form-saved one.'
-      description: Configuration for webhook listeners that receive data through incoming HTTP requests. Required when the export's `type` is `webhook`; omit for other export types. Senders POST to the export's listener URL, `https://api.integrator.io/v1/exports/{_id}/data` (or the same path on the account's regional API host); the platform validates each request using the configured `verify` method, passes the payload to subsequent flow steps, and returns a configurable HTTP response to the caller. A request is answered 204 by default when accepted, 401 when it fails verification, and 403 `unable_to_run_flows` while every flow the export feeds is disabled; a refused request is not queued, so the sender must resend it.
+      description: Configuration for webhook listeners that receive data through incoming HTTP requests. Required when the export's `type` is `webhook`; omit for other export types. Senders POST to the export's listener URL, `https://api.integrator.io/v1/exports/{_id}/data` (or the same path on the account's regional API host); the platform validates each request using the configured `verify` method, passes the payload to subsequent flow steps, and returns a configurable HTTP response to the caller. A request is answered 204 by default when accepted, 401 when it fails verification, 403 `unable_to_run_flows` while every flow the export feeds is disabled, and 403 `access_denied` when the export's `_networkPolicyId` policy does not admit the sender's address (checked before verification, with a valid or an invalid token alike, where enforcement is enabled for the account); a refused request is not queued, so the sender must resend it once the cause is cleared.
       x-celigo-ai-guidance:
         - Configuration object for real-time event listeners that receive data via incoming HTTP requests.
         - |-
@@ -39194,10 +39194,18 @@ components:
             `webhook` object when `type` is `webhook`); an HTTP or SQL `delta` export saves without a
             `delta` object because its request carries `{{lastExportDateTime}}`, though
             `delta.startDate` sets its first window. It still needs `type: delta`: on an export
-            with no `type`, `{{lastExportDateTime}}` and `{{currentExportDateTime}}` render
-            empty on every run, so a request that carries them goes out with blank values each time
-            (live-verified 2026-10-22). Use `blob` only to transfer raw files without parsing their
-            contents.
+            with no `type` (or `all`, or `test`), `{{lastExportDateTime}}` and `{{currentExportDateTime}}` render
+            empty on every run, so a request that carries them bare goes out with blank values each
+            time, `dateFormat` on one renders the run's current time (the request asks for changes
+            since now), and `dateAdd` on one fails the whole render — on an HTTP export's body or
+            relative URI the run records `handlebars_template_parse_error`, "Failed to generate request
+            body (or url) from template … Details: Invalid time value" — before anything is sent
+            (live-verified 2026-10-22 and 2026-11-04). When incremental reads are intended, restoring
+            `type: delta` (with `delta.startDate` for the first window) makes the variables resolve;
+            when reading everything is intended, change the template — drop the variable or guard it
+            with `{{#if lastExportDateTime}}…{{else}}fallback{{/if}}`, whose else branch (a literal, in
+            practice a fixed start date) renders on an export with no `type`, `type: all` or
+            `type: test`. Use `blob` only to transfer raw files without parsing their contents.
           x-celigo-ai-guidance:
             - |-
               ## HOW TO PICK THE TYPE VALUE
@@ -39696,6 +39704,33 @@ components:
             - 'The listener must be an export with `type: "webhook"` and `webhook.provider: "integrator-extension"`; any other export id is rejected with `invalid_post_parse_listener`. On an HTTP export outside file mode the save is rejected with `post_parse_listener_not_supported`: "Listener for functional acknowledgment is only supported for AS2, FTP, S3 and HTTP file export."'
           examples:
             - 60a2c4e6f321d800129a1a3c
+        _networkPolicyId:
+          type:
+            - string
+            - 'null'
+          format: objectId
+          x-celigo-refModel: networkpolicies
+          description: |-
+            Network policy whose IP allow and deny lists gate the requests that deliver data to this
+            listener. Only `type` `webhook` or `distributed` exports accept it; any other type fails
+            with 422 `not_allowed`. An id that is not one of the environment's network policies,
+            including one in the recycle bin, fails with 400 `network_policy_not_found`. Preserved
+            when omitted on PUT; send `null`, or `remove` it with `PATCH /v1/exports/{_id}` (which
+            also accepts `add` and `replace` with an id), to clear it. Deleting the policy with
+            `?force=true` clears it too. Absent from responses when no policy is assigned.
+
+            Where network-policy enforcement is enabled for the account, a webhook delivery to the
+            listener's `/data` route from an address the policy does not admit is refused with 403
+            `access_denied` — with a valid verification token or an invalid one alike, never 401 —
+            before the listener's verification runs and before the payload is read, so nothing is
+            queued and no flow run starts; an authenticated `GET` or `HEAD` of that route from such an
+            address is refused the same way. Enforcement on listeners is enabled per account. The
+            assignment is recorded in the export's audit as a `_networkPolicyId` field change carrying
+            the policy id.
+          x-celigo-ai-guidance:
+            - 'Assign by sending the whole export document with `_networkPolicyId` set (the form''s own save does the same) and clear it with an explicit `null` — a PUT that omits the field keeps the current policy, so a removed key is a silent no-op, not an unassignment. Resolve the policy id from `GET /v1/networkpolicies` in the same environment first: an unknown or recycled id is refused only at save time with 400 `network_policy_not_found`.'
+          examples:
+            - 6ab1ebbfb9e4547494ff7558
         externalId:
           type:
             - string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.233",
+  "version": "0.2.235",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "7cd4b255",
+		"iasCommit": "aba7deb7",
 		"generatedAt": "2026-11-04"
 	},
 	"roots": {
@@ -5793,6 +5793,7 @@
 				"_ediProfileId": 0,
 				"_id": 0,
 				"_integrationId": 88,
+				"_networkPolicyId": 88,
 				"_postParseListenerId": 0,
 				"_sourceId": 0,
 				"_templateId": 0,