@celigo/api-specs 0.2.24 → 0.2.26

package/dist/editransaction.yml

@@ -721,7 +721,9 @@ components:
           description: |-
             Job ID of the flow run that processed the functional acknowledgement
             (997 / CONTRL) for this transaction. Present only once an FA has been
-            received and processed.
+            received and processed. Use this job — not `_flowJobId` — with
+            `POST /v1/jobs/{_faFlowJobId}/files/signedURL` (body
+            `{ "fileIds": ["<faS3Key>"] }`) to download the FA file.
           x-celigo-refModel: jobs
           examples:
             - 6a05fdbf0f139ef519238dd7
@@ -806,8 +808,13 @@ components:
             Opaque file identifier for the stored functional-acknowledgement
             (997 / CONTRL) file. Present only once an FA has been received.
             One acknowledgement file can cover many transactions, which then
-            share the same `faS3Key`. Download it via
-            `GET /v1/ediTransactions/{_ediTransactionId}/ediFile?type=fa`.
+            share the same `faS3Key`. To download the FA file, combine with
+            `_faFlowJobId` (the FA-processing flow run — not `_flowJobId`) and
+            call `POST /v1/jobs/{_faFlowJobId}/files/signedURL` with body
+            `{ "fileIds": ["<faS3Key>"] }`. For parsed FA failure details, use
+            `GET /v1/ediTransactions/{_ediTransactionId}/faDetails?fileType=<X12|EDIFACT>`
+            — pass the transaction's own `fileType`; the route answers 404 without it
+            (available only for transactions with a rejected FA status).
           examples:
             - 9a7c3e14b2af45d8bc0e6090c5be6afa
         mdnStatus:

package/dist/enduser.yml

@@ -21,7 +21,9 @@ tags:
       getting workspace access — they sign in through MCP OAuth, optionally
       via an external IdP. Use these endpoints to invite end users (singly or
       in bulk), list and revoke them, and inspect the effective MCP tool
-      access compiled from their grants, groups, and roles.
+      access compiled from their grants, groups, and roles. An end user's
+      access record is an ashare, so editing its grants and suspending it
+      use the `/v1/ashares` routes shared with workspace users.
 
       ## End user schema
 
@@ -325,6 +327,131 @@ paths:
           $ref: '#/components/responses/403-forbidden'
         '404':
           $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_ashareId}:
+    put:
+      x-internal: false
+      summary: Update an end user's access
+      operationId: updateEndUser
+      tags:
+        - End Users
+      description: |-
+        Replaces the end user's group memberships and direct resource grants with
+        the arrays sent. Works on invited end users before they accept. `disabled`
+        is not applied here — use `PUT /v1/ashares/{_ashareId}/disable`.
+
+        An end user's access record is an ashare, so this is the same route as
+        the workspace-user update in the Users API, with this body instead of the
+        workspace fields. `GET /v1/ashares/{_id}` does not return end-user
+        records — read them from `GET /v1/endusers`.
+      parameters:
+        - name: _ashareId
+          in: path
+          required: true
+          description: End-user access-record id (from the end users list).
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/EndUserUpdateRequest'
+            examples:
+              removeDirectGrant:
+                summary: Keep one group, drop a direct grant
+                value:
+                  groupMemberships:
+                    - _groupId: 68a1b2c3d4e5f6a7b8c9d0e1
+                      source: manual
+                  resourceGrants: []
+              grantServer:
+                summary: Add a direct grant on one MCP server
+                value:
+                  groupMemberships: []
+                  resourceGrants:
+                    - resourceType: mcpServer
+                      _resourceId: 6a1b2c3d4e5f6a7b8c9d0e1f
+                      capabilities:
+                        - tool:all
+      responses:
+        '200':
+          description: |-
+            The updated access record as stored. The identity fields the list
+            joins in (`email`, `name`, `lastSignIn`) and `hasWorkspaceShare` are
+            not included, and empty arrays may be omitted.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EndUser'
+              examples:
+                default:
+                  value:
+                    _id: 68b1c2d3e4f5a6b7c8d9e0f1
+                    _sharedWithUserId: 624774a6a7574d3ed9f9a5cc
+                    userType: end-user
+                    provisionedBy: invite
+                    accepted: true
+                    groupMemberships:
+                      - _groupId: 68a1b2c3d4e5f6a7b8c9d0e1
+                        source: manual
+                    createdAt: '2026-07-01T09:15:32Z'
+                    lastModified: '2026-08-15T14:30:15Z'
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_ashareId}/disable:
+    put:
+      x-internal: false
+      summary: Toggle an end user's access
+      operationId: toggleEndUserDisabled
+      tags:
+        - End Users
+      description: |-
+        Toggles the `disabled` flag on the end user's access record — call again
+        to restore access; there is no separate `/enable` path. Unlike the
+        workspace toggle, this also works on invited end users who have not yet
+        accepted. Shares its route with the workspace-user toggle in the Users
+        API.
+      parameters:
+        - name: _ashareId
+          in: path
+          required: true
+          description: End-user access-record id (from the end users list).
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Empty body — the target is identified by the path parameter alone.
+            examples:
+              default:
+                summary: Empty body
+                value: {}
+      responses:
+        '204':
+          description: End-user access toggled.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          description: End user not found.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                ashare_not_found:
+                  value:
+                    errors:
+                      - code: invalid_ref
+                        message: AShare not found.
   /v1/groups:
     get:
       x-internal: false
@@ -1010,7 +1137,10 @@ components:
           description: When true, the end user has declined the invitation.
         disabled:
           type: boolean
-          description: When true, the end user's access is suspended without deleting the record.
+          description: |-
+            When true, the end user's access is suspended without deleting the
+            record. Changed only by `PUT /v1/ashares/{_ashareId}/disable` — a
+            value sent on the update operation is not applied.
         groupMemberships:
           type: array
           description: Groups this end user belongs to, with the source of each membership.
@@ -1418,6 +1548,25 @@ components:
                     reason:
                       type: string
                       description: Why the tool is not available to this end user.
+    EndUserUpdateRequest:
+      type: object
+      description: |-
+        Replacement access for an end user. Both arrays are stored as sent, so
+        each must carry every entry to keep, not just the changes.
+      required:
+        - groupMemberships
+        - resourceGrants
+      properties:
+        groupMemberships:
+          type: array
+          description: Complete set of groups the end user should belong to after the update.
+          items:
+            $ref: '#/components/schemas/GroupMembership'
+        resourceGrants:
+          type: array
+          description: Complete set of direct resource grants the end user should hold after the update.
+          items:
+            $ref: '#/components/schemas/ResourceGrant'
     Group:
       type: object
       description: |-

package/dist/mcp-server.yml

@@ -18,6 +18,7 @@ info:
       - Supports tool overrides for customizing connections, exports, imports, and routing per-server
       - Exposes prompts via `prompts/list` and `prompts/get` with Handlebars-style argument substitution
       - Carries **permission sets** ("Capability Sets" in the UI) — named bundles of its tools and APIs granted to end users via `pset:<_id>` capability strings on end-user, group, and role resource grants
+      - Carries optional **traffic limits** (`policies[]`) — a server-level rate limit, a per-user rate limit for OAuth end users, and a usage quota — enforced before a tool runs; a rejected call gets HTTP 429 with `Retry-After`
 servers:
   - url: https://api.integrator.io
     description: Production (US / default region)
@@ -43,7 +44,10 @@ tags:
       and routing. Permission sets ("Capability Sets" in the UI) bundle a
       server's tools and APIs into named grants for end users, and the
       server-scoped access endpoints bulk-assign capabilities to end users
-      and groups and report compiled effective access.
+      and groups and report compiled effective access. Optional traffic
+      limits (`policies`) — a server-level rate limit, a per-user rate
+      limit, and a usage quota — reject calls over the limit with HTTP 429
+      and `Retry-After` before any tool runs.
 
       ## MCP server schema
 
@@ -269,10 +273,11 @@ paths:
       summary: Update an MCP server
       description: |-
         Full replacement of an MCP server's configuration. Omitted arrays
-        (`tools`, `apis`, `prompts`, `resources`, `permissionSets`) are cleared,
-        so include the complete arrays — clearing `permissionSets` this way also
-        rewrites the `pset:` grants that referenced the erased sets. `relativeURI`
-        can be changed but must remain unique per account.
+        (`tools`, `apis`, `prompts`, `resources`, `permissionSets`, `policies`)
+        are cleared, so include the complete arrays — clearing `permissionSets`
+        this way also rewrites the `pset:` grants that referenced the erased sets,
+        and clearing `policies` removes every traffic limit. `relativeURI` can be
+        changed but must remain unique per account.
       operationId: updateMcpServer
       tags:
         - MCP Servers
@@ -386,8 +391,14 @@ paths:
       summary: Patch an MCP server
       description: |-
         Partially updates an MCP server using a JSON Patch document (RFC 6902).
-        Only `/name` and `/disabled` are whitelisted paths — all other paths
-        are rejected with `not a whitelisted property`.
+        Only `/name`, `/disabled`, and `/policies` are whitelisted paths — all
+        other paths are rejected with `not a whitelisted property`. Under
+        `/policies`, `add`, `replace`, and `remove` work on the whole array,
+        `add` works at `/policies/-` or an index, and `replace` works at an index
+        or a sub-path such as `/policies/0/config/limit`; `remove` at an array
+        index is rejected with 422 `Remove at array index is not supported`. The
+        resulting array is validated as a whole, and an invalid policy rejects
+        the entire patch.
       operationId: patchMcpServer
       tags:
         - MCP Servers
@@ -421,6 +432,40 @@ paths:
                   - op: replace
                     path: /name
                     value: Updated Server Name
+              set_traffic_limits:
+                summary: Set a server rate limit, a per-user rate limit, and a monthly quota
+                value:
+                  - op: replace
+                    path: /policies
+                    value:
+                      - type: rate-limit
+                        name: Server-level rate limit
+                        enabled: true
+                        config:
+                          limit: 600
+                          periodTime: 1
+                          periodTimeUnit: MINUTE
+                      - type: rate-limit
+                        name: Per-user rate limit
+                        enabled: true
+                        config:
+                          limit: 60
+                          periodTime: 1
+                          periodTimeUnit: MINUTE
+                          keyResolver: consumer
+                      - type: quota
+                        name: Monthly usage quota
+                        enabled: true
+                        config:
+                          limit: 500000
+                          periodTime: 1
+                          periodTimeUnit: MONTH
+              remove_traffic_limits:
+                summary: Remove every traffic limit (unlimited)
+                value:
+                  - op: replace
+                    path: /policies
+                    value: []
       responses:
         '204':
           description: Patch applied.
@@ -1724,6 +1769,217 @@ components:
       required:
         - name
         - accessLevel
+    Policy:
+      type: object
+      description: |-
+        One traffic limit the server enforces before a tool runs — shown under
+        **Access > Governance** in the UI. A `rate-limit` caps calls per MINUTE,
+        HOUR, or DAY with a continuously refilling allowance, either for the whole
+        server (`keyResolver` `endpoint`) or separately for each OAuth end user
+        (`keyResolver` `consumer`); a `quota` caps cumulative calls over a UTC
+        calendar DAY, WEEK, or MONTH across every consumer. A call must pass every
+        enabled policy. A rejected call is not executed and receives HTTP 429 with
+        a `Retry-After` header (seconds until the allowance refills or the quota
+        period resets), an `X-RateLimit-Limit` header, and a JSON-RPC error
+        (code -32004) whose message names the policy: `Rate limit exceeded: <name>`
+        or `Usage quota exceeded: <name>`.
+      x-celigo-ai-guidance:
+        - |-
+          Configure one policy per kind — one server-level rate limit, one per-user
+          rate limit (`keyResolver` `consumer`), one quota. The API does not reject a
+          second policy of the same kind; both are then enforced against the same
+          traffic, which makes the effective limit hard to reason about.
+        - |-
+          A `tools/call` counts against every enabled policy, even when the named tool
+          does not exist; `initialize`, `tools/list`, `prompts/list`, and `resources/list`
+          are never counted or rejected (all live-verified). Whether `prompts/get` and
+          `resources/read` count has not been verified — do not assert either way.
+        - |-
+          Bearer API-token traffic is evaluated by `endpoint`-keyed rate limits and by
+          quotas only; a `consumer`-keyed rate limit applies to OAuth end users, each
+          with an independent allowance, and leaves API-token traffic untouched.
+        - |-
+          A rate limit keeps its allowance state when its `limit` is changed, so raising
+          a limit right after it tripped admits nothing until tokens refill at the new
+          rate. A quota counts every call the server accepted in the current UTC period,
+          including calls made before the quota was configured — a quota below the
+          period's current count rejects every call until the period resets.
+      required:
+        - type
+        - name
+        - config
+      properties:
+        type:
+          type: string
+          enum:
+            - rate-limit
+            - quota
+          x-enumDescriptions:
+            rate-limit: Caps calls per MINUTE, HOUR, or DAY with an allowance that refills continuously; server-wide, or per end user with keyResolver consumer
+            quota: Caps cumulative calls over a UTC calendar DAY, WEEK, or MONTH for every consumer combined
+          description: |-
+            Kind of limit. Use rate-limit to protect downstream systems from bursts
+            and, with `keyResolver` `consumer`, to keep one end user from consuming
+            the whole server; use quota to cap total consumption for cost control.
+          examples:
+            - rate-limit
+        name:
+          type: string
+          maxLength: 100
+          description: |-
+            Label for the limit, echoed verbatim in the 429 error message that
+            rejected clients receive — name it the way consumers should read it.
+          examples:
+            - Server-level rate limit
+            - Per-user rate limit
+            - Monthly usage quota
+        enabled:
+          type: boolean
+          default: true
+          description: |-
+            When true, the policy is enforced. Set to false to keep the
+            configuration in place without enforcing it.
+          examples:
+            - true
+        config:
+          type: object
+          additionalProperties: false
+          description: |-
+            Limit value and period. The maximum `limit` depends on the unit and
+            equals the platform ceiling of 300 calls per second over one period.
+          required:
+            - limit
+            - periodTime
+            - periodTimeUnit
+          properties:
+            limit:
+              type: integer
+              minimum: 1
+              description: |-
+                Maximum number of counted calls in one period. Ceilings per unit:
+                18000 per MINUTE, 1080000 per HOUR, 25920000 per DAY, 181440000 per
+                WEEK, 777600000 per MONTH — higher values are rejected with 422
+                `policy_config_invalid`.
+              examples:
+                - 600
+            periodTime:
+              type: integer
+              const: 1
+              default: 1
+              description: |-
+                Number of `periodTimeUnit` units in one period. Only a single unit
+                is supported; any other value is rejected with 422.
+              examples:
+                - 1
+            periodTimeUnit:
+              type: string
+              enum:
+                - MINUTE
+                - HOUR
+                - DAY
+                - WEEK
+                - MONTH
+              x-enumDescriptions:
+                MINUTE: One-minute period; rate limits only
+                HOUR: One-hour period; rate limits only
+                DAY: One calendar day (UTC) for quotas, or a one-day refilling allowance for rate limits
+                WEEK: One calendar week (UTC); quotas only
+                MONTH: One calendar month (UTC); quotas only
+              description: |-
+                Length of one period. Rate limits take MINUTE, HOUR, or DAY; quotas
+                take DAY, WEEK, or MONTH — any other pairing, or a lowercase value,
+                is rejected with 422 `policy_config_invalid`.
+              examples:
+                - MINUTE
+            keyResolver:
+              type: string
+              enum:
+                - endpoint
+                - consumer
+              default: endpoint
+              x-enumDescriptions:
+                endpoint: One shared allowance for the whole server across every consumer and authentication method
+                consumer: A separate allowance for each OAuth end user; bearer API-token traffic is not evaluated by this policy
+              description: |-
+                Whose allowance the limit tracks. Omit it (or send endpoint) for a
+                server-level limit and send consumer for a per-user rate limit;
+                quotas accept endpoint only.
+              examples:
+                - endpoint
+          if:
+            properties:
+              periodTimeUnit:
+                const: MINUTE
+            required:
+              - periodTimeUnit
+          then:
+            properties:
+              limit:
+                maximum: 18000
+          else:
+            if:
+              properties:
+                periodTimeUnit:
+                  const: HOUR
+              required:
+                - periodTimeUnit
+            then:
+              properties:
+                limit:
+                  maximum: 1080000
+            else:
+              if:
+                properties:
+                  periodTimeUnit:
+                    const: DAY
+                required:
+                  - periodTimeUnit
+              then:
+                properties:
+                  limit:
+                    maximum: 25920000
+              else:
+                if:
+                  properties:
+                    periodTimeUnit:
+                      const: WEEK
+                  required:
+                    - periodTimeUnit
+                then:
+                  properties:
+                    limit:
+                      maximum: 181440000
+                else:
+                  properties:
+                    limit:
+                      maximum: 777600000
+      if:
+        properties:
+          type:
+            const: rate-limit
+        required:
+          - type
+      then:
+        properties:
+          config:
+            properties:
+              periodTimeUnit:
+                enum:
+                  - MINUTE
+                  - HOUR
+                  - DAY
+      else:
+        properties:
+          config:
+            properties:
+              periodTimeUnit:
+                enum:
+                  - DAY
+                  - WEEK
+                  - MONTH
+              keyResolver:
+                enum:
+                  - endpoint
     OAuthConfig:
       type: object
       description: |-
@@ -1965,12 +2221,28 @@ components:
             `resources`, the field is not normalized to an empty array).
           x-celigo-ai-guidance:
             - |-
-              Not editable via PATCH (the whitelist covers only `/name` and
-              `/disabled`). To change permission sets safely, GET the server,
+              Not editable via PATCH (the whitelist covers only `/name`,
+              `/disabled`, and `/policies`). To change permission sets safely, GET the server,
               modify `permissionSets`, and PUT the complete document back with
               every set's `_id` intact.
           items:
             $ref: '#/components/schemas/PermissionSet'
+        policies:
+          type: array
+          description: |-
+            Traffic limits enforced on this server before a tool runs — a
+            server-level rate limit, a per-user rate limit, and a usage quota, each
+            optional and independent. An empty array (the default) means unlimited.
+            Always returned; servers saved before traffic limits existed return an
+            empty array. Omitting the field on PUT clears every limit — send the
+            complete array back, or edit it with PATCH.
+          x-celigo-ai-guidance:
+            - |-
+              Leave `policies` empty unless the user asks for a limit — that is today's
+              default behavior. To change limits without touching the rest of the
+              document, PATCH `replace /policies` with the complete array.
+          items:
+            $ref: '#/components/schemas/Policy'
         oauth:
           $ref: '#/components/schemas/OAuthConfig'
     ResourceResponse:
@@ -2065,9 +2337,9 @@ components:
       type: object
       description: |-
         Request body for creating or updating an MCP server. On PUT, include
-        the full `tools`, `apis`, and `resources` arrays because omitted arrays
-        are cleared. Use PATCH to update individual fields without affecting
-        these arrays.
+        the full `tools`, `apis`, `prompts`, `resources`, `permissionSets`, and
+        `policies` arrays because omitted arrays are cleared. Use PATCH to update individual
+        fields without affecting these arrays.
       x-celigo-ai-guidance:
         - |-
           MCP servers expose Celigo tools, builder-mode APIs,

package/dist/tradingpartnerconnector.yml

@@ -1396,12 +1396,22 @@ components:
         `preConfiguredFields` must include a `type` path (e.g. `ftp` or
         `as2`) and export/import must include `file.type` set to
         `filedefinition` -- these are validated when `published` is `true`.
+
+        `type`, `region`, and `model` must match the deployment's configured
+        values exactly, including case. A value outside the list is not
+        rejected with a validation error: the request never completes (no
+        response is returned) and nothing is created or changed.
       x-celigo-ai-guidance:
         - |-
           Trading partner connectors define reusable templates for onboarding EDI trading partners.
           They specify which fields are pre-configured and which fields the user must
           provide for connections,
           exports, imports, and EDI profiles.
+        - |-
+          Send `type`, `region`, and `model` exactly as configured (`AS2`, not `as2`;
+          `North America`; `Dropship`). An out-of-list value gets no response at all — the
+          create or update never completes and nothing is saved — so a request that hangs
+          on this endpoint means a categorization value is wrong, not that the platform is slow.
         - |-
           When `published` is true, the connector's `supportedBy` sections are validated
           to ensure all required fields are present. For example:

package/dist/user.yml

@@ -125,7 +125,10 @@ paths:
       operationId: getUser
       tags:
         - Users
-      description: Retrieve a single user's access record by its id.
+      description: |-
+        Retrieve a single user's access record by its id. Returns workspace
+        records only — an end-user access-record id is not found here; read
+        those from `GET /v1/endusers`.
       parameters:
         - name: _id
           in: path
@@ -173,10 +176,17 @@ paths:
       tags:
         - Users
       description: |-
-        Update a user's access level, integration permissions, or account
-        settings. The user's email cannot be changed after invite. To
-        disable a user without deleting, use `PUT /v1/ashares/{_id}/disable`
-        instead.
+        Replaces a workspace user's access settings. The body must grant access
+        through `accessLevel` or a non-empty `integrationAccessLevel`, and
+        `integrationAccessLevel`, `accountSSORequired`, and `accountMFARequired`
+        are cleared when omitted — send every value to keep. `disabled` is not
+        applied here; toggle it with `PUT /v1/ashares/{_userId}/disable`.
+        Read-only fields echoed from the GET response are ignored, except
+        `userType`, which is rejected. The user's email cannot be changed after
+        invite. Callable from the production environment only.
+
+        End-user access records share this route with a different body — see
+        the End Users API.
       parameters:
         - name: _id
           in: path
@@ -193,30 +203,81 @@ paths:
               $ref: '#/components/schemas/Request'
             examples:
               changeAccessLevel:
-                summary: Change to administrator
+                summary: Change to administrator (resend the SSO/MFA settings — omitted ones are cleared)
                 value:
                   accessLevel: administrator
+                  integrationAccessLevel: []
+                  accountSSORequired: false
+                  accountMFARequired: true
               integrationOnly:
-                summary: Integration-only access
+                summary: Integration-only access (no accessLevel; resend the SSO/MFA settings)
                 value:
                   integrationAccessLevel:
                     - _integrationId: 68f52162f00a35a1b26eaafb
                       accessLevel: manage
                     - _integrationId: 6842261335b64c0bcb308e4f
                       accessLevel: monitor
-              disableUser:
-                summary: Re-enable a disabled user
+                  accountSSORequired: false
+                  accountMFARequired: true
+              keepSettings:
+                summary: Change access level, keeping every other setting
                 value:
-                  disabled: false
+                  accessLevel: monitor
+                  integrationAccessLevel: []
+                  accountSSORequired: false
+                  accountMFARequired: true
+                  allowToEditRetryData: true
       responses:
         '204':
           description: User updated.
         '400':
-          $ref: '#/components/responses/400-bad-request'
+          description: The body grants no access, or echoes the read-only `userType`.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                noAccessGranted:
+                  summary: Neither accessLevel nor integrationAccessLevel sent
+                  value:
+                    errors:
+                      - code: invalid_request
+                        message: To update the account access you need to either provide account level access or integration level access.
+                userTypeEchoed:
+                  summary: Read-only userType sent back
+                  value:
+                    errors:
+                      - code: validation_failed
+                        message: userType is immutable after creation.
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          description: The call was made from a sandbox environment.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                sandboxEnvironment:
+                  value:
+                    errors:
+                      - code: access_restricted
+                        message: This request can only be made through the production environment.
         '404':
           $ref: '#/components/responses/404-not-found'
+        '422':
+          description: '`integrationAccessLevel` is empty and no `accessLevel` was sent.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                emptyIntegrationAccess:
+                  value:
+                    errors:
+                      - code: missing_required_field
+                        field: accessLevel
+                        message: You need to provide user with either an account level access or integration level access.
     delete:
       x-internal: false
       summary: Delete a user
@@ -251,8 +312,12 @@ paths:
       summary: Toggle a user's account access (disable or re-enable)
       description: |-
         Toggles the `disabled` flag on a user's access record. Call again to
-        re-enable — there is no separate `/enable` path. Only works on users
-        with `accepted: true`.
+        re-enable — there is no separate `/enable` path, and this is the only
+        way to change `disabled` (the update operation does not apply it). A
+        pending invitation cannot be toggled until the invited user accepts or
+        declines it.
+
+        End-user access records share this route — see the End Users API.
       parameters:
         - name: _userId
           in: path
@@ -278,7 +343,17 @@ paths:
         '204':
           description: User access toggled.
         '400':
-          $ref: '#/components/responses/400-bad-request'
+          description: The invitation is still pending.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                pendingInvitation:
+                  value:
+                    errors:
+                      - code: invalid_request
+                        message: You can't disable this invitation without it being accepted or dismissed by the invited user.
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '404':
@@ -435,9 +510,6 @@ components:
       type: object
       description: Writable fields shared by the request and response schemas.
       properties:
-        disabled:
-          type: boolean
-          description: Set to False to enable a disabled user, or True to maintain disabled
         accessLevel:
           type: string
           description: |-
@@ -452,8 +524,14 @@ components:
               `integrationAccessLevel` undefined/empty
 
             If per-integration level permissions are needed, omit `accessLevel` and instead populate `integrationAccessLevel`.
+
+            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `integrationAccessLevel`,
+            `accountSSORequired`, and `accountMFARequired` are cleared when omitted, so resend every value to keep.
           x-celigo-ai-guidance:
             - Choose the `accessLevel` value based on what the user should be able to do across the account.
+            - |-
+              On PUT, "omit" means "clear" for integrationAccessLevel, accountSSORequired, and
+              accountMFARequired — GET the record first and resend those three with the new accessLevel.
           enum:
             - monitor
             - manage
@@ -472,6 +550,8 @@ components:
             - If `accessLevel` is omitted, this creates **integration-only** access.
             - If `accessLevel` is `monitor`, this grants **elevated access** (typically `manage`) for specific integrations.
             - If `accessLevel` is `manage` or `administrator`, do not set `integrationAccessLevel`.
+
+            Cleared when omitted on update — send `[]` explicitly only when you mean no per-integration grants.
           items:
             type: object
             properties:
@@ -493,12 +573,16 @@ components:
                   manage: Full access to edit the integration and its resources.
         accountSSORequired:
           type: boolean
-          description: When true, SSO is required for this user in this account.
+          description: |-
+            When true, SSO is required for this user in this account. Cleared when
+            omitted on update — resend it with every `PUT /v1/ashares/{_id}`.
           x-celigo-ai-guidance:
             - Whether the invited user must use SSO to access this account.
         accountMFARequired:
           type: boolean
-          description: When true, MFA is required for this user in this account.
+          description: |-
+            When true, MFA is required for this user in this account. Cleared when
+            omitted on update — resend it with every `PUT /v1/ashares/{_id}`.
           x-celigo-ai-guidance:
             - Whether the invited user must use MFA to access this account.
         allowAccessToAPIM:
@@ -601,6 +685,13 @@ components:
               type: boolean
               readOnly: true
               description: When true, the user has accepted the invitation to join the account.
+            disabled:
+              type: boolean
+              readOnly: true
+              description: |-
+                When true, the user's access to the account is suspended. Changed
+                only by `PUT /v1/ashares/{_userId}/disable` — a value sent on the
+                update operation is accepted but not applied.
             userType:
               type: string
               readOnly: true
@@ -608,8 +699,10 @@ components:
                 - workspace
               description: |-
                 Discriminates workspace users from end users on the underlying
-                access-record model. This endpoint only returns `workspace`
-                records — end users are managed through the End Users API.
+                access-record model. Reads on this API return only `workspace`
+                records — end users are managed through the End Users API, which
+                shares the update and disable routes. Sending it back on update
+                is rejected.
               x-enumDescriptions:
                 workspace: A workspace (team member) access record.
             lastSignIn:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "9257926",
+		"iasCommit": "641fc30",
 		"generatedAt": "2026-09-18"
 	},
 	"roots": {
@@ -20,11 +20,11 @@
 		"integration": 642,
 		"lookupcache": 644,
 		"mcpoauthprovider": 648,
-		"mcpserver": 679,
-		"script": 680,
-		"stack": 687,
-		"sync": 697,
-		"tool": 714
+		"mcpserver": 685,
+		"script": 686,
+		"stack": 693,
+		"sync": 703,
+		"tool": 720
 	},
 	"defs": [
 		{
@@ -7879,8 +7879,9 @@
 				"description": 1,
 				"disabled": 9,
 				"name": 1,
-				"oauth": 678,
+				"oauth": 684,
 				"permissionSets": 677,
+				"policies": 683,
 				"prompts": 674,
 				"relativeURI": 1,
 				"resources": 666,
@@ -8154,6 +8155,64 @@
 			],
 			"i": 675
 		},
+		{
+			"t": [
+				"object"
+			],
+			"p": {
+				"config": 682,
+				"enabled": 9,
+				"name": 1,
+				"type": 679
+			}
+		},
+		{
+			"t": [
+				"string"
+			],
+			"e": [
+				"quota",
+				"rate-limit"
+			]
+		},
+		{
+			"t": [
+				"string"
+			],
+			"e": [
+				"DAY",
+				"HOUR",
+				"MINUTE",
+				"MONTH",
+				"WEEK"
+			]
+		},
+		{
+			"t": [
+				"string"
+			],
+			"e": [
+				"consumer",
+				"endpoint"
+			]
+		},
+		{
+			"t": [
+				"object"
+			],
+			"p": {
+				"keyResolver": 681,
+				"limit": 124,
+				"periodTime": 124,
+				"periodTimeUnit": 680
+			}
+		},
+		{
+			"t": [
+				"array"
+			],
+			"i": 678
+		},
 		{
 			"t": [
 				"object"
@@ -8184,8 +8243,9 @@
 				"draftExpiresAt": 1,
 				"lastModified": 1,
 				"name": 1,
-				"oauth": 678,
+				"oauth": 684,
 				"permissionSets": 677,
+				"policies": 683,
 				"prompts": 674,
 				"relativeURI": 1,
 				"resources": 666,
@@ -8270,9 +8330,9 @@
 			],
 			"p": {
 				"accessKeyId": 1,
-				"awsRegion": 684,
+				"awsRegion": 690,
 				"functionName": 1,
-				"language": 685,
+				"language": 691,
 				"secretAccessKey": 1
 			}
 		},
@@ -8283,12 +8343,12 @@
 			"p": {
 				"_id": 1,
 				"createdAt": 1,
-				"framework": 682,
-				"lambda": 686,
+				"framework": 688,
+				"lambda": 692,
 				"lastModified": 1,
 				"name": 1,
-				"server": 683,
-				"type": 681
+				"server": 689,
+				"type": 687
 			}
 		},
 		{
@@ -8315,8 +8375,8 @@
 				"object"
 			],
 			"p": {
-				"dataset": 693,
-				"element": 694
+				"dataset": 699,
+				"element": 700
 			}
 		},
 		{
@@ -8341,8 +8401,8 @@
 				"object"
 			],
 			"p": {
-				"added": 691,
-				"removed": 692
+				"added": 697,
+				"removed": 698
 			}
 		},
 		{
@@ -8350,12 +8410,12 @@
 				"object"
 			],
 			"p": {
-				"added": 691,
-				"arrayAdded": 696,
-				"expanded": 692,
-				"objectAdded": 695,
-				"reduced": 692,
-				"removed": 692
+				"added": 697,
+				"arrayAdded": 702,
+				"expanded": 698,
+				"objectAdded": 701,
+				"reduced": 698,
+				"removed": 698
 			}
 		},
 		{
@@ -8385,13 +8445,13 @@
 				"_integrationId": 1,
 				"_userId": 1,
 				"description": 1,
-				"destination": 689,
+				"destination": 695,
 				"disabled": 9,
-				"driftPolicy": 690,
+				"driftPolicy": 696,
 				"historicDateTime": 1,
 				"name": 1,
 				"schedule": 1,
-				"source": 688,
+				"source": 694,
 				"timezone": 1
 			}
 		},
@@ -8404,10 +8464,10 @@
 				"aiDescription": 131,
 				"description": 1,
 				"draft": 9,
-				"input": 699,
+				"input": 705,
 				"name": 1,
-				"output": 707,
-				"routers": 713
+				"output": 713,
+				"routers": 719
 			}
 		},
 		{
@@ -8420,7 +8480,7 @@
 				"mockInput": 10,
 				"name": 1,
 				"schema": 10,
-				"transform": 700
+				"transform": 706
 			}
 		},
 		{
@@ -8428,7 +8488,7 @@
 				"object"
 			],
 			"p": {
-				"expression": 706,
+				"expression": 712,
 				"script": 109,
 				"type": 104
 			}
@@ -8437,14 +8497,14 @@
 			"t": [
 				"array"
 			],
-			"i": 702
+			"i": 708
 		},
 		{
 			"t": [
 				"object"
 			],
 			"p": {
-				"buildArrayHelper": 704,
+				"buildArrayHelper": 710,
 				"conditional": 96,
 				"dataType": 87,
 				"default": 88,
@@ -8456,7 +8516,7 @@
 				"generateDateFormat": 1,
 				"generateDateTimezone": 1,
 				"lookupName": 1,
-				"mappings": 701,
+				"mappings": 707,
 				"sourceDataType": 87,
 				"status": 94
 			}
@@ -8469,7 +8529,7 @@
 				"conditional": 91,
 				"default": 88,
 				"extract": 1,
-				"mappings": 701,
+				"mappings": 707,
 				"sourceDataType": 87
 			}
 		},
@@ -8477,7 +8537,7 @@
 			"t": [
 				"array"
 			],
-			"i": 703
+			"i": 709
 		},
 		{
 			"t": [
@@ -8486,7 +8546,7 @@
 			"p": {
 				"inputContext": 102,
 				"lookups": 116,
-				"mappings": 701,
+				"mappings": 707,
 				"mode": 115
 			}
 		},
@@ -8496,7 +8556,7 @@
 			],
 			"p": {
 				"rules": 114,
-				"rulesTwoDotZero": 705,
+				"rulesTwoDotZero": 711,
 				"version": 111
 			}
 		},
@@ -8508,8 +8568,8 @@
 				"debugUntil": 1,
 				"description": 1,
 				"hooks": 196,
-				"lookups": 709,
-				"mappings": 701,
+				"lookups": 715,
+				"mappings": 707,
 				"mockInput": 10,
 				"name": 1,
 				"schema": 10
@@ -8530,14 +8590,14 @@
 			"t": [
 				"array"
 			],
-			"i": 708
+			"i": 714
 		},
 		{
 			"t": [
 				"object"
 			],
 			"p": {
-				"branches": 712,
+				"branches": 718,
 				"id": 1,
 				"name": 1,
 				"routeRecordsTo": 172,
@@ -8562,13 +8622,13 @@
 			"t": [
 				"array"
 			],
-			"i": 711
+			"i": 717
 		},
 		{
 			"t": [
 				"array"
 			],
-			"i": 710
+			"i": 716
 		},
 		{
 			"t": [
@@ -8584,11 +8644,11 @@
 				"description": 1,
 				"draft": 9,
 				"draftExpiresAt": 1,
-				"input": 699,
+				"input": 705,
 				"lastModified": 1,
 				"name": 1,
-				"output": 707,
-				"routers": 713
+				"output": 713,
+				"routers": 719
 			}
 		}
 	]