@celigo/api-specs 0.2.25 → 0.2.27

package/dist/editransaction.yml

@@ -721,7 +721,9 @@ components:
           description: |-
             Job ID of the flow run that processed the functional acknowledgement
             (997 / CONTRL) for this transaction. Present only once an FA has been
-            received and processed.
+            received and processed. Use this job — not `_flowJobId` — with
+            `POST /v1/jobs/{_faFlowJobId}/files/signedURL` (body
+            `{ "fileIds": ["<faS3Key>"] }`) to download the FA file.
           x-celigo-refModel: jobs
           examples:
             - 6a05fdbf0f139ef519238dd7
@@ -806,8 +808,13 @@ components:
             Opaque file identifier for the stored functional-acknowledgement
             (997 / CONTRL) file. Present only once an FA has been received.
             One acknowledgement file can cover many transactions, which then
-            share the same `faS3Key`. Download it via
-            `GET /v1/ediTransactions/{_ediTransactionId}/ediFile?type=fa`.
+            share the same `faS3Key`. To download the FA file, combine with
+            `_faFlowJobId` (the FA-processing flow run — not `_flowJobId`) and
+            call `POST /v1/jobs/{_faFlowJobId}/files/signedURL` with body
+            `{ "fileIds": ["<faS3Key>"] }`. For parsed FA failure details, use
+            `GET /v1/ediTransactions/{_ediTransactionId}/faDetails?fileType=<X12|EDIFACT>`
+            — pass the transaction's own `fileType`; the route answers 404 without it
+            (available only for transactions with a rejected FA status).
           examples:
             - 9a7c3e14b2af45d8bc0e6090c5be6afa
         mdnStatus:

package/dist/enduser.yml

@@ -21,7 +21,9 @@ tags:
       getting workspace access — they sign in through MCP OAuth, optionally
       via an external IdP. Use these endpoints to invite end users (singly or
       in bulk), list and revoke them, and inspect the effective MCP tool
-      access compiled from their grants, groups, and roles.
+      access compiled from their grants, groups, and roles. An end user's
+      access record is an ashare, so editing its grants and suspending it
+      use the `/v1/ashares` routes shared with workspace users.
 
       ## End user schema
 
@@ -325,6 +327,131 @@ paths:
           $ref: '#/components/responses/403-forbidden'
         '404':
           $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_ashareId}:
+    put:
+      x-internal: false
+      summary: Update an end user's access
+      operationId: updateEndUser
+      tags:
+        - End Users
+      description: |-
+        Replaces the end user's group memberships and direct resource grants with
+        the arrays sent. Works on invited end users before they accept. `disabled`
+        is not applied here — use `PUT /v1/ashares/{_ashareId}/disable`.
+
+        An end user's access record is an ashare, so this is the same route as
+        the workspace-user update in the Users API, with this body instead of the
+        workspace fields. `GET /v1/ashares/{_id}` does not return end-user
+        records — read them from `GET /v1/endusers`.
+      parameters:
+        - name: _ashareId
+          in: path
+          required: true
+          description: End-user access-record id (from the end users list).
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/EndUserUpdateRequest'
+            examples:
+              removeDirectGrant:
+                summary: Keep one group, drop a direct grant
+                value:
+                  groupMemberships:
+                    - _groupId: 68a1b2c3d4e5f6a7b8c9d0e1
+                      source: manual
+                  resourceGrants: []
+              grantServer:
+                summary: Add a direct grant on one MCP server
+                value:
+                  groupMemberships: []
+                  resourceGrants:
+                    - resourceType: mcpServer
+                      _resourceId: 6a1b2c3d4e5f6a7b8c9d0e1f
+                      capabilities:
+                        - tool:all
+      responses:
+        '200':
+          description: |-
+            The updated access record as stored. The identity fields the list
+            joins in (`email`, `name`, `lastSignIn`) and `hasWorkspaceShare` are
+            not included, and empty arrays may be omitted.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EndUser'
+              examples:
+                default:
+                  value:
+                    _id: 68b1c2d3e4f5a6b7c8d9e0f1
+                    _sharedWithUserId: 624774a6a7574d3ed9f9a5cc
+                    userType: end-user
+                    provisionedBy: invite
+                    accepted: true
+                    groupMemberships:
+                      - _groupId: 68a1b2c3d4e5f6a7b8c9d0e1
+                        source: manual
+                    createdAt: '2026-07-01T09:15:32Z'
+                    lastModified: '2026-08-15T14:30:15Z'
+        '400':
+          $ref: '#/components/responses/400-bad-request'
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_ashareId}/disable:
+    put:
+      x-internal: false
+      summary: Toggle an end user's access
+      operationId: toggleEndUserDisabled
+      tags:
+        - End Users
+      description: |-
+        Toggles the `disabled` flag on the end user's access record — call again
+        to restore access; there is no separate `/enable` path. Unlike the
+        workspace toggle, this also works on invited end users who have not yet
+        accepted. Shares its route with the workspace-user toggle in the Users
+        API.
+      parameters:
+        - name: _ashareId
+          in: path
+          required: true
+          description: End-user access-record id (from the end users list).
+          schema:
+            type: string
+            format: objectId
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Empty body — the target is identified by the path parameter alone.
+            examples:
+              default:
+                summary: Empty body
+                value: {}
+      responses:
+        '204':
+          description: End-user access toggled.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          description: End user not found.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                ashare_not_found:
+                  value:
+                    errors:
+                      - code: invalid_ref
+                        message: AShare not found.
   /v1/groups:
     get:
       x-internal: false
@@ -1010,7 +1137,10 @@ components:
           description: When true, the end user has declined the invitation.
         disabled:
           type: boolean
-          description: When true, the end user's access is suspended without deleting the record.
+          description: |-
+            When true, the end user's access is suspended without deleting the
+            record. Changed only by `PUT /v1/ashares/{_ashareId}/disable` — a
+            value sent on the update operation is not applied.
         groupMemberships:
           type: array
           description: Groups this end user belongs to, with the source of each membership.
@@ -1418,6 +1548,25 @@ components:
                     reason:
                       type: string
                       description: Why the tool is not available to this end user.
+    EndUserUpdateRequest:
+      type: object
+      description: |-
+        Replacement access for an end user. Both arrays are stored as sent, so
+        each must carry every entry to keep, not just the changes.
+      required:
+        - groupMemberships
+        - resourceGrants
+      properties:
+        groupMemberships:
+          type: array
+          description: Complete set of groups the end user should belong to after the update.
+          items:
+            $ref: '#/components/schemas/GroupMembership'
+        resourceGrants:
+          type: array
+          description: Complete set of direct resource grants the end user should hold after the update.
+          items:
+            $ref: '#/components/schemas/ResourceGrant'
     Group:
       type: object
       description: |-