@celigo/api-specs 0.2.31 → 0.2.32

package/dist/enduser.yml

@@ -23,7 +23,11 @@ tags:
       in bulk), list and revoke them, and inspect the effective MCP tool
       access compiled from their grants, groups, and roles. An end user's
       access record is an ashare, so editing its grants and suspending it
-      use the `/v1/ashares` routes shared with workspace users.
+      use the `/v1/ashares` routes shared with workspace users. The account
+      owner is never an end user: owners already have MCP access without an
+      end-user record, the invite refuses the owner's address
+      (`owner_self_invite_not_allowed`), and the owner never appears in
+      these lists.
 
       ## End user schema
 
@@ -59,7 +63,9 @@ paths:
         Returns the account's end users with identity fields (`email`, `name`,
         `lastSignIn`) joined from each user record, plus a computed
         `hasWorkspaceShare` flag indicating whether the same person also holds a
-        workspace access record. Requires account owner or administrator access.
+        workspace access record. The account owner is never listed: owners
+        have MCP access without an end-user record, so none exists for them.
+        Requires account owner or administrator access.
       parameters:
         - name: provisionedBy
           in: query
@@ -124,8 +130,11 @@ paths:
       description: |-
         Finds or creates the user by email, creates an end-user access record,
         applies the requested group memberships and direct grants, and sends an
-        invite email. Account owners cannot be invited as end users. Requires
-        account owner or administrator access.
+        invite email. The account owner cannot be invited as an end user
+        (`owner_self_invite_not_allowed`): owners already have MCP access
+        without an end-user record, so there is nothing to grant — test
+        end-user access with a different address. Requires account owner or
+        administrator access.
       requestBody:
         required: true
         content:
@@ -163,7 +172,20 @@ paths:
                     _ashareId: 68b1c2d3e4f5a6b7c8d9e0f1
                     status: invited
         '400':
-          $ref: '#/components/responses/400-bad-request'
+          description: |-
+            The email is missing or invalid (`email_invalid`), or it is the
+            account owner's address (`owner_self_invite_not_allowed` — the owner
+            already has MCP access without an end-user record).
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                ownerSelfInvite:
+                  value:
+                    errors:
+                      - code: owner_self_invite_not_allowed
+                        message: Account owners cannot be invited as end-users. Owners already have MCP access without an end-user share.
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '403':
@@ -1403,7 +1425,7 @@ components:
                 x-enumDescriptions:
                   email_invalid: The email address is not valid
                   enduser_ashare_exists: An end-user record already exists for this user in the account
-                  owner_self_invite_not_allowed: Account owners cannot be invited as end users
+                  owner_self_invite_not_allowed: The address is the account owner's — owners already have MCP access without an end-user record
                   validation_failed: The shared groupIds or grants failed validation for this item
                   invite_failed: An unexpected per-item error, caught so the batch can continue
                 description: Failure reason. Present when status is `failed`.

package/dist/mcp-server.yml

@@ -551,8 +551,11 @@ paths:
         server and compiles each one's effective tool access with source
         attribution — the union of direct grants, group grants, role grants, and
         permission sets. The result is recomputed on every request rather than
-        cached. Requires account owner or administrator access. The per-user view
-        of the same compilation is `GET /v1/endusers/{_ashareId}/effective-access`
+        cached. The account owner is never listed — owners have MCP access
+        without an end-user record, so there is no record to compile — and an
+        empty result therefore means no end user has been granted this server.
+        Requires account owner or administrator access. The per-user view of the
+        same compilation is `GET /v1/endusers/{_ashareId}/effective-access`
         (End Users API).
       parameters:
         - name: _id

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.31",
+  "version": "0.2.32",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "bcdaef7",
+		"iasCommit": "762b9a7",
 		"generatedAt": "2026-09-19"
 	},
 	"roots": {