@celigo/api-specs 0.2.39 → 0.2.40

package/dist/user.yml

@@ -126,9 +126,11 @@ paths:
       tags:
         - Users
       description: |-
-        Retrieve a single user's access record by its id. Returns workspace
-        records only — an end-user access-record id is not found here; read
-        those from `GET /v1/endusers`.
+        Retrieve a single user's access record by its id. Returns the bare record:
+        the user is identified by `_sharedWithUserId` rather than the expanded
+        `sharedWithUser` the list returns, and `isProductionAdmin` is not computed.
+        Returns workspace records only — an end-user access-record id is not found
+        here; read those from `GET /v1/endusers`.
       parameters:
         - name: _id
           in: path
@@ -148,23 +150,18 @@ paths:
                 default:
                   value:
                     _id: 6798f4dc43db9184f4bc8ee0
+                    _sharedWithUserId: 624774a6a7574d3ed9f9a5cc
                     accepted: true
                     accessLevel: administrator
                     integrationAccessLevel: []
                     accountSSORequired: false
                     accountMFARequired: false
-                    isProductionAdmin: true
                     allowIntegrationWorkspaceCreation: false
                     createdVia: existing_account_invite
                     lastModified: '2026-05-02T17:02:59.371Z'
                     createdAt: '2025-01-28T15:16:44.327Z'
                     lastSignIn: '2026-05-02T17:02:59.370Z'
-                    sharedWithUser:
-                      _id: 624774a6a7574d3ed9f9a5cc
-                      email: admin@example.com
-                      name: Account Admin
-                      allowedToResetMFA: false
-                      accountSSOLinked: not_linked
+                    userType: workspace
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '404':
@@ -178,8 +175,10 @@ paths:
       description: |-
         Replaces a workspace user's access settings. The body must grant access
         through `accessLevel` or a non-empty `integrationAccessLevel`, and
-        `integrationAccessLevel`, `accountSSORequired`, and `accountMFARequired`
-        are cleared when omitted — send every value to keep. `disabled` is not
+        `integrationAccessLevel` and `accountMFARequired` are cleared when
+        omitted — send every value to keep. `accountSSORequired` is the
+        exception: it changes only when the body carries it, and is ignored
+        while the account enforces SSO for every user. `disabled` is not
         applied here; toggle it with `PUT /v1/ashares/{_userId}/disable`.
         Read-only fields echoed from the GET response are ignored, except
         `userType`, which is rejected. The user's email cannot be changed after
@@ -203,28 +202,26 @@ paths:
               $ref: '#/components/schemas/Request'
             examples:
               changeAccessLevel:
-                summary: Change to administrator (resend the SSO/MFA settings — omitted ones are cleared)
+                summary: Change to administrator (resend accountMFARequired — omitted means cleared)
                 value:
                   accessLevel: administrator
                   integrationAccessLevel: []
-                  accountSSORequired: false
                   accountMFARequired: true
               integrationOnly:
-                summary: Integration-only access (no accessLevel; resend the SSO/MFA settings)
+                summary: Integration-only access (no accessLevel; resend accountMFARequired)
                 value:
                   integrationAccessLevel:
                     - _integrationId: 68f52162f00a35a1b26eaafb
                       accessLevel: manage
                     - _integrationId: 6842261335b64c0bcb308e4f
                       accessLevel: monitor
-                  accountSSORequired: false
                   accountMFARequired: true
-              keepSettings:
-                summary: Change access level, keeping every other setting
+              requireSso:
+                summary: Turn on SSO for the user while keeping every other setting
                 value:
                   accessLevel: monitor
                   integrationAccessLevel: []
-                  accountSSORequired: false
+                  accountSSORequired: true
                   accountMFARequired: true
                   allowToEditRetryData: true
       responses:
@@ -418,6 +415,94 @@ paths:
           $ref: '#/components/responses/401-unauthorized'
         '404':
           $ref: '#/components/responses/404-not-found'
+  /v1/ashares/{_id}/accept:
+    put:
+      x-internal: false
+      summary: Accept an account invitation
+      operationId: acceptAccountInvitation
+      tags:
+        - Users
+      description: |-
+        Accepts an invitation to another user's account on behalf of the caller.
+        The `_id` is a share record addressed *to* the caller — take it from
+        `GET /v1/shared/ashares`, not from `GET /v1/ashares`. Pending invitations
+        from the same owner's other environments are accepted with it, and the
+        owner is notified by email. Accepting an invitation that is already
+        accepted changes nothing. A user who still owns integrations, flows, or
+        syncs must transfer or delete them before they can join another account.
+      x-celigo-ai-guidance:
+        - Recipient-side operation — the caller's own token accepts the share. To grant access to your account, use `POST /v1/invite/multiple` instead.
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: Share record id from `GET /v1/shared/ashares`.
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 612345abcdef6789012345ab
+      responses:
+        '204':
+          description: Invitation accepted (or already accepted).
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          description: No share with this id is addressed to the caller.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                notShared:
+                  value:
+                    errors:
+                      - code: invalid_ref
+                        message: AShare not found.
+  /v1/ashares/{_id}/dismiss:
+    put:
+      x-internal: false
+      summary: Dismiss an account invitation
+      operationId: dismissAccountInvitation
+      tags:
+        - Users
+      description: |-
+        Declines an invitation to another user's account on behalf of the caller.
+        The `_id` is a share record addressed *to* the caller — take it from
+        `GET /v1/shared/ashares`. Pending invitations from the same owner's other
+        environments are dismissed with it, and the owner is notified by email;
+        they can send it again with `PUT /v1/ashares/{_id}/reinvite`. Dismissing
+        an invitation that is already dismissed changes nothing. To leave an
+        account whose invitation you accepted, use `DELETE /v1/shared/ashares/{_id}`.
+      x-celigo-ai-guidance:
+        - Recipient-side operation — the caller's own token declines the share. To remove a user from your account, use `DELETE /v1/ashares/{_id}` instead.
+      parameters:
+        - name: _id
+          in: path
+          required: true
+          description: Share record id from `GET /v1/shared/ashares`.
+          schema:
+            type: string
+            format: objectId
+            examples:
+              - 612345abcdef6789012345ab
+      responses:
+        '204':
+          description: Invitation dismissed (or already dismissed).
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '404':
+          description: No share with this id is addressed to the caller.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                notShared:
+                  value:
+                    errors:
+                      - code: invalid_ref
+                        message: AShare not found.
   /v1/invite/multiple:
     post:
       x-internal: false
@@ -525,21 +610,28 @@ components:
 
             If per-integration level permissions are needed, omit `accessLevel` and instead populate `integrationAccessLevel`.
 
-            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `integrationAccessLevel`,
-            `accountSSORequired`, and `accountMFARequired` are cleared when omitted, so resend every value to keep.
+            On update (`PUT /v1/ashares/{_id}`) the body replaces the access settings: `integrationAccessLevel`
+            and `accountMFARequired` are cleared when omitted, so resend them to keep them. `accountSSORequired`
+            is different — it changes only when the body carries it.
+
+            `none` is written by SCIM provisioning for a user who has no account-wide grant; do not send it
+            yourself — omit `accessLevel` and use `integrationAccessLevel` for integration-only access.
           x-celigo-ai-guidance:
             - Choose the `accessLevel` value based on what the user should be able to do across the account.
             - |-
-              On PUT, "omit" means "clear" for integrationAccessLevel, accountSSORequired, and
-              accountMFARequired — GET the record first and resend those three with the new accessLevel.
+              On PUT, "omit" means "clear" for integrationAccessLevel and accountMFARequired — GET the
+              record first and resend both with the new accessLevel. accountSSORequired keeps its stored
+              value when omitted.
           enum:
             - monitor
             - manage
             - administrator
+            - none
           x-enumDescriptions:
             monitor: Grants access to view all integrations, run flows, and troubleshoot flow errors (retry/resolve) without modifying integrations, flows, steps, resources, account settings, or users
             manage: Grants access to edit all integrations and resources and troubleshoot flow errors, but not to view or edit account settings or invite/manage users
             administrator: Grants full account administration, including editing account settings, resources, and integrations; inviting/managing users; and troubleshooting flow errors, but does not grant owner-only actions such as transferring account ownership or managing owner permissions
+            none: No account-wide grant; recorded by SCIM provisioning for users whose access is defined entirely by integrationAccessLevel
         integrationAccessLevel:
           type: array
           description: |-
@@ -574,10 +666,16 @@ components:
         accountSSORequired:
           type: boolean
           description: |-
-            When true, SSO is required for this user in this account. Cleared when
-            omitted on update — resend it with every `PUT /v1/ashares/{_id}`.
+            When true, the user must sign in through SSO to access this account. Written
+            only when present in the update body — omitting it on `PUT /v1/ashares/{_id}`
+            leaves the stored value unchanged. While the account enforces SSO for every
+            user, the value sent is ignored and the stored value is kept until that
+            enforcement is turned off.
+          examples:
+            - false
           x-celigo-ai-guidance:
             - Whether the invited user must use SSO to access this account.
+            - Send it only when you intend to change it; a PUT without it does not clear SSO enforcement for the user.
         accountMFARequired:
           type: boolean
           description: |-
@@ -657,7 +755,6 @@ components:
       type: object
       required:
         - _id
-        - sharedWithUser
         - integrationAccessLevel
         - createdAt
         - lastModified
@@ -665,10 +762,12 @@ components:
         A user's access record in the account. Each user who has been invited
         (or shared access) gets one record per account they belong to. The
         `_id` is the access-record id, not the user's own id — the user's
-        identity is in `sharedWithUser._id`. The account owner does not
-        appear in this list.
+        identity is in `sharedWithUser._id` on list and invite responses, and
+        in `_sharedWithUserId` on `GET /v1/ashares/{_id}`. The account owner
+        does not appear in this list.
       x-celigo-ai-guidance:
         - Account user object representing a user's access to the account
+        - The list expands the user into `sharedWithUser`; the single-record GET returns only `_sharedWithUserId`. Read the list when you need the email or name.
       allOf:
         - $ref: '#/components/schemas/UserBase'
         - type: object
@@ -681,6 +780,17 @@ components:
               examples:
                 - 6798f4dc43db9184f4bc8ee0
               description: Access-record id for this user in the account.
+            _sharedWithUserId:
+              type: string
+              format: objectId
+              readOnly: true
+              x-celigo-refModel: users
+              examples:
+                - 624774a6a7574d3ed9f9a5cc
+              description: |-
+                The user's own account id. Present on `GET /v1/ashares/{_id}`, which
+                returns the bare record; the list and invite responses expand it into
+                `sharedWithUser` instead.
             accepted:
               type: boolean
               readOnly: true
@@ -747,7 +857,10 @@ components:
             sharedWithUser:
               type: object
               readOnly: true
-              description: Identity details of the invited/shared user.
+              description: |-
+                Identity details of the invited/shared user. Present on the list and
+                invite responses; `GET /v1/ashares/{_id}` returns `_sharedWithUserId`
+                in its place.
               properties:
                 _id:
                   type: string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [