@celigo/api-specs 0.2.47 → 0.2.49

package/dist/editransaction.yml

@@ -809,9 +809,10 @@ components:
         sender/receiver IDs and control numbers — see individual field
         descriptions.
 
-        Transaction records are retained for a license-dependent window (30, 60,
-        or 180 days after last modification) and then expire; expired transactions
-        no longer appear in query results. Unlike most resources, these records
+        Transaction records are retained for the account's data retention period
+        (`dataRetentionPeriod` on account settings: 30, 60, 90 or 180 days after
+        last modification; the license sets the ceiling) and then expire; expired
+        transactions no longer appear in query results. Unlike most resources, these records
         are not soft-deleted into the recycle bin, and `createdAt` / `deletedAt`
         are not returned.
       properties:
@@ -828,7 +829,10 @@ components:
           readOnly: true
           description: |-
             Timestamp when the record was last updated (e.g. by an faStatus
-            change). Also restarts the retention window.
+            change). Also restarts the retention window — the record is kept for
+            the account's `dataRetentionPeriod` (30, 60, 90 or 180 days) after
+            this timestamp, so a record can outlive the raw file behind it, whose
+            period counts from when the file was stored.
           examples:
             - '2026-04-15T14:30:15.123Z'
         _userId:

package/dist/mcp-server.yml

@@ -515,8 +515,11 @@ paths:
         array, `add` works at `/policies/-` or an index, and `replace` works at
         an index or a sub-path such as `/policies/0/config/limit`; `remove` at
         an array index is rejected with 422 `Remove at array index is not
-        supported`. The resulting array is validated as a whole, and an invalid
-        policy rejects the entire patch. `/_networkPolicyId` takes `add`,
+        supported`. The resulting array is validated as a whole, and a policy
+        with invalid `config` (422 `policy_config_invalid`), a missing `name`,
+        or a second policy of the same `type` and `keyResolver` (422
+        `mcp_server_duplicate_policy`) rejects the entire patch.
+        `/_networkPolicyId` takes `add`,
         `replace` (a policy in the same environment, else 422 `invalid_ref`),
         and `remove` to unassign — `replace` with a `null` value is rejected
         with 422 `missing 'value' property`. Setting `/disabled` to `false` is rejected
@@ -2762,17 +2765,21 @@ components:
         server (`keyResolver` `endpoint`) or separately for each OAuth end user
         (`keyResolver` `consumer`); a `quota` caps cumulative calls over a UTC
         calendar DAY, WEEK, or MONTH across every consumer. A call must pass every
-        enabled policy. A rejected call is not executed and receives HTTP 429 with
-        a `Retry-After` header (seconds until the allowance refills or the quota
+        enabled policy. A second policy of the same `type` and `keyResolver` is
+        rejected with 422 `mcp_server_duplicate_policy`. A rejected call is not
+        executed, does not count toward usage, and receives HTTP 429 with a
+        `Retry-After` header (seconds until the allowance refills or the quota
         period resets), an `X-RateLimit-Limit` header, and a JSON-RPC error
         (code -32004) whose message names the policy: `Rate limit exceeded: <name>`
-        or `Usage quota exceeded: <name>`.
+        or `Usage quota exceeded: <name>`. A quota counts only calls accepted after
+        it was added; editing the limit keeps the running count for the current UTC
+        period, and removing then re-adding the quota starts a new count.
       x-celigo-ai-guidance:
         - |-
           Configure one policy per kind — one server-level rate limit, one per-user
-          rate limit (`keyResolver` `consumer`), one quota. The API does not reject a
-          second policy of the same kind; both are then enforced against the same
-          traffic, which makes the effective limit hard to reason about.
+          rate limit (`keyResolver` `consumer`), one quota. A second policy of the
+          same `type` and `keyResolver` is rejected with 422
+          `mcp_server_duplicate_policy`.
         - |-
           A `tools/call` counts against every enabled policy, even when the named tool
           does not exist; `initialize`, `tools/list`, `prompts/list`, and `resources/list`
@@ -2785,9 +2792,10 @@ components:
         - |-
           A rate limit keeps its allowance state when its `limit` is changed, so raising
           a limit right after it tripped admits nothing until tokens refill at the new
-          rate. A quota counts every call the server accepted in the current UTC period,
-          including calls made before the quota was configured — a quota below the
-          period's current count rejects every call until the period resets.
+          rate. A quota counts calls accepted after it was added in the current UTC
+          period; editing the limit keeps the running count, and removing then
+          re-adding the quota starts a new count. Calls rejected by a traffic limit
+          do not consume quota, so raising a quota mid-period takes effect immediately.
       required:
         - type
         - name
@@ -2809,10 +2817,11 @@ components:
             - rate-limit
         name:
           type: string
-          maxLength: 100
+          maxLength: 200
           description: |-
-            Label for the limit, echoed verbatim in the 429 error message that
-            rejected clients receive — name it the way consumers should read it.
+            Required label for the limit, echoed verbatim in the 429 error message
+            that rejected clients receive — name it the way consumers should read
+            it. A missing or empty name is rejected with 422.
           examples:
             - Server-level rate limit
             - Per-user rate limit
@@ -3253,10 +3262,15 @@ components:
           description: |-
             Traffic limits enforced on this server before a tool runs — a
             server-level rate limit, a per-user rate limit, and a usage quota, each
-            optional and independent. An empty array (the default) means unlimited.
-            Always returned; servers saved before traffic limits existed return an
-            empty array. Omitting the field on PUT clears every limit — send the
-            complete array back, or edit it with PATCH.
+            optional and independent. At most one policy per `type` and
+            `keyResolver` is allowed; a second is rejected with 422
+            `mcp_server_duplicate_policy`. An empty array (the default) means
+            unlimited. Always returned; servers saved before traffic limits existed
+            return an empty array. Omitting the field on PUT clears every limit —
+            send the complete array back, or edit it with PATCH. A quota counts
+            calls accepted after it is saved; edits that keep the same `type` and
+            `keyResolver` keep counting from the original add time, and removing
+            the quota (then adding it again) starts a new count.
           x-celigo-ai-guidance:
             - |-
               Leave `policies` empty unless the user asks for a limit — that is today's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.47",
+  "version": "0.2.49",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "f237220",
-		"generatedAt": "2026-09-23"
+		"iasCommit": "f1b9b36",
+		"generatedAt": "2026-09-24"
 	},
 	"roots": {
 		"aiagent": 133,