@celigo/api-specs 0.2.61 → 0.2.63

package/dist/enduser.yml

@@ -38,8 +38,8 @@ tags:
     description: |-
       Groups bundle roles and resource grants so end-user access can be
       managed collectively. End users receive a group's access through
-      membership, added manually or synced from an identity provider's group
-      claims.
+      membership, added manually or synced from an identity provider (group
+      claims at sign-in or a SCIM group push).
 
       ## Group schema
 
@@ -920,7 +920,8 @@ paths:
       description: |-
         Bulk-removes manual memberships from the group. Only manual memberships
         can be removed this way — attempting to remove an IdP-synced membership
-        returns 409; change the IdP group mapping instead. Uses POST rather than
+        returns 409; change the person's group in the identity provider (its
+        group mapping or SCIM group assignment) instead. Uses POST rather than
         DELETE so the request body survives proxies and CDNs. Requires account
         owner or administrator access.
       parameters:
@@ -1212,11 +1213,12 @@ components:
             - idp
           x-enumDescriptions:
             manual: Membership was added by an owner or administrator (invite or group members API)
-            idp: Membership is synced from the identity provider's group claims
+            idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
           description: |-
             How the membership was created. IdP-synced memberships cannot be
-            removed through the group members API — change the IdP group mapping
-            instead.
+            removed through the group members API — change the person's group in
+            the identity provider instead (its group mapping, or the SCIM group
+            assignment, whichever created the membership).
     ResourceGrant:
       type: object
       description: |-
@@ -1319,10 +1321,34 @@ components:
           x-enumDescriptions:
             invite: Created through an explicit invite (or by migration from a workspace user)
             jit: Provisioned just-in-time on first sign-in through an external IdP
-            scim: Provisioned by the identity provider through SCIM; carries the externalId and the IdP configuration it was created from
+            scim: Provisioned, or adopted from an invited or JIT record, by the identity provider through SCIM
           description: |-
-            How this end-user record was created. Records provisioned through SCIM are owned by the
-            identity provider — change their access there, not through this API.
+            How this end-user record was created. A SCIM push for a person who already has an invited
+            or JIT record adopts it in place, so the value can change to `scim` over the record's life.
+            For a SCIM-managed user the identity provider owns the active state and the IdP-sourced
+            group memberships and roles: `PUT /v1/ashares/{_ashareId}/disable` still toggles `disabled`,
+            but the identity provider's next push re-applies what it holds — deactivate the person or
+            change their groups in the IdP. Direct `resourceGrants` and `manual` memberships are never
+            touched by SCIM.
+        externalId:
+          type: string
+          readOnly: true
+          examples:
+            - 00u1a2b3c4d5e6f7g8h9
+          description: |-
+            Identifier the identity provider uses for this person in its own directory,
+            stored when the record is provisioned through SCIM. Present only when
+            `provisionedBy` is `scim`. SCIM matches people by email, not by this value.
+        _scimIdpConfigId:
+          type: string
+          format: objectId
+          readOnly: true
+          x-celigo-refModel: idpconfigs
+          examples:
+            - 68d1e2f3a4b5c6d7e8f9a0b1
+          description: |-
+            IdP configuration whose SCIM endpoint provisioned this record. Present
+            only when `provisionedBy` is `scim`.
         accepted:
           type: boolean
           description: When true, the end user has completed invite setup (or was JIT-provisioned).
@@ -1684,9 +1710,11 @@ components:
           enum:
             - invite
             - jit
+            - scim
           x-enumDescriptions:
             invite: Created through an explicit invite (or by migration from a workspace user)
             jit: Provisioned just-in-time on first sign-in through an external IdP
+            scim: Provisioned, or adopted from an invited or JIT record, by the identity provider through SCIM
           description: How the end-user record was created.
         groups:
           type: array
@@ -1708,9 +1736,9 @@ components:
                   - manual
                   - idp
                 x-enumDescriptions:
-                  manual: Membership was added by an owner or administrator
-                  idp: Membership is synced from the identity provider's group claims
-                description: How the end user's membership in this group was created.
+                  manual: Membership was added by an owner or administrator (invite or group members API)
+                  idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
+                description: How the end user's membership in this group was created (same rule as `GroupMembership.source` on the end-user record).
         roles:
           type: array
           description: Roles that contributed to the compiled access.
@@ -7224,9 +7252,10 @@ components:
           readOnly: true
           description: |-
             When true, at least one end user's membership in this group is synced
-            from an identity provider's group claims. Maintained by the server —
-            IdP-synced memberships cannot be removed through the group members
-            API.
+            from an identity provider — through group claims at sign-in or a SCIM
+            group push. Maintained by the server — IdP-synced memberships cannot be
+            removed through the group members API. Groups a SCIM push names that do
+            not exist yet are created with this flag set and no grants.
         createdAt:
           type: string
           format: date-time

package/dist/export.yml

@@ -16555,6 +16555,45 @@ components:
                   example:
                     threshold: 100
                     prefix: EXP-
+            preParse:
+              type: object
+              x-celigo-agent:
+                - script
+              description: |-
+                Hook that runs on file-based exports after the file is downloaded and before it is
+                parsed: it receives the raw file text as `preParseData` together with `fileMeta` and
+                returns both, modified or not, for the configured parser to read. Used to normalize a
+                non-standard file — fix a header row, strip a preamble, convert a format — before
+                parsing; an exception thrown here fails the run.
+              properties:
+                function:
+                  type: string
+                  description: Function to invoke within the referenced script.
+                  examples:
+                    - fixHeader
+                    - normalizeFile
+                    - convertToCsv
+                _scriptId:
+                  type: string
+                  format: objectId
+                  x-celigo-refModel: scripts
+                  description: Script containing the hook function named in `function`.
+                  examples:
+                    - 60a2c4e6f321d800129a1a3c
+                    - 5f8e7d2c1b54e6003a9c7e12
+                _stackId:
+                  type: string
+                  x-celigo-refModel: stacks
+                  format: objectId
+                  description: Stack that hosts the hook logic, used instead of a script for stack-based deployments.
+                configuration:
+                  type: object
+                  description: |-
+                    Static parameters passed to the hook function at runtime, letting one script be
+                    reused across exports with different settings.
+                  example:
+                    headerRow: 1
+                    encoding: utf8
         settingsForm:
           x-celigo-agent:
             - settings_form

package/dist/tool.yml

@@ -36489,6 +36489,45 @@ components:
                   example:
                     threshold: 100
                     prefix: EXP-
+            preParse:
+              type: object
+              x-celigo-agent:
+                - script
+              description: |-
+                Hook that runs on file-based exports after the file is downloaded and before it is
+                parsed: it receives the raw file text as `preParseData` together with `fileMeta` and
+                returns both, modified or not, for the configured parser to read. Used to normalize a
+                non-standard file — fix a header row, strip a preamble, convert a format — before
+                parsing; an exception thrown here fails the run.
+              properties:
+                function:
+                  type: string
+                  description: Function to invoke within the referenced script.
+                  examples:
+                    - fixHeader
+                    - normalizeFile
+                    - convertToCsv
+                _scriptId:
+                  type: string
+                  format: objectId
+                  x-celigo-refModel: scripts
+                  description: Script containing the hook function named in `function`.
+                  examples:
+                    - 60a2c4e6f321d800129a1a3c
+                    - 5f8e7d2c1b54e6003a9c7e12
+                _stackId:
+                  type: string
+                  x-celigo-refModel: stacks
+                  format: objectId
+                  description: Stack that hosts the hook logic, used instead of a script for stack-based deployments.
+                configuration:
+                  type: object
+                  description: |-
+                    Static parameters passed to the hook function at runtime, letting one script be
+                    reused across exports with different settings.
+                  example:
+                    headerRow: 1
+                    encoding: utf8
         settingsForm:
           x-celigo-agent:
             - settings_form

package/dist/user.yml

@@ -28,8 +28,9 @@ tags:
       - **accessLevel** — account-wide role (administrator, manage, monitor, etc.)
       - **integrationAccessLevel** — per-integration overrides for finer control.
 
-      The account owner is not included — only invited users appear. Users can
-      be disabled (reversible) or permanently removed.
+      The account owner is not included — only invited users appear, plus any
+      the identity provider provisioned through SCIM (`provisionedBy: scim`).
+      Users can be disabled (reversible) or permanently removed.
 
       ## User schema
 
@@ -760,7 +761,8 @@ components:
         - lastModified
       description: |-
         A user's access record in the account. Each user who has been invited
-        (or shared access) gets one record per account they belong to. The
+        (or shared access), or whom the identity provider provisioned through
+        SCIM, gets one record per account they belong to. The
         `_id` is the access-record id, not the user's own id — the user's
         identity is in `sharedWithUser._id` on list and invite responses, and
         in `_sharedWithUserId` on `GET /v1/ashares/{_id}`. The account owner
@@ -854,6 +856,43 @@ components:
                 before their SSO-required access is fully active. Set by the
                 server during SSO enrollment; cleared by removing the field, so
                 it is never `false`.
+            provisionedBy:
+              type: string
+              readOnly: true
+              enum:
+                - scim
+              x-enumDescriptions:
+                scim: Created, or adopted from an existing invitation, by the identity provider through SCIM
+              description: |-
+                Present only on workspace users the identity provider manages through
+                SCIM; every other workspace record omits the field, so an invited
+                user has no value here rather than `invite`. The identity provider
+                owns a SCIM-managed user's account-wide access level and active
+                state: `PUT /v1/ashares/{_id}` still accepts a new `accessLevel` and
+                `PUT /v1/ashares/{_userId}/disable` still toggles `disabled`, but the
+                identity provider's next push overwrites both — change them in the
+                IdP. SCIM never sets `integrationAccessLevel`, so integration-level
+                grants made here stay.
+            externalId:
+              type: string
+              readOnly: true
+              examples:
+                - 00u1a2b3c4d5e6f7g8h9
+              description: |-
+                Identifier the identity provider uses for this person in its own
+                directory, stored when the record is provisioned through SCIM.
+                Present only when `provisionedBy` is `scim`. SCIM matches people by
+                email, not by this value.
+            _scimSsoClientId:
+              type: string
+              format: objectId
+              readOnly: true
+              x-celigo-refModel: ssoclients
+              examples:
+                - 6a1b2c3d4e5f6a7b8c9d0e1f
+              description: |-
+                SSO client whose SCIM configuration provisioned this record. Present
+                only when `provisionedBy` is `scim`.
             sharedWithUser:
               type: object
               readOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.61",
+  "version": "0.2.63",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "77aa9d7",
-		"generatedAt": "2026-09-28"
+		"iasCommit": "27222ec",
+		"generatedAt": "2026-09-29"
 	},
 	"roots": {
 		"aiagent": 133,
@@ -5224,6 +5224,7 @@
 				"object"
 			],
 			"p": {
+				"preParse": 445,
 				"preSavePage": 445
 			}
 		},