@celigo/api-specs 0.2.62 → 0.2.64

package/dist/enduser.yml

@@ -38,8 +38,8 @@ tags:
     description: |-
       Groups bundle roles and resource grants so end-user access can be
       managed collectively. End users receive a group's access through
-      membership, added manually or synced from an identity provider's group
-      claims.
+      membership, added manually or synced from an identity provider (group
+      claims at sign-in or a SCIM group push).
 
       ## Group schema
 
@@ -920,7 +920,8 @@ paths:
       description: |-
         Bulk-removes manual memberships from the group. Only manual memberships
         can be removed this way — attempting to remove an IdP-synced membership
-        returns 409; change the IdP group mapping instead. Uses POST rather than
+        returns 409; change the person's group in the identity provider (its
+        group mapping or SCIM group assignment) instead. Uses POST rather than
         DELETE so the request body survives proxies and CDNs. Requires account
         owner or administrator access.
       parameters:
@@ -1212,11 +1213,12 @@ components:
             - idp
           x-enumDescriptions:
             manual: Membership was added by an owner or administrator (invite or group members API)
-            idp: Membership is synced from the identity provider's group claims
+            idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
           description: |-
             How the membership was created. IdP-synced memberships cannot be
-            removed through the group members API — change the IdP group mapping
-            instead.
+            removed through the group members API — change the person's group in
+            the identity provider instead (its group mapping, or the SCIM group
+            assignment, whichever created the membership).
     ResourceGrant:
       type: object
       description: |-
@@ -1319,10 +1321,34 @@ components:
           x-enumDescriptions:
             invite: Created through an explicit invite (or by migration from a workspace user)
             jit: Provisioned just-in-time on first sign-in through an external IdP
-            scim: Provisioned by the identity provider through SCIM; carries the externalId and the IdP configuration it was created from
+            scim: Provisioned, or adopted from an invited or JIT record, by the identity provider through SCIM
           description: |-
-            How this end-user record was created. Records provisioned through SCIM are owned by the
-            identity provider — change their access there, not through this API.
+            How this end-user record was created. A SCIM push for a person who already has an invited
+            or JIT record adopts it in place, so the value can change to `scim` over the record's life.
+            For a SCIM-managed user the identity provider owns the active state and the IdP-sourced
+            group memberships and roles: `PUT /v1/ashares/{_ashareId}/disable` still toggles `disabled`,
+            but the identity provider's next push re-applies what it holds — deactivate the person or
+            change their groups in the IdP. Direct `resourceGrants` and `manual` memberships are never
+            touched by SCIM.
+        externalId:
+          type: string
+          readOnly: true
+          examples:
+            - 00u1a2b3c4d5e6f7g8h9
+          description: |-
+            Identifier the identity provider uses for this person in its own directory,
+            stored when the record is provisioned through SCIM. Present only when
+            `provisionedBy` is `scim`. SCIM matches people by email, not by this value.
+        _scimIdpConfigId:
+          type: string
+          format: objectId
+          readOnly: true
+          x-celigo-refModel: idpconfigs
+          examples:
+            - 68d1e2f3a4b5c6d7e8f9a0b1
+          description: |-
+            IdP configuration whose SCIM endpoint provisioned this record. Present
+            only when `provisionedBy` is `scim`.
         accepted:
           type: boolean
           description: When true, the end user has completed invite setup (or was JIT-provisioned).
@@ -1684,9 +1710,11 @@ components:
           enum:
             - invite
             - jit
+            - scim
           x-enumDescriptions:
             invite: Created through an explicit invite (or by migration from a workspace user)
             jit: Provisioned just-in-time on first sign-in through an external IdP
+            scim: Provisioned, or adopted from an invited or JIT record, by the identity provider through SCIM
           description: How the end-user record was created.
         groups:
           type: array
@@ -1708,9 +1736,9 @@ components:
                   - manual
                   - idp
                 x-enumDescriptions:
-                  manual: Membership was added by an owner or administrator
-                  idp: Membership is synced from the identity provider's group claims
-                description: How the end user's membership in this group was created.
+                  manual: Membership was added by an owner or administrator (invite or group members API)
+                  idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
+                description: How the end user's membership in this group was created (same rule as `GroupMembership.source` on the end-user record).
         roles:
           type: array
           description: Roles that contributed to the compiled access.
@@ -7224,9 +7252,10 @@ components:
           readOnly: true
           description: |-
             When true, at least one end user's membership in this group is synced
-            from an identity provider's group claims. Maintained by the server —
-            IdP-synced memberships cannot be removed through the group members
-            API.
+            from an identity provider — through group claims at sign-in or a SCIM
+            group push. Maintained by the server — IdP-synced memberships cannot be
+            removed through the group members API. Groups a SCIM push names that do
+            not exist yet are created with this flag set and no grants.
         createdAt:
           type: string
           format: date-time

package/dist/subscription.yml

@@ -812,29 +812,71 @@ components:
                 - true
         di:
           type: object
-          description: Data Interchange (DI) entitlements.
+          description: |-
+            Data Ingestion (Celigo Sync) entitlements. Every paid edition includes a base
+            allowance — one enabled sync per environment and a monthly loaded-row volume —
+            and a Data Ingestion volume pack adds capacity on top of it. A free trial
+            carries the Enterprise-equivalent allowance for its duration; the free plan
+            after the trial has no Data Ingestion.
           required:
             - enabled
             - volume
             - volumeAddOn
             - disableOverage
+          x-celigo-ai-guidance:
+            - |-
+              Read the entitlement from this block, never from a tier table: `volume` is
+              the edition's included monthly loaded rows and `volumeAddOn` the purchased
+              capacity. A trial's allowance is computed by the platform and is reported
+              here while the trial is active.
+            - |-
+              The entitlement is enforced when a sync is enabled, not when it is created.
+              Saving a sync with `disabled: false` returns `422 di_subscription_required`
+              ("Your license does not support Data Ingestion") when the account has no
+              entitlement, `di_sync_limit_exceeded` when the environment already has an
+              enabled sync and `volumeAddOn` is 0, and `di_usage_limit_exceeded` on volume
+              in two cases: while `histLoadEndDate` is in the future (with `volumeAddOn`
+              above 0), when the month's loaded rows have reached the historical-load cap —
+              regardless of `disableOverage`; otherwise, only when `disableOverage` is in
+              force and the month's loaded rows already exceed the allowance.
           properties:
             enabled:
               type: boolean
-              description: When true, the plan entitles the account to use Data Interchange.
+              description: When true, the plan entitles the account to enable and run Data Ingestion syncs.
               example: false
             volume:
               type: integer
-              description: Base DI volume included with the plan.
+              description: |-
+                Monthly loaded-row allowance included with the edition. Without the add-on,
+                crossing it lets the running job finish and disables the sync from its next
+                run until the next month.
               example: 0
             volumeAddOn:
               type: integer
-              description: Additional DI volume the customer purchased as add-ons.
+              description: |-
+                Additional monthly loaded rows purchased as a Data Ingestion volume pack. With
+                a pack the account is no longer limited to one enabled sync per environment;
+                when the pack lapses, each environment is trimmed back to its most recently
+                run sync.
               example: 0
             disableOverage:
               type: boolean
-              description: When true, Data Interchange overage charges are disabled.
+              description: |-
+                When true, monthly overage is not permitted: once the month's loaded rows
+                reach the allowance, syncs cannot be enabled until the next month. Trial
+                licenses enforce this unless the field is explicitly false. Not consulted
+                while a historical-load window (`histLoadEndDate`) is active.
               example: false
+            histLoadEndDate:
+              type: string
+              format: date-time
+              description: |-
+                End of the historical-load window granted with a volume pack. While this date
+                is in the future and `volumeAddOn` is above 0, the monthly cap is raised to a
+                platform-configured multiple (50 by default) of `volume` plus `volumeAddOn` —
+                still checked per calendar month — and `disableOverage` is not consulted.
+                Absent when no window is active.
+              example: '2026-10-29T00:00:00.000Z'
         api:
           type: object
           description: API Builder plan entitlements and invocation limits.
@@ -1522,7 +1564,7 @@ components:
               example: 0
             diVolume:
               type: integer
-              description: Data Interchange volume consumed during the month.
+              description: Data Ingestion (Celigo Sync) rows loaded during the month.
               example: 0
         allocated:
           type: object

package/dist/user.yml

@@ -28,8 +28,9 @@ tags:
       - **accessLevel** — account-wide role (administrator, manage, monitor, etc.)
       - **integrationAccessLevel** — per-integration overrides for finer control.
 
-      The account owner is not included — only invited users appear. Users can
-      be disabled (reversible) or permanently removed.
+      The account owner is not included — only invited users appear, plus any
+      the identity provider provisioned through SCIM (`provisionedBy: scim`).
+      Users can be disabled (reversible) or permanently removed.
 
       ## User schema
 
@@ -760,7 +761,8 @@ components:
         - lastModified
       description: |-
         A user's access record in the account. Each user who has been invited
-        (or shared access) gets one record per account they belong to. The
+        (or shared access), or whom the identity provider provisioned through
+        SCIM, gets one record per account they belong to. The
         `_id` is the access-record id, not the user's own id — the user's
         identity is in `sharedWithUser._id` on list and invite responses, and
         in `_sharedWithUserId` on `GET /v1/ashares/{_id}`. The account owner
@@ -854,6 +856,43 @@ components:
                 before their SSO-required access is fully active. Set by the
                 server during SSO enrollment; cleared by removing the field, so
                 it is never `false`.
+            provisionedBy:
+              type: string
+              readOnly: true
+              enum:
+                - scim
+              x-enumDescriptions:
+                scim: Created, or adopted from an existing invitation, by the identity provider through SCIM
+              description: |-
+                Present only on workspace users the identity provider manages through
+                SCIM; every other workspace record omits the field, so an invited
+                user has no value here rather than `invite`. The identity provider
+                owns a SCIM-managed user's account-wide access level and active
+                state: `PUT /v1/ashares/{_id}` still accepts a new `accessLevel` and
+                `PUT /v1/ashares/{_userId}/disable` still toggles `disabled`, but the
+                identity provider's next push overwrites both — change them in the
+                IdP. SCIM never sets `integrationAccessLevel`, so integration-level
+                grants made here stay.
+            externalId:
+              type: string
+              readOnly: true
+              examples:
+                - 00u1a2b3c4d5e6f7g8h9
+              description: |-
+                Identifier the identity provider uses for this person in its own
+                directory, stored when the record is provisioned through SCIM.
+                Present only when `provisionedBy` is `scim`. SCIM matches people by
+                email, not by this value.
+            _scimSsoClientId:
+              type: string
+              format: objectId
+              readOnly: true
+              x-celigo-refModel: ssoclients
+              examples:
+                - 6a1b2c3d4e5f6a7b8c9d0e1f
+              description: |-
+                SSO client whose SCIM configuration provisioned this record. Present
+                only when `provisionedBy` is `scim`.
             sharedWithUser:
               type: object
               readOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.62",
+  "version": "0.2.64",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "f757489",
-		"generatedAt": "2026-09-28"
+		"iasCommit": "98fb2b4",
+		"generatedAt": "2026-09-29"
 	},
 	"roots": {
 		"aiagent": 133,