@celigo/api-specs 0.2.63 → 0.2.65
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/networkpolicy.yml +1221 -0
- package/dist/subscription.yml +48 -6
- package/package.json +1 -1
- package/schemas.json +2 -2
|
@@ -0,0 +1,1221 @@
|
|
|
1
|
+
openapi: 3.2.0
|
|
2
|
+
info:
|
|
3
|
+
version: 1.0.0
|
|
4
|
+
title: Network Policies
|
|
5
|
+
description: Manage IP allow and deny lists that restrict where API tokens, MCP servers, and users may connect from.
|
|
6
|
+
x-celigo-ai-guidance:
|
|
7
|
+
- |-
|
|
8
|
+
API for managing network policies — named IP allow/deny lists that are assigned to API tokens
|
|
9
|
+
(`_networkPolicyId`), MCP servers (`_networkPolicyId`), or account sign-in settings to restrict
|
|
10
|
+
the source addresses a caller may connect from. A policy restricts nothing until it is assigned.
|
|
11
|
+
servers:
|
|
12
|
+
- url: https://api.integrator.io
|
|
13
|
+
description: Production (US / default region)
|
|
14
|
+
- url: https://api.eu.integrator.io
|
|
15
|
+
description: Production (EU region)
|
|
16
|
+
- url: https://api.au.integrator.io
|
|
17
|
+
description: Production (AU region)
|
|
18
|
+
- url: https://api.ca.integrator.io
|
|
19
|
+
description: Production (CA region)
|
|
20
|
+
security:
|
|
21
|
+
- bearerAuth: []
|
|
22
|
+
tags:
|
|
23
|
+
- name: Network Policies
|
|
24
|
+
description: |-
|
|
25
|
+
Network policies are named IP allow and deny lists that control where API tokens, MCP servers, and users may connect from. A policy takes effect only once it is assigned — through `_networkPolicyId` on an API token or MCP server, or in account settings for workspace-user and end-user sign-in — and each environment (production or sandbox) keeps its own library of policies. Network policies must be enabled for the account, and only the account owner and administrators can manage them.
|
|
26
|
+
|
|
27
|
+
## Network policy schema
|
|
28
|
+
|
|
29
|
+
{% openapi-schemas spec="networkpolicy" schemas="NetworkPolicy" grouped="true" %}
|
|
30
|
+
paths:
|
|
31
|
+
/v1/networkpolicies:
|
|
32
|
+
get:
|
|
33
|
+
x-internal: false
|
|
34
|
+
summary: List network policies
|
|
35
|
+
description: |-
|
|
36
|
+
Returns the policies of the caller's environment, most recently modified first.
|
|
37
|
+
Policies in the recycle bin are not included. The `include` and `exclude`
|
|
38
|
+
projection parameters used by other list endpoints are not supported here.
|
|
39
|
+
operationId: listNetworkPolicies
|
|
40
|
+
tags:
|
|
41
|
+
- Network Policies
|
|
42
|
+
parameters:
|
|
43
|
+
- name: limit
|
|
44
|
+
in: query
|
|
45
|
+
required: false
|
|
46
|
+
description: Maximum number of policies to return per page.
|
|
47
|
+
schema:
|
|
48
|
+
type: integer
|
|
49
|
+
minimum: 1
|
|
50
|
+
maximum: 1000
|
|
51
|
+
examples:
|
|
52
|
+
- 100
|
|
53
|
+
- name: sort_by
|
|
54
|
+
in: query
|
|
55
|
+
required: false
|
|
56
|
+
description: |-
|
|
57
|
+
Field to order the page by. `lastModified` lists the most recently changed
|
|
58
|
+
policy first; `name` lists alphabetically.
|
|
59
|
+
schema:
|
|
60
|
+
type: string
|
|
61
|
+
enum:
|
|
62
|
+
- lastModified
|
|
63
|
+
- name
|
|
64
|
+
x-enumDescriptions:
|
|
65
|
+
lastModified: Most recently modified policy first
|
|
66
|
+
name: Alphabetical by display name
|
|
67
|
+
examples:
|
|
68
|
+
- name
|
|
69
|
+
- $ref: '#/components/parameters/After'
|
|
70
|
+
responses:
|
|
71
|
+
'200':
|
|
72
|
+
description: Array of network policies.
|
|
73
|
+
headers:
|
|
74
|
+
Link:
|
|
75
|
+
description: |-
|
|
76
|
+
RFC 5988 pagination links. When more pages remain, includes a
|
|
77
|
+
`<...>; rel="next"` entry with an `after` cursor; absent on the
|
|
78
|
+
final page.
|
|
79
|
+
schema:
|
|
80
|
+
type: string
|
|
81
|
+
content:
|
|
82
|
+
application/json:
|
|
83
|
+
schema:
|
|
84
|
+
type: array
|
|
85
|
+
items:
|
|
86
|
+
$ref: '#/components/schemas/NetworkPolicy'
|
|
87
|
+
examples:
|
|
88
|
+
default:
|
|
89
|
+
value:
|
|
90
|
+
- _id: 6ab1f501b9e454749402c749
|
|
91
|
+
_userId: 624cb0346309dc3a543733a2
|
|
92
|
+
name: Corporate VPN egress
|
|
93
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
94
|
+
ipAllowList:
|
|
95
|
+
- 10.0.0.0/8
|
|
96
|
+
- 203.0.113.5/32
|
|
97
|
+
- 2001:db8::/32
|
|
98
|
+
ipDenyList:
|
|
99
|
+
- 198.51.100.0/24
|
|
100
|
+
createdAt: '2026-09-22T03:24:49.115Z'
|
|
101
|
+
lastModified: '2026-09-22T03:27:28.318Z'
|
|
102
|
+
- _id: 6ab1ebbfb9e4547494ff7558
|
|
103
|
+
_userId: 624cb0346309dc3a543733a2
|
|
104
|
+
name: Block known scanners
|
|
105
|
+
ipAllowList: []
|
|
106
|
+
ipDenyList:
|
|
107
|
+
- 198.51.100.7/32
|
|
108
|
+
- 192.0.2.0/24
|
|
109
|
+
createdAt: '2026-09-22T02:45:19.304Z'
|
|
110
|
+
lastModified: '2026-09-22T02:45:19.304Z'
|
|
111
|
+
'204':
|
|
112
|
+
description: No network policies exist in this environment.
|
|
113
|
+
'400':
|
|
114
|
+
$ref: '#/components/responses/400-bad-request'
|
|
115
|
+
'401':
|
|
116
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
117
|
+
'422':
|
|
118
|
+
$ref: '#/components/responses/422-unprocessable-entity'
|
|
119
|
+
post:
|
|
120
|
+
x-internal: false
|
|
121
|
+
summary: Create a network policy
|
|
122
|
+
description: |-
|
|
123
|
+
Creates a policy in the caller's environment. Entries in both lists are
|
|
124
|
+
validated and stored in normalized form — a bare address becomes `/32` or
|
|
125
|
+
`/128`, IPv6 is compressed — and the response shows the stored values. The new
|
|
126
|
+
policy restricts nothing until it is assigned to an API token, an MCP server,
|
|
127
|
+
or account sign-in.
|
|
128
|
+
operationId: createNetworkPolicy
|
|
129
|
+
tags:
|
|
130
|
+
- Network Policies
|
|
131
|
+
requestBody:
|
|
132
|
+
required: true
|
|
133
|
+
content:
|
|
134
|
+
application/json:
|
|
135
|
+
schema:
|
|
136
|
+
$ref: '#/components/schemas/Request'
|
|
137
|
+
examples:
|
|
138
|
+
allowList:
|
|
139
|
+
summary: Allow only corporate ranges
|
|
140
|
+
value:
|
|
141
|
+
name: Corporate VPN egress
|
|
142
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
143
|
+
ipAllowList:
|
|
144
|
+
- 10.0.0.0/8
|
|
145
|
+
- 203.0.113.5
|
|
146
|
+
- 2001:db8::/32
|
|
147
|
+
ipDenyList:
|
|
148
|
+
- 198.51.100.0/24
|
|
149
|
+
denyOnly:
|
|
150
|
+
summary: Deny list only
|
|
151
|
+
value:
|
|
152
|
+
name: Block known scanners
|
|
153
|
+
ipDenyList:
|
|
154
|
+
- 198.51.100.7
|
|
155
|
+
- 192.0.2.0/24
|
|
156
|
+
responses:
|
|
157
|
+
'201':
|
|
158
|
+
description: Created network policy, with entries in stored form.
|
|
159
|
+
content:
|
|
160
|
+
application/json:
|
|
161
|
+
schema:
|
|
162
|
+
$ref: '#/components/schemas/NetworkPolicy'
|
|
163
|
+
examples:
|
|
164
|
+
allowList:
|
|
165
|
+
summary: Created policy
|
|
166
|
+
value:
|
|
167
|
+
_id: 6ab1f501b9e454749402c749
|
|
168
|
+
_userId: 624cb0346309dc3a543733a2
|
|
169
|
+
name: Corporate VPN egress
|
|
170
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
171
|
+
ipAllowList:
|
|
172
|
+
- 10.0.0.0/8
|
|
173
|
+
- 203.0.113.5/32
|
|
174
|
+
- 2001:db8::/32
|
|
175
|
+
ipDenyList:
|
|
176
|
+
- 198.51.100.0/24
|
|
177
|
+
createdAt: '2026-09-22T03:24:49.115Z'
|
|
178
|
+
lastModified: '2026-09-22T03:24:49.115Z'
|
|
179
|
+
'400':
|
|
180
|
+
$ref: '#/components/responses/400-bad-request'
|
|
181
|
+
'401':
|
|
182
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
183
|
+
'409':
|
|
184
|
+
$ref: '#/components/responses/409-name-conflict'
|
|
185
|
+
'422':
|
|
186
|
+
$ref: '#/components/responses/422-unprocessable-entity'
|
|
187
|
+
/v1/networkpolicies/{_id}:
|
|
188
|
+
get:
|
|
189
|
+
x-internal: false
|
|
190
|
+
summary: Get a network policy
|
|
191
|
+
description: |-
|
|
192
|
+
Returns a single policy from the caller's environment. A policy that has been
|
|
193
|
+
moved to the recycle bin, or that belongs to another environment, returns 404.
|
|
194
|
+
operationId: getNetworkPolicyById
|
|
195
|
+
tags:
|
|
196
|
+
- Network Policies
|
|
197
|
+
parameters:
|
|
198
|
+
- name: _id
|
|
199
|
+
in: path
|
|
200
|
+
required: true
|
|
201
|
+
description: Network policy ID.
|
|
202
|
+
schema:
|
|
203
|
+
type: string
|
|
204
|
+
format: objectId
|
|
205
|
+
x-celigo-refModel: networkpolicies
|
|
206
|
+
examples:
|
|
207
|
+
- 6ab1f501b9e454749402c749
|
|
208
|
+
responses:
|
|
209
|
+
'200':
|
|
210
|
+
description: Network policy.
|
|
211
|
+
content:
|
|
212
|
+
application/json:
|
|
213
|
+
schema:
|
|
214
|
+
$ref: '#/components/schemas/NetworkPolicy'
|
|
215
|
+
examples:
|
|
216
|
+
default:
|
|
217
|
+
value:
|
|
218
|
+
_id: 6ab1f501b9e454749402c749
|
|
219
|
+
_userId: 624cb0346309dc3a543733a2
|
|
220
|
+
name: Corporate VPN egress
|
|
221
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
222
|
+
ipAllowList:
|
|
223
|
+
- 10.0.0.0/8
|
|
224
|
+
- 203.0.113.5/32
|
|
225
|
+
- 2001:db8::/32
|
|
226
|
+
ipDenyList:
|
|
227
|
+
- 198.51.100.0/24
|
|
228
|
+
createdAt: '2026-09-22T03:24:49.115Z'
|
|
229
|
+
lastModified: '2026-09-22T03:27:28.318Z'
|
|
230
|
+
'401':
|
|
231
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
232
|
+
'404':
|
|
233
|
+
$ref: '#/components/responses/404-not-found'
|
|
234
|
+
put:
|
|
235
|
+
x-internal: false
|
|
236
|
+
summary: Replace a network policy
|
|
237
|
+
description: |-
|
|
238
|
+
Replaces the policy with the request body. Fields left out are cleared: an
|
|
239
|
+
omitted `description` is removed and an omitted `ipAllowList` or `ipDenyList`
|
|
240
|
+
becomes empty, which lifts every restriction that list imposed. Entries are
|
|
241
|
+
validated and normalized exactly as on create. The change applies to every
|
|
242
|
+
token, MCP server, and sign-in setting the policy is assigned to.
|
|
243
|
+
operationId: updateNetworkPolicy
|
|
244
|
+
tags:
|
|
245
|
+
- Network Policies
|
|
246
|
+
parameters:
|
|
247
|
+
- name: _id
|
|
248
|
+
in: path
|
|
249
|
+
required: true
|
|
250
|
+
description: Network policy ID.
|
|
251
|
+
schema:
|
|
252
|
+
type: string
|
|
253
|
+
format: objectId
|
|
254
|
+
x-celigo-refModel: networkpolicies
|
|
255
|
+
examples:
|
|
256
|
+
- 6ab1f501b9e454749402c749
|
|
257
|
+
requestBody:
|
|
258
|
+
required: true
|
|
259
|
+
content:
|
|
260
|
+
application/json:
|
|
261
|
+
schema:
|
|
262
|
+
$ref: '#/components/schemas/Request'
|
|
263
|
+
examples:
|
|
264
|
+
addRange:
|
|
265
|
+
summary: Add a range to the allow list
|
|
266
|
+
value:
|
|
267
|
+
name: Corporate VPN egress
|
|
268
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
269
|
+
ipAllowList:
|
|
270
|
+
- 10.0.0.0/8
|
|
271
|
+
- 203.0.113.5
|
|
272
|
+
- 2001:db8::/32
|
|
273
|
+
- 172.16.0.0/12
|
|
274
|
+
ipDenyList:
|
|
275
|
+
- 198.51.100.0/24
|
|
276
|
+
responses:
|
|
277
|
+
'200':
|
|
278
|
+
description: Updated network policy, with entries in stored form.
|
|
279
|
+
content:
|
|
280
|
+
application/json:
|
|
281
|
+
schema:
|
|
282
|
+
$ref: '#/components/schemas/NetworkPolicy'
|
|
283
|
+
examples:
|
|
284
|
+
addRange:
|
|
285
|
+
summary: Updated policy
|
|
286
|
+
value:
|
|
287
|
+
_id: 6ab1f501b9e454749402c749
|
|
288
|
+
_userId: 624cb0346309dc3a543733a2
|
|
289
|
+
name: Corporate VPN egress
|
|
290
|
+
description: Office and VPN egress ranges. Deny beats allow.
|
|
291
|
+
ipAllowList:
|
|
292
|
+
- 10.0.0.0/8
|
|
293
|
+
- 203.0.113.5/32
|
|
294
|
+
- 2001:db8::/32
|
|
295
|
+
- 172.16.0.0/12
|
|
296
|
+
ipDenyList:
|
|
297
|
+
- 198.51.100.0/24
|
|
298
|
+
createdAt: '2026-09-22T03:24:49.115Z'
|
|
299
|
+
lastModified: '2026-09-22T03:30:21.527Z'
|
|
300
|
+
'400':
|
|
301
|
+
$ref: '#/components/responses/400-bad-request'
|
|
302
|
+
'401':
|
|
303
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
304
|
+
'404':
|
|
305
|
+
$ref: '#/components/responses/404-not-found'
|
|
306
|
+
'409':
|
|
307
|
+
$ref: '#/components/responses/409-name-conflict'
|
|
308
|
+
'422':
|
|
309
|
+
$ref: '#/components/responses/422-unprocessable-entity'
|
|
310
|
+
patch:
|
|
311
|
+
x-internal: false
|
|
312
|
+
summary: Patch a network policy
|
|
313
|
+
description: |-
|
|
314
|
+
Partially updates a policy with a JSON Patch document (RFC 6902). Fields the
|
|
315
|
+
document does not touch are preserved, unlike PUT. Whitelisted paths:
|
|
316
|
+
|
|
317
|
+
| Path | Operations |
|
|
318
|
+
|------|------------|
|
|
319
|
+
| `/name` | `add`, `replace` |
|
|
320
|
+
| `/description` | `add`, `replace`, `remove` |
|
|
321
|
+
| `/ipAllowList`, `/ipDenyList` | `replace` the whole list |
|
|
322
|
+
| `/ipAllowList/-`, `/ipDenyList/-` | `add` one entry at the end |
|
|
323
|
+
| `/ipAllowList/{index}`, `/ipDenyList/{index}` | `add` or `replace` one entry |
|
|
324
|
+
|
|
325
|
+
Entries are validated and normalized exactly as on create. `move`, `copy`, and
|
|
326
|
+
`test` on `/name` or either list return 400 `invalid_patch_operation`; removing
|
|
327
|
+
a single list entry by index is not supported (422) — `replace` the whole list
|
|
328
|
+
instead. Any other path returns 422.
|
|
329
|
+
operationId: patchNetworkPolicy
|
|
330
|
+
tags:
|
|
331
|
+
- Network Policies
|
|
332
|
+
x-celigo-ai-guidance:
|
|
333
|
+
- |-
|
|
334
|
+
To drop one address from a list, `replace` the whole list without it — `remove` on
|
|
335
|
+
`/ipAllowList/0` fails with 422 "Remove at array index is not supported". Read the policy
|
|
336
|
+
first so the replacement starts from the stored, normalized entries.
|
|
337
|
+
parameters:
|
|
338
|
+
- name: _id
|
|
339
|
+
in: path
|
|
340
|
+
required: true
|
|
341
|
+
description: Network policy ID.
|
|
342
|
+
schema:
|
|
343
|
+
type: string
|
|
344
|
+
format: objectId
|
|
345
|
+
x-celigo-refModel: networkpolicies
|
|
346
|
+
examples:
|
|
347
|
+
- 6ab1f501b9e454749402c749
|
|
348
|
+
requestBody:
|
|
349
|
+
required: true
|
|
350
|
+
content:
|
|
351
|
+
application/json:
|
|
352
|
+
schema:
|
|
353
|
+
$ref: '#/components/schemas/JsonPatchRequest'
|
|
354
|
+
examples:
|
|
355
|
+
rename:
|
|
356
|
+
summary: Rename the policy
|
|
357
|
+
value:
|
|
358
|
+
- op: replace
|
|
359
|
+
path: /name
|
|
360
|
+
value: Corporate VPN egress (2026)
|
|
361
|
+
appendEntry:
|
|
362
|
+
summary: Append one address to the deny list
|
|
363
|
+
value:
|
|
364
|
+
- op: add
|
|
365
|
+
path: /ipDenyList/-
|
|
366
|
+
value: 198.51.100.7
|
|
367
|
+
replaceList:
|
|
368
|
+
summary: Replace the allow list
|
|
369
|
+
value:
|
|
370
|
+
- op: replace
|
|
371
|
+
path: /ipAllowList
|
|
372
|
+
value:
|
|
373
|
+
- 10.0.0.0/8
|
|
374
|
+
- 172.16.0.0/12
|
|
375
|
+
clearDescription:
|
|
376
|
+
summary: Remove the description
|
|
377
|
+
value:
|
|
378
|
+
- op: remove
|
|
379
|
+
path: /description
|
|
380
|
+
responses:
|
|
381
|
+
'204':
|
|
382
|
+
description: Network policy patched.
|
|
383
|
+
'400':
|
|
384
|
+
$ref: '#/components/responses/400-bad-request'
|
|
385
|
+
'401':
|
|
386
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
387
|
+
'404':
|
|
388
|
+
$ref: '#/components/responses/404-not-found'
|
|
389
|
+
'409':
|
|
390
|
+
$ref: '#/components/responses/409-name-conflict'
|
|
391
|
+
'422':
|
|
392
|
+
$ref: '#/components/responses/422-unprocessable-entity'
|
|
393
|
+
delete:
|
|
394
|
+
x-internal: false
|
|
395
|
+
summary: Delete a network policy
|
|
396
|
+
description: |-
|
|
397
|
+
Moves the policy to the recycle bin, where it is retained for 30 days and can
|
|
398
|
+
be restored. A policy that is still assigned to an API token, MCP server, or
|
|
399
|
+
account sign-in setting is not deleted: the request fails with 409
|
|
400
|
+
`network_policy_in_use` and `info` lists every assignment. Repeat with
|
|
401
|
+
`force=true` to clear those assignments and delete the policy — every principal
|
|
402
|
+
it was assigned to loses the restriction. Use `GET /v1/networkpolicies/{_id}/dependencies`
|
|
403
|
+
to review the assignments first.
|
|
404
|
+
operationId: deleteNetworkPolicy
|
|
405
|
+
tags:
|
|
406
|
+
- Network Policies
|
|
407
|
+
parameters:
|
|
408
|
+
- name: _id
|
|
409
|
+
in: path
|
|
410
|
+
required: true
|
|
411
|
+
description: Network policy ID.
|
|
412
|
+
schema:
|
|
413
|
+
type: string
|
|
414
|
+
format: objectId
|
|
415
|
+
x-celigo-refModel: networkpolicies
|
|
416
|
+
examples:
|
|
417
|
+
- 6ab1f501b9e454749402c749
|
|
418
|
+
- name: force
|
|
419
|
+
in: query
|
|
420
|
+
required: false
|
|
421
|
+
description: |-
|
|
422
|
+
When true, clears the policy from every API token, MCP server, and account
|
|
423
|
+
sign-in setting it is assigned to, then deletes it. Without it, an assigned
|
|
424
|
+
policy returns 409 and nothing changes.
|
|
425
|
+
schema:
|
|
426
|
+
type: boolean
|
|
427
|
+
default: false
|
|
428
|
+
examples:
|
|
429
|
+
- true
|
|
430
|
+
responses:
|
|
431
|
+
'204':
|
|
432
|
+
description: Network policy moved to the recycle bin.
|
|
433
|
+
'401':
|
|
434
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
435
|
+
'404':
|
|
436
|
+
$ref: '#/components/responses/404-not-found'
|
|
437
|
+
'409':
|
|
438
|
+
$ref: '#/components/responses/409-in-use'
|
|
439
|
+
/v1/networkpolicies/{_id}/dependencies:
|
|
440
|
+
get:
|
|
441
|
+
x-internal: false
|
|
442
|
+
operationId: listNetworkPolicyDependencies
|
|
443
|
+
tags:
|
|
444
|
+
- Network Policies
|
|
445
|
+
summary: List assignments of a network policy
|
|
446
|
+
description: |-
|
|
447
|
+
Returns every API token, MCP server, and account sign-in setting the policy is
|
|
448
|
+
assigned to within its own environment. Call it before `DELETE` to see what a
|
|
449
|
+
`force=true` delete would clear. Unlike other `/dependencies` endpoints, the
|
|
450
|
+
response is a fixed object rather than a map keyed by resource type.
|
|
451
|
+
parameters:
|
|
452
|
+
- name: _id
|
|
453
|
+
in: path
|
|
454
|
+
required: true
|
|
455
|
+
description: Network policy ID.
|
|
456
|
+
schema:
|
|
457
|
+
type: string
|
|
458
|
+
format: objectId
|
|
459
|
+
x-celigo-refModel: networkpolicies
|
|
460
|
+
examples:
|
|
461
|
+
- 6ab1f501b9e454749402c749
|
|
462
|
+
responses:
|
|
463
|
+
'200':
|
|
464
|
+
description: Assignments of the policy. All keys are present even when the policy is unassigned.
|
|
465
|
+
content:
|
|
466
|
+
application/json:
|
|
467
|
+
schema:
|
|
468
|
+
$ref: '#/components/schemas/NetworkPolicyDependencies'
|
|
469
|
+
examples:
|
|
470
|
+
assigned:
|
|
471
|
+
summary: Assigned to an MCP server
|
|
472
|
+
value:
|
|
473
|
+
mcpservers:
|
|
474
|
+
- _id: 6ab1f4a95af4c5a3ea6b0a28
|
|
475
|
+
name: Order lookup MCP server
|
|
476
|
+
accesstokens: []
|
|
477
|
+
account:
|
|
478
|
+
workspaceUsers: false
|
|
479
|
+
workspaceUserEnvironments: []
|
|
480
|
+
endUsers: false
|
|
481
|
+
endUserEnvironments: []
|
|
482
|
+
unassigned:
|
|
483
|
+
summary: Not assigned anywhere
|
|
484
|
+
value:
|
|
485
|
+
mcpservers: []
|
|
486
|
+
accesstokens: []
|
|
487
|
+
account:
|
|
488
|
+
workspaceUsers: false
|
|
489
|
+
workspaceUserEnvironments: []
|
|
490
|
+
endUsers: false
|
|
491
|
+
endUserEnvironments: []
|
|
492
|
+
'401':
|
|
493
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
494
|
+
'404':
|
|
495
|
+
$ref: '#/components/responses/404-not-found'
|
|
496
|
+
/v1/networkpolicies/{_id}/audit:
|
|
497
|
+
get:
|
|
498
|
+
x-internal: false
|
|
499
|
+
summary: Get audit log for a network policy
|
|
500
|
+
description: |-
|
|
501
|
+
Returns the change history for a network policy, newest first. Each entry
|
|
502
|
+
records one event with who made the change, when, and which fields were
|
|
503
|
+
affected. Entries survive the policy's deletion and purge; the route itself
|
|
504
|
+
returns 404 once the policy has been purged, so use `GET /v1/audit?resourceType=networkpolicy`
|
|
505
|
+
to read the history of a purged policy.
|
|
506
|
+
tags:
|
|
507
|
+
- Network Policies
|
|
508
|
+
operationId: getNetworkPolicyAudit
|
|
509
|
+
parameters:
|
|
510
|
+
- name: _id
|
|
511
|
+
in: path
|
|
512
|
+
description: Network policy ID.
|
|
513
|
+
required: true
|
|
514
|
+
schema:
|
|
515
|
+
type: string
|
|
516
|
+
format: objectId
|
|
517
|
+
x-celigo-refModel: networkpolicies
|
|
518
|
+
examples:
|
|
519
|
+
- 6ab1f501b9e454749402c749
|
|
520
|
+
- name: limit
|
|
521
|
+
in: query
|
|
522
|
+
description: Maximum number of audit entries to return per page.
|
|
523
|
+
required: false
|
|
524
|
+
schema:
|
|
525
|
+
type: integer
|
|
526
|
+
minimum: 1
|
|
527
|
+
maximum: 1000
|
|
528
|
+
default: 1000
|
|
529
|
+
examples:
|
|
530
|
+
- 100
|
|
531
|
+
- name: after
|
|
532
|
+
in: query
|
|
533
|
+
required: false
|
|
534
|
+
description: |-
|
|
535
|
+
Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`
|
|
536
|
+
response header's `rel="next"` URL rather than constructing it.
|
|
537
|
+
schema:
|
|
538
|
+
type: string
|
|
539
|
+
examples:
|
|
540
|
+
- W3siJGRhdGUiOiIyMDI2LTA5LTIyVDAzOjI3OjEwLjM5N1oifSwiNmFiMWY1OGU0ZGI1Njg4ZmQ4Y2FjMTc5Il0
|
|
541
|
+
- name: from
|
|
542
|
+
in: query
|
|
543
|
+
required: false
|
|
544
|
+
description: Only return entries at or after this timestamp.
|
|
545
|
+
schema:
|
|
546
|
+
type: string
|
|
547
|
+
format: date-time
|
|
548
|
+
examples:
|
|
549
|
+
- '2026-09-01T00:00:00.000Z'
|
|
550
|
+
- name: to
|
|
551
|
+
in: query
|
|
552
|
+
required: false
|
|
553
|
+
description: Only return entries at or before this timestamp.
|
|
554
|
+
schema:
|
|
555
|
+
type: string
|
|
556
|
+
format: date-time
|
|
557
|
+
examples:
|
|
558
|
+
- '2026-09-30T23:59:59.999Z'
|
|
559
|
+
- name: action
|
|
560
|
+
in: query
|
|
561
|
+
required: false
|
|
562
|
+
description: Filter by the change type. Maps to the `event` field on each entry.
|
|
563
|
+
schema:
|
|
564
|
+
type: string
|
|
565
|
+
enum:
|
|
566
|
+
- create
|
|
567
|
+
- update
|
|
568
|
+
- delete
|
|
569
|
+
- view
|
|
570
|
+
- restore
|
|
571
|
+
- purge
|
|
572
|
+
- signin
|
|
573
|
+
- signout
|
|
574
|
+
- purgelogs
|
|
575
|
+
examples:
|
|
576
|
+
- update
|
|
577
|
+
x-enumDescriptions:
|
|
578
|
+
create: A resource was created.
|
|
579
|
+
update: A resource was modified.
|
|
580
|
+
delete: A resource was deleted (moved to recycle bin).
|
|
581
|
+
view: A resource was viewed or accessed.
|
|
582
|
+
restore: A resource was restored from the recycle bin.
|
|
583
|
+
purge: A resource was permanently purged from the recycle bin.
|
|
584
|
+
signin: A user signed in to the account.
|
|
585
|
+
signout: A user signed out of the account.
|
|
586
|
+
purgelogs: Execution logs were purged for a resource.
|
|
587
|
+
- name: source
|
|
588
|
+
in: query
|
|
589
|
+
required: false
|
|
590
|
+
description: Filter by how the change was initiated.
|
|
591
|
+
schema:
|
|
592
|
+
type: string
|
|
593
|
+
enum:
|
|
594
|
+
- ui
|
|
595
|
+
- api
|
|
596
|
+
- system
|
|
597
|
+
- connector
|
|
598
|
+
- script
|
|
599
|
+
- sso
|
|
600
|
+
examples:
|
|
601
|
+
- api
|
|
602
|
+
x-enumDescriptions:
|
|
603
|
+
ui: Change made through the Celigo web UI.
|
|
604
|
+
api: Change made via the REST API.
|
|
605
|
+
system: Change made automatically by the platform.
|
|
606
|
+
connector: Change made by an Integration App (connector) process.
|
|
607
|
+
script: Change made by a custom script execution.
|
|
608
|
+
sso: Change triggered by an SSO authentication event.
|
|
609
|
+
- name: _byUserId
|
|
610
|
+
in: query
|
|
611
|
+
required: false
|
|
612
|
+
description: Filter to changes performed by a single user.
|
|
613
|
+
schema:
|
|
614
|
+
type: string
|
|
615
|
+
format: objectId
|
|
616
|
+
x-celigo-refModel: users
|
|
617
|
+
examples:
|
|
618
|
+
- 624cb0346309dc3a543733a2
|
|
619
|
+
responses:
|
|
620
|
+
'200':
|
|
621
|
+
description: Array of audit entries, newest first.
|
|
622
|
+
headers:
|
|
623
|
+
Link:
|
|
624
|
+
description: |-
|
|
625
|
+
RFC 5988 pagination link. Includes `<...>; rel="next"` with an
|
|
626
|
+
`after` cursor when more entries exist; absent on the final page.
|
|
627
|
+
schema:
|
|
628
|
+
type: string
|
|
629
|
+
content:
|
|
630
|
+
application/json:
|
|
631
|
+
schema:
|
|
632
|
+
type: array
|
|
633
|
+
items:
|
|
634
|
+
type: object
|
|
635
|
+
properties:
|
|
636
|
+
_id:
|
|
637
|
+
type: string
|
|
638
|
+
format: objectId
|
|
639
|
+
description: Unique identifier for this audit entry.
|
|
640
|
+
examples:
|
|
641
|
+
- 6ab1f5a0b9e454749402f002
|
|
642
|
+
resourceType:
|
|
643
|
+
type: string
|
|
644
|
+
description: Always `networkpolicy` for this endpoint.
|
|
645
|
+
examples:
|
|
646
|
+
- networkpolicy
|
|
647
|
+
_resourceId:
|
|
648
|
+
type: string
|
|
649
|
+
format: objectId
|
|
650
|
+
x-celigo-refModel: networkpolicies
|
|
651
|
+
description: ID of the network policy this entry belongs to.
|
|
652
|
+
examples:
|
|
653
|
+
- 6ab1f501b9e454749402c749
|
|
654
|
+
event:
|
|
655
|
+
type: string
|
|
656
|
+
description: |-
|
|
657
|
+
Type of change that occurred. A policy's history runs `create`, then any
|
|
658
|
+
number of `update`, then `delete`; a deleted policy either gains a
|
|
659
|
+
`restore` and continues, or ends with `purge`.
|
|
660
|
+
enum:
|
|
661
|
+
- create
|
|
662
|
+
- update
|
|
663
|
+
- delete
|
|
664
|
+
- restore
|
|
665
|
+
- purge
|
|
666
|
+
x-enumDescriptions:
|
|
667
|
+
create: Policy was created
|
|
668
|
+
update: Policy fields were modified
|
|
669
|
+
delete: Policy was moved to the recycle bin
|
|
670
|
+
restore: Policy was restored from the recycle bin
|
|
671
|
+
purge: Policy was permanently removed from the recycle bin
|
|
672
|
+
source:
|
|
673
|
+
type: string
|
|
674
|
+
description: How the change was initiated. Restores from the recycle bin are recorded as `system`.
|
|
675
|
+
enum:
|
|
676
|
+
- api
|
|
677
|
+
- ui
|
|
678
|
+
- system
|
|
679
|
+
x-enumDescriptions:
|
|
680
|
+
api: Change made via the REST API
|
|
681
|
+
ui: Change made through the Celigo UI
|
|
682
|
+
system: Change made by an automated platform process
|
|
683
|
+
time:
|
|
684
|
+
type: string
|
|
685
|
+
format: date-time
|
|
686
|
+
description: When the change occurred.
|
|
687
|
+
examples:
|
|
688
|
+
- '2026-09-22T03:27:28.318Z'
|
|
689
|
+
byUser:
|
|
690
|
+
type: object
|
|
691
|
+
description: User who made the change.
|
|
692
|
+
properties:
|
|
693
|
+
_id:
|
|
694
|
+
type: string
|
|
695
|
+
format: objectId
|
|
696
|
+
x-celigo-refModel: users
|
|
697
|
+
description: User ID.
|
|
698
|
+
examples:
|
|
699
|
+
- 624cb0346309dc3a543733a2
|
|
700
|
+
email:
|
|
701
|
+
type: string
|
|
702
|
+
format: email
|
|
703
|
+
description: User email address.
|
|
704
|
+
examples:
|
|
705
|
+
- user@example.com
|
|
706
|
+
name:
|
|
707
|
+
type: string
|
|
708
|
+
description: User display name.
|
|
709
|
+
examples:
|
|
710
|
+
- Jane Doe
|
|
711
|
+
fieldChanges:
|
|
712
|
+
type: array
|
|
713
|
+
description: Fields that were modified. Empty on `create`, `delete`, `restore`, and `purge` events.
|
|
714
|
+
items:
|
|
715
|
+
type: object
|
|
716
|
+
properties:
|
|
717
|
+
fieldPath:
|
|
718
|
+
type: string
|
|
719
|
+
description: Dot-notation path of the changed field.
|
|
720
|
+
examples:
|
|
721
|
+
- ipAllowList
|
|
722
|
+
oldValue:
|
|
723
|
+
description: Previous value (absent when the field was newly set).
|
|
724
|
+
newValue:
|
|
725
|
+
description: New value (absent when the field was removed).
|
|
726
|
+
deletedInfo:
|
|
727
|
+
type: object
|
|
728
|
+
description: Metadata about the deleted policy. Present on `delete` and `purge` events.
|
|
729
|
+
properties:
|
|
730
|
+
name:
|
|
731
|
+
type: string
|
|
732
|
+
description: Name of the policy at the time of deletion.
|
|
733
|
+
examples:
|
|
734
|
+
- Corporate VPN egress
|
|
735
|
+
examples:
|
|
736
|
+
default:
|
|
737
|
+
value:
|
|
738
|
+
- _id: 6ab1f5a0b9e454749402f002
|
|
739
|
+
resourceType: networkpolicy
|
|
740
|
+
_resourceId: 6ab1f501b9e454749402c749
|
|
741
|
+
source: api
|
|
742
|
+
event: update
|
|
743
|
+
time: '2026-09-22T03:27:28.318Z'
|
|
744
|
+
byUser:
|
|
745
|
+
_id: 624cb0346309dc3a543733a2
|
|
746
|
+
email: user@example.com
|
|
747
|
+
name: Jane Doe
|
|
748
|
+
fieldChanges:
|
|
749
|
+
- fieldPath: ipAllowList
|
|
750
|
+
oldValue:
|
|
751
|
+
- 10.0.0.0/8
|
|
752
|
+
newValue:
|
|
753
|
+
- 10.0.0.0/8
|
|
754
|
+
- 172.16.0.0/12
|
|
755
|
+
- _id: 6ab1f501b9e454749402c752
|
|
756
|
+
resourceType: networkpolicy
|
|
757
|
+
_resourceId: 6ab1f501b9e454749402c749
|
|
758
|
+
source: api
|
|
759
|
+
event: create
|
|
760
|
+
time: '2026-09-22T03:24:49.115Z'
|
|
761
|
+
byUser:
|
|
762
|
+
_id: 624cb0346309dc3a543733a2
|
|
763
|
+
email: user@example.com
|
|
764
|
+
name: Jane Doe
|
|
765
|
+
fieldChanges: []
|
|
766
|
+
'204':
|
|
767
|
+
description: No audit entries exist for this network policy.
|
|
768
|
+
'400':
|
|
769
|
+
$ref: '#/components/responses/400-bad-request'
|
|
770
|
+
'401':
|
|
771
|
+
$ref: '#/components/responses/401-unauthorized'
|
|
772
|
+
'404':
|
|
773
|
+
$ref: '#/components/responses/404-not-found'
|
|
774
|
+
'422':
|
|
775
|
+
$ref: '#/components/responses/422-unprocessable-entity'
|
|
776
|
+
components:
|
|
777
|
+
securitySchemes:
|
|
778
|
+
bearerAuth:
|
|
779
|
+
type: http
|
|
780
|
+
scheme: bearer
|
|
781
|
+
parameters:
|
|
782
|
+
After:
|
|
783
|
+
name: after
|
|
784
|
+
in: query
|
|
785
|
+
required: false
|
|
786
|
+
description: |-
|
|
787
|
+
Opaque cursor for forward pagination. Pass the value from the `Link`
|
|
788
|
+
response header (`rel="next"`) to fetch the next page.
|
|
789
|
+
schema:
|
|
790
|
+
type: string
|
|
791
|
+
schemas:
|
|
792
|
+
NetworkPolicy:
|
|
793
|
+
type: object
|
|
794
|
+
description: Network policy as returned by the API.
|
|
795
|
+
x-celigo-ai-guidance:
|
|
796
|
+
- |-
|
|
797
|
+
Responses return the stored, normalized lists: a bare address comes back with `/32` (IPv4) or
|
|
798
|
+
`/128` (IPv6) appended and IPv6 ranges are compressed and lowercased, so compare against the
|
|
799
|
+
returned form rather than the value that was sent.
|
|
800
|
+
required:
|
|
801
|
+
- _id
|
|
802
|
+
- _userId
|
|
803
|
+
- name
|
|
804
|
+
- ipAllowList
|
|
805
|
+
- ipDenyList
|
|
806
|
+
- createdAt
|
|
807
|
+
- lastModified
|
|
808
|
+
properties:
|
|
809
|
+
_id:
|
|
810
|
+
type: string
|
|
811
|
+
format: objectId
|
|
812
|
+
readOnly: true
|
|
813
|
+
x-celigo-refModel: networkpolicies
|
|
814
|
+
description: Unique identifier for the network policy.
|
|
815
|
+
examples:
|
|
816
|
+
- 6ab1f501b9e454749402c749
|
|
817
|
+
_userId:
|
|
818
|
+
type: string
|
|
819
|
+
format: objectId
|
|
820
|
+
readOnly: true
|
|
821
|
+
x-celigo-refModel: users
|
|
822
|
+
description: |-
|
|
823
|
+
Environment that owns the policy — the account user for production, or the
|
|
824
|
+
sandbox user for a policy created there. A policy is visible and assignable
|
|
825
|
+
only within its own environment.
|
|
826
|
+
examples:
|
|
827
|
+
- 624cb0346309dc3a543733a2
|
|
828
|
+
name:
|
|
829
|
+
type: string
|
|
830
|
+
maxLength: 150
|
|
831
|
+
description: Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
|
|
832
|
+
examples:
|
|
833
|
+
- Corporate VPN egress
|
|
834
|
+
description:
|
|
835
|
+
type: string
|
|
836
|
+
maxLength: 500
|
|
837
|
+
description: Explains what the policy is for. Absent when the policy has no description.
|
|
838
|
+
examples:
|
|
839
|
+
- Office and VPN egress ranges. Deny beats allow.
|
|
840
|
+
ipAllowList:
|
|
841
|
+
type: array
|
|
842
|
+
maxItems: 200
|
|
843
|
+
description: |-
|
|
844
|
+
Source addresses permitted to connect, each an IPv4 or IPv6 address or CIDR
|
|
845
|
+
range in stored form (bare addresses carry `/32` or `/128`). An empty list
|
|
846
|
+
permits every address that `ipDenyList` does not block.
|
|
847
|
+
items:
|
|
848
|
+
type: string
|
|
849
|
+
examples:
|
|
850
|
+
- - 10.0.0.0/8
|
|
851
|
+
- 203.0.113.5/32
|
|
852
|
+
- 2001:db8::/32
|
|
853
|
+
ipDenyList:
|
|
854
|
+
type: array
|
|
855
|
+
maxItems: 200
|
|
856
|
+
description: |-
|
|
857
|
+
Source addresses refused even when `ipAllowList` permits them. Same entry
|
|
858
|
+
format and stored form as `ipAllowList`; deny always wins over allow.
|
|
859
|
+
items:
|
|
860
|
+
type: string
|
|
861
|
+
examples:
|
|
862
|
+
- - 198.51.100.0/24
|
|
863
|
+
createdAt:
|
|
864
|
+
type: string
|
|
865
|
+
format: date-time
|
|
866
|
+
readOnly: true
|
|
867
|
+
description: Timestamp when the policy was created.
|
|
868
|
+
examples:
|
|
869
|
+
- '2026-09-22T03:24:49.115Z'
|
|
870
|
+
lastModified:
|
|
871
|
+
type: string
|
|
872
|
+
format: date-time
|
|
873
|
+
readOnly: true
|
|
874
|
+
description: Timestamp when the policy was last modified. Updated on every PUT and PATCH that changes a field.
|
|
875
|
+
examples:
|
|
876
|
+
- '2026-09-22T03:27:28.318Z'
|
|
877
|
+
Error:
|
|
878
|
+
type: object
|
|
879
|
+
description: Standard error response envelope returned by integrator.io APIs.
|
|
880
|
+
properties:
|
|
881
|
+
errors:
|
|
882
|
+
type: array
|
|
883
|
+
description: List of errors that occurred while processing the request.
|
|
884
|
+
items:
|
|
885
|
+
type: object
|
|
886
|
+
properties:
|
|
887
|
+
code:
|
|
888
|
+
oneOf:
|
|
889
|
+
- type: string
|
|
890
|
+
- type: integer
|
|
891
|
+
description: |-
|
|
892
|
+
Machine-readable error code. Usually a string like
|
|
893
|
+
`invalid_ref`, `missing_required_field`, or `unauthorized`;
|
|
894
|
+
may be an **integer** when the error mirrors an upstream HTTP
|
|
895
|
+
status (e.g. `500`) — most commonly returned by connection-ping
|
|
896
|
+
and adaptor-proxy responses.
|
|
897
|
+
message:
|
|
898
|
+
type: string
|
|
899
|
+
description: Human-readable description of the error.
|
|
900
|
+
field:
|
|
901
|
+
type: string
|
|
902
|
+
description: |-
|
|
903
|
+
Optional pointer to the document field that caused the error.
|
|
904
|
+
Used by structural validation errors (`missing_required_field`,
|
|
905
|
+
`invalid_ref`) to indicate which field is at fault
|
|
906
|
+
(e.g. `_id`, `type`, `http.baseURI`).
|
|
907
|
+
source:
|
|
908
|
+
type: string
|
|
909
|
+
description: |-
|
|
910
|
+
Optional origin layer for the error — e.g. `application` when
|
|
911
|
+
the error came from the remote system the adaptor called,
|
|
912
|
+
`connector` when the adaptor itself rejected the request.
|
|
913
|
+
required:
|
|
914
|
+
- message
|
|
915
|
+
required:
|
|
916
|
+
- errors
|
|
917
|
+
Request:
|
|
918
|
+
type: object
|
|
919
|
+
description: Request body for creating or replacing a network policy.
|
|
920
|
+
x-celigo-ai-guidance:
|
|
921
|
+
- |-
|
|
922
|
+
Send `ipAllowList`, `ipDenyList`, and `description` on every PUT. A replace clears whatever
|
|
923
|
+
it omits — a rename that sends only `name` comes back with both lists empty and the
|
|
924
|
+
description gone, which silently removes every IP restriction the policy carried.
|
|
925
|
+
- |-
|
|
926
|
+
Write entries as IPv4 or IPv6 addresses or CIDR ranges; the server stores bare addresses as
|
|
927
|
+
`/32` or `/128`. Anything else — a hostname, an empty string, a number, a prefix longer than
|
|
928
|
+
the address family allows — fails with 400 `invalid_cidr`, and a list of more than 200
|
|
929
|
+
entries fails with 400 `max_cidr_entries_exceeded`. Duplicate entries are stored as sent.
|
|
930
|
+
- |-
|
|
931
|
+
`name` must be unique among the environment's live policies: a duplicate fails with 409
|
|
932
|
+
`conflict` on create, replace, and patch. A name held only by a policy in the recycle bin
|
|
933
|
+
can be reused.
|
|
934
|
+
required:
|
|
935
|
+
- name
|
|
936
|
+
properties:
|
|
937
|
+
name:
|
|
938
|
+
type: string
|
|
939
|
+
maxLength: 150
|
|
940
|
+
description: Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
|
|
941
|
+
x-celigo-ai-guidance:
|
|
942
|
+
- Name the policy after the network it describes ("Corporate VPN egress", "Partner SFTP host"), not after the token or MCP server it is assigned to — one policy can be assigned to many principals.
|
|
943
|
+
examples:
|
|
944
|
+
- Corporate VPN egress
|
|
945
|
+
description:
|
|
946
|
+
type: string
|
|
947
|
+
maxLength: 500
|
|
948
|
+
description: Explains what the policy is for and where its ranges come from. Omit on PUT to clear it.
|
|
949
|
+
examples:
|
|
950
|
+
- Office and VPN egress ranges. Deny beats allow.
|
|
951
|
+
ipAllowList:
|
|
952
|
+
type: array
|
|
953
|
+
maxItems: 200
|
|
954
|
+
description: |-
|
|
955
|
+
Source addresses permitted to connect. Each entry is an IPv4 or IPv6 address
|
|
956
|
+
or CIDR range; bare addresses are stored as `/32` or `/128`. Leave empty to
|
|
957
|
+
permit every address that `ipDenyList` does not block. Omitting the field on
|
|
958
|
+
PUT empties the list.
|
|
959
|
+
items:
|
|
960
|
+
type: string
|
|
961
|
+
examples:
|
|
962
|
+
- - 10.0.0.0/8
|
|
963
|
+
- 203.0.113.5
|
|
964
|
+
- 2001:db8::/32
|
|
965
|
+
ipDenyList:
|
|
966
|
+
type: array
|
|
967
|
+
maxItems: 200
|
|
968
|
+
description: |-
|
|
969
|
+
Source addresses refused even when `ipAllowList` permits them. Same entry
|
|
970
|
+
format as `ipAllowList`; deny always wins over allow. Omitting the field on
|
|
971
|
+
PUT empties the list.
|
|
972
|
+
items:
|
|
973
|
+
type: string
|
|
974
|
+
examples:
|
|
975
|
+
- - 198.51.100.0/24
|
|
976
|
+
NetworkPolicyDependencyRef:
|
|
977
|
+
type: object
|
|
978
|
+
description: A resource the policy is assigned to.
|
|
979
|
+
required:
|
|
980
|
+
- _id
|
|
981
|
+
- name
|
|
982
|
+
properties:
|
|
983
|
+
_id:
|
|
984
|
+
type: string
|
|
985
|
+
format: objectId
|
|
986
|
+
description: Identifier of the assigned resource; use it with the resource's own `GET /v1/<type>/{_id}` endpoint.
|
|
987
|
+
examples:
|
|
988
|
+
- 6ab1f4a95af4c5a3ea6b0a28
|
|
989
|
+
name:
|
|
990
|
+
type: string
|
|
991
|
+
description: Display name of the assigned resource at the time of the request.
|
|
992
|
+
examples:
|
|
993
|
+
- Order lookup MCP server
|
|
994
|
+
NetworkPolicyEnvironmentRef:
|
|
995
|
+
type: object
|
|
996
|
+
description: An environment whose sign-in the policy restricts.
|
|
997
|
+
required:
|
|
998
|
+
- _envUserId
|
|
999
|
+
- name
|
|
1000
|
+
properties:
|
|
1001
|
+
_envUserId:
|
|
1002
|
+
type: string
|
|
1003
|
+
format: objectId
|
|
1004
|
+
x-celigo-refModel: users
|
|
1005
|
+
description: Account user that represents the environment holding the assignment.
|
|
1006
|
+
examples:
|
|
1007
|
+
- 624cb0346309dc3a543733a2
|
|
1008
|
+
name:
|
|
1009
|
+
type:
|
|
1010
|
+
- string
|
|
1011
|
+
- 'null'
|
|
1012
|
+
description: Environment name. Null when the environment has no name record, in which case identify it by `_envUserId`.
|
|
1013
|
+
examples:
|
|
1014
|
+
- Production
|
|
1015
|
+
NetworkPolicyDependencies:
|
|
1016
|
+
type: object
|
|
1017
|
+
description: |-
|
|
1018
|
+
Every place a network policy is assigned within its own environment. All four
|
|
1019
|
+
keys are always present; an unassigned policy returns empty arrays and `false`
|
|
1020
|
+
flags.
|
|
1021
|
+
required:
|
|
1022
|
+
- mcpservers
|
|
1023
|
+
- accesstokens
|
|
1024
|
+
- account
|
|
1025
|
+
properties:
|
|
1026
|
+
mcpservers:
|
|
1027
|
+
type: array
|
|
1028
|
+
description: MCP servers whose `_networkPolicyId` is this policy.
|
|
1029
|
+
items:
|
|
1030
|
+
$ref: '#/components/schemas/NetworkPolicyDependencyRef'
|
|
1031
|
+
accesstokens:
|
|
1032
|
+
type: array
|
|
1033
|
+
description: API tokens whose `_networkPolicyId` is this policy. Personal access tokens never appear here; they inherit the account's workspace-user policy instead.
|
|
1034
|
+
items:
|
|
1035
|
+
$ref: '#/components/schemas/NetworkPolicyDependencyRef'
|
|
1036
|
+
account:
|
|
1037
|
+
type: object
|
|
1038
|
+
description: Account sign-in assignments of this policy, resolved per environment.
|
|
1039
|
+
required:
|
|
1040
|
+
- workspaceUsers
|
|
1041
|
+
- workspaceUserEnvironments
|
|
1042
|
+
- endUsers
|
|
1043
|
+
- endUserEnvironments
|
|
1044
|
+
properties:
|
|
1045
|
+
workspaceUsers:
|
|
1046
|
+
type: boolean
|
|
1047
|
+
description: When true, the policy restricts workspace-user sign-in in at least one environment listed in `workspaceUserEnvironments`.
|
|
1048
|
+
examples:
|
|
1049
|
+
- false
|
|
1050
|
+
workspaceUserEnvironments:
|
|
1051
|
+
type: array
|
|
1052
|
+
description: Environments whose workspace-user sign-in this policy restricts. Empty when `workspaceUsers` is false.
|
|
1053
|
+
items:
|
|
1054
|
+
$ref: '#/components/schemas/NetworkPolicyEnvironmentRef'
|
|
1055
|
+
endUsers:
|
|
1056
|
+
type: boolean
|
|
1057
|
+
description: When true, the policy restricts end-user sign-in in at least one environment listed in `endUserEnvironments`.
|
|
1058
|
+
examples:
|
|
1059
|
+
- false
|
|
1060
|
+
endUserEnvironments:
|
|
1061
|
+
type: array
|
|
1062
|
+
description: Environments whose end-user sign-in this policy restricts. Empty when `endUsers` is false.
|
|
1063
|
+
items:
|
|
1064
|
+
$ref: '#/components/schemas/NetworkPolicyEnvironmentRef'
|
|
1065
|
+
JsonPatchOperation:
|
|
1066
|
+
type: object
|
|
1067
|
+
description: A single JSON Patch operation (RFC 6902).
|
|
1068
|
+
required:
|
|
1069
|
+
- op
|
|
1070
|
+
- path
|
|
1071
|
+
properties:
|
|
1072
|
+
op:
|
|
1073
|
+
type: string
|
|
1074
|
+
enum:
|
|
1075
|
+
- replace
|
|
1076
|
+
- add
|
|
1077
|
+
- remove
|
|
1078
|
+
x-enumDescriptions:
|
|
1079
|
+
replace: Replaces the value at the specified path.
|
|
1080
|
+
add: Sets the value at the specified path.
|
|
1081
|
+
remove: Removes the value at the specified path.
|
|
1082
|
+
description: The operation to perform.
|
|
1083
|
+
path:
|
|
1084
|
+
type: string
|
|
1085
|
+
description: |-
|
|
1086
|
+
JSON Pointer (RFC 6901) to the field to patch. Only
|
|
1087
|
+
whitelisted paths are accepted — unlisted paths return
|
|
1088
|
+
`422` with `"<path> is not a whitelisted property"`.
|
|
1089
|
+
value:
|
|
1090
|
+
description: The new value to set. Required for `replace` and `add`, omit for `remove`.
|
|
1091
|
+
JsonPatchRequest:
|
|
1092
|
+
type: array
|
|
1093
|
+
description: |-
|
|
1094
|
+
A JSON Patch document (RFC 6902). Send an array of patch
|
|
1095
|
+
operations on whitelisted fields — all other paths are rejected
|
|
1096
|
+
with 422.
|
|
1097
|
+
minItems: 1
|
|
1098
|
+
items:
|
|
1099
|
+
$ref: '#/components/schemas/JsonPatchOperation'
|
|
1100
|
+
responses:
|
|
1101
|
+
400-bad-request:
|
|
1102
|
+
description: |
|
|
1103
|
+
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
|
|
1104
|
+
content:
|
|
1105
|
+
application/json:
|
|
1106
|
+
schema:
|
|
1107
|
+
$ref: '#/components/schemas/Error'
|
|
1108
|
+
examples:
|
|
1109
|
+
default:
|
|
1110
|
+
value:
|
|
1111
|
+
errors:
|
|
1112
|
+
- code: invalid_request
|
|
1113
|
+
message: The request body failed validation.
|
|
1114
|
+
401-unauthorized:
|
|
1115
|
+
description: |-
|
|
1116
|
+
Unauthorized. The request lacks a valid bearer token, or the provided token
|
|
1117
|
+
failed to authenticate.
|
|
1118
|
+
|
|
1119
|
+
Note: the 401 response is produced by the auth middleware **before** the
|
|
1120
|
+
request reaches the endpoint handler, so it does **not** follow the
|
|
1121
|
+
standard `{errors: [...]}` envelope. Instead the body is a bare
|
|
1122
|
+
`{message: string}` object with no `code`, no `errors` array. Callers
|
|
1123
|
+
handling 401s should key off the HTTP status and the `message` string,
|
|
1124
|
+
not try to destructure an `errors[]`.
|
|
1125
|
+
content:
|
|
1126
|
+
application/json:
|
|
1127
|
+
schema:
|
|
1128
|
+
type: object
|
|
1129
|
+
properties:
|
|
1130
|
+
message:
|
|
1131
|
+
type: string
|
|
1132
|
+
description: |-
|
|
1133
|
+
Human-readable description of the auth failure. Known values:
|
|
1134
|
+
- `"Unauthorized"` — no `Authorization` header on the request.
|
|
1135
|
+
- `"Bearer Authentication Failed"` — header present but token
|
|
1136
|
+
is invalid, revoked, or expired.
|
|
1137
|
+
required:
|
|
1138
|
+
- message
|
|
1139
|
+
examples:
|
|
1140
|
+
missing_token:
|
|
1141
|
+
summary: No Authorization header sent
|
|
1142
|
+
value:
|
|
1143
|
+
message: Unauthorized
|
|
1144
|
+
invalid_token:
|
|
1145
|
+
summary: Bearer token invalid or revoked
|
|
1146
|
+
value:
|
|
1147
|
+
message: Bearer Authentication Failed
|
|
1148
|
+
422-unprocessable-entity:
|
|
1149
|
+
description: |
|
|
1150
|
+
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
|
|
1151
|
+
content:
|
|
1152
|
+
application/json:
|
|
1153
|
+
schema:
|
|
1154
|
+
$ref: '#/components/schemas/Error'
|
|
1155
|
+
examples:
|
|
1156
|
+
default:
|
|
1157
|
+
value:
|
|
1158
|
+
errors:
|
|
1159
|
+
- code: unprocessable_entity
|
|
1160
|
+
message: The request could not be processed due to a semantic error.
|
|
1161
|
+
409-name-conflict:
|
|
1162
|
+
description: |-
|
|
1163
|
+
Conflict. Another policy in this environment that is not in the recycle bin
|
|
1164
|
+
already uses the requested `name`.
|
|
1165
|
+
content:
|
|
1166
|
+
application/json:
|
|
1167
|
+
schema:
|
|
1168
|
+
$ref: '#/components/schemas/Error'
|
|
1169
|
+
examples:
|
|
1170
|
+
default:
|
|
1171
|
+
value:
|
|
1172
|
+
errors:
|
|
1173
|
+
- code: conflict
|
|
1174
|
+
message: A network policy with this name already exists in the account.
|
|
1175
|
+
404-not-found:
|
|
1176
|
+
description: |
|
|
1177
|
+
Not found. The requested resource does not exist or is not visible to the caller.
|
|
1178
|
+
content:
|
|
1179
|
+
application/json:
|
|
1180
|
+
schema:
|
|
1181
|
+
$ref: '#/components/schemas/Error'
|
|
1182
|
+
examples:
|
|
1183
|
+
default:
|
|
1184
|
+
value:
|
|
1185
|
+
errors:
|
|
1186
|
+
- code: not_found
|
|
1187
|
+
message: The requested resource was not found.
|
|
1188
|
+
409-in-use:
|
|
1189
|
+
description: |-
|
|
1190
|
+
Conflict. The policy is still assigned to at least one API token, MCP server, or
|
|
1191
|
+
account sign-in setting, so it was not deleted. `info` lists every assignment;
|
|
1192
|
+
repeat the request with `force=true` to clear them and delete the policy.
|
|
1193
|
+
content:
|
|
1194
|
+
application/json:
|
|
1195
|
+
schema:
|
|
1196
|
+
allOf:
|
|
1197
|
+
- $ref: '#/components/schemas/Error'
|
|
1198
|
+
- type: object
|
|
1199
|
+
properties:
|
|
1200
|
+
info:
|
|
1201
|
+
$ref: '#/components/schemas/NetworkPolicyDependencies'
|
|
1202
|
+
examples:
|
|
1203
|
+
default:
|
|
1204
|
+
value:
|
|
1205
|
+
errors:
|
|
1206
|
+
- code: network_policy_in_use
|
|
1207
|
+
message: This policy is assigned to 2 resources. Deleting it removes those restrictions.
|
|
1208
|
+
info:
|
|
1209
|
+
mcpservers:
|
|
1210
|
+
- _id: 6ab1f4a95af4c5a3ea6b0a28
|
|
1211
|
+
name: Order lookup MCP server
|
|
1212
|
+
accesstokens:
|
|
1213
|
+
- _id: 6ab1f6a338d7733b4599ec83
|
|
1214
|
+
name: Warehouse sync token
|
|
1215
|
+
account:
|
|
1216
|
+
workspaceUsers: false
|
|
1217
|
+
workspaceUserEnvironments: []
|
|
1218
|
+
endUsers: false
|
|
1219
|
+
endUserEnvironments: []
|
|
1220
|
+
x-internal: false
|
|
1221
|
+
x-enable-proxy: true
|
package/dist/subscription.yml
CHANGED
|
@@ -812,29 +812,71 @@ components:
|
|
|
812
812
|
- true
|
|
813
813
|
di:
|
|
814
814
|
type: object
|
|
815
|
-
description:
|
|
815
|
+
description: |-
|
|
816
|
+
Data Ingestion (Celigo Sync) entitlements. Every paid edition includes a base
|
|
817
|
+
allowance — one enabled sync per environment and a monthly loaded-row volume —
|
|
818
|
+
and a Data Ingestion volume pack adds capacity on top of it. A free trial
|
|
819
|
+
carries the Enterprise-equivalent allowance for its duration; the free plan
|
|
820
|
+
after the trial has no Data Ingestion.
|
|
816
821
|
required:
|
|
817
822
|
- enabled
|
|
818
823
|
- volume
|
|
819
824
|
- volumeAddOn
|
|
820
825
|
- disableOverage
|
|
826
|
+
x-celigo-ai-guidance:
|
|
827
|
+
- |-
|
|
828
|
+
Read the entitlement from this block, never from a tier table: `volume` is
|
|
829
|
+
the edition's included monthly loaded rows and `volumeAddOn` the purchased
|
|
830
|
+
capacity. A trial's allowance is computed by the platform and is reported
|
|
831
|
+
here while the trial is active.
|
|
832
|
+
- |-
|
|
833
|
+
The entitlement is enforced when a sync is enabled, not when it is created.
|
|
834
|
+
Saving a sync with `disabled: false` returns `422 di_subscription_required`
|
|
835
|
+
("Your license does not support Data Ingestion") when the account has no
|
|
836
|
+
entitlement, `di_sync_limit_exceeded` when the environment already has an
|
|
837
|
+
enabled sync and `volumeAddOn` is 0, and `di_usage_limit_exceeded` on volume
|
|
838
|
+
in two cases: while `histLoadEndDate` is in the future (with `volumeAddOn`
|
|
839
|
+
above 0), when the month's loaded rows have reached the historical-load cap —
|
|
840
|
+
regardless of `disableOverage`; otherwise, only when `disableOverage` is in
|
|
841
|
+
force and the month's loaded rows already exceed the allowance.
|
|
821
842
|
properties:
|
|
822
843
|
enabled:
|
|
823
844
|
type: boolean
|
|
824
|
-
description: When true, the plan entitles the account to
|
|
845
|
+
description: When true, the plan entitles the account to enable and run Data Ingestion syncs.
|
|
825
846
|
example: false
|
|
826
847
|
volume:
|
|
827
848
|
type: integer
|
|
828
|
-
description:
|
|
849
|
+
description: |-
|
|
850
|
+
Monthly loaded-row allowance included with the edition. Without the add-on,
|
|
851
|
+
crossing it lets the running job finish and disables the sync from its next
|
|
852
|
+
run until the next month.
|
|
829
853
|
example: 0
|
|
830
854
|
volumeAddOn:
|
|
831
855
|
type: integer
|
|
832
|
-
description:
|
|
856
|
+
description: |-
|
|
857
|
+
Additional monthly loaded rows purchased as a Data Ingestion volume pack. With
|
|
858
|
+
a pack the account is no longer limited to one enabled sync per environment;
|
|
859
|
+
when the pack lapses, each environment is trimmed back to its most recently
|
|
860
|
+
run sync.
|
|
833
861
|
example: 0
|
|
834
862
|
disableOverage:
|
|
835
863
|
type: boolean
|
|
836
|
-
description:
|
|
864
|
+
description: |-
|
|
865
|
+
When true, monthly overage is not permitted: once the month's loaded rows
|
|
866
|
+
reach the allowance, syncs cannot be enabled until the next month. Trial
|
|
867
|
+
licenses enforce this unless the field is explicitly false. Not consulted
|
|
868
|
+
while a historical-load window (`histLoadEndDate`) is active.
|
|
837
869
|
example: false
|
|
870
|
+
histLoadEndDate:
|
|
871
|
+
type: string
|
|
872
|
+
format: date-time
|
|
873
|
+
description: |-
|
|
874
|
+
End of the historical-load window granted with a volume pack. While this date
|
|
875
|
+
is in the future and `volumeAddOn` is above 0, the monthly cap is raised to a
|
|
876
|
+
platform-configured multiple (50 by default) of `volume` plus `volumeAddOn` —
|
|
877
|
+
still checked per calendar month — and `disableOverage` is not consulted.
|
|
878
|
+
Absent when no window is active.
|
|
879
|
+
example: '2026-10-29T00:00:00.000Z'
|
|
838
880
|
api:
|
|
839
881
|
type: object
|
|
840
882
|
description: API Builder plan entitlements and invocation limits.
|
|
@@ -1522,7 +1564,7 @@ components:
|
|
|
1522
1564
|
example: 0
|
|
1523
1565
|
diVolume:
|
|
1524
1566
|
type: integer
|
|
1525
|
-
description: Data
|
|
1567
|
+
description: Data Ingestion (Celigo Sync) rows loaded during the month.
|
|
1526
1568
|
example: 0
|
|
1527
1569
|
allocated:
|
|
1528
1570
|
type: object
|
package/package.json
CHANGED