@celigo/api-specs 0.2.72 → 0.2.74

package/dist/api.yml

@@ -4891,16 +4891,16 @@ components:
                 netsuite: NetSuite ERP connection using token-based authentication (TBA).
                 salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
                 ftp: FTP, SFTP, or FTPS file transfer connection.
-                s3: Amazon S3 cloud storage connection.
+                s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
                 wrapper: Wrapper connection that delegates to another connection type.
                 http: Generic HTTP/REST API connection with full configuration control.
-                rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+                rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
                 mongodb: MongoDB NoSQL database connection.
                 as2: AS2 (Applicability Statement 2) EDI connection.
                 filesystem: Local or network filesystem connection (requires an Agent).
                 mcp: MCP (Model Context Protocol) server connection.
                 dynamodb: Amazon DynamoDB NoSQL database connection.
-                jdbc: JDBC database connection for systems not covered by RDBMS.
+                jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
                 van: Value-Added Network connection for EDI document exchange.
                 rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
             externalId:
@@ -5777,26 +5777,39 @@ components:
             (s3:GetObject, s3:PutObject, s3:ListBucket, etc.). Used when authType is `accesskey`.
           examples:
             - AKIAIOSFODNN7EXAMPLE
-          x-celigo-ui-override: The connection form marks accessKeyId required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks accessKeyId required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         secretAccessKey:
           type: string
           writeOnly: true
           description: AWS secret access key, paired with accessKeyId. Used when authType is `accesskey`. Encrypted at rest; returned masked as `"******"`.
           examples:
             - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-          x-celigo-ui-override: The connection form marks secretAccessKey required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks secretAccessKey required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         _iClientId:
           type: string
           format: objectId
           x-celigo-refModel: iclients
           description: |-
             Reference to an iClient that holds AWS IAM role credentials. Required when authType is
-            `awsIam`; ignored otherwise.
+            `awsIam`; ignored otherwise. The iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-file-adaptor-` — the S3 service assumes only roles in that family,
+            so a role created for an HTTP or Redshift connection cannot be reused here.
           examples:
             - 65f99e3e6b5b420fea998454
           x-celigo-ai-guidance:
             - When authType is "awsIam", set _iClientId to an existing iClient; omitting it fails the POST with 422 "Expected field: _iClientId to be present."
             - The referenced iClient must itself be an awsIam-provider iClient; referencing any other iClient fails the POST with 422 "IClient provider must be awsIam for S3 IAM Role authentication."
+            - |-
+              The referenced iClient must have awsIam.roleArn set (otherwise 422 missing_required_field on
+              s3._iClientId "Expected field: awsIam.roleArn to be present.") and its role name must start
+              with "celigo-file-adaptor-" (otherwise 422 invalid_field_value on s3._iClientId "Invalid
+              value for field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor.").
+              Point an S3 connection at an iClient whose role was named for S3; do not reuse a
+              celigo-http-adaptor- or celigo-data-warehouse-adaptor- role.
+            - |-
+              With authType "awsIam", omit accessKeyId and secretAccessKey — the API does not reject
+              them, it stores them alongside the iClient reference, leaving a stray static credential
+              on a connection that no longer uses one.
         pingBucket:
           type: string
           description: |-
@@ -7872,9 +7885,26 @@ components:
             rdbms object. Required when type is `mssql` and `mssql.authType` is
             `azure-service-principal` (Azure service-principal credentials), and
             when type is `redshift` and `redshift.authType` is `awsIam` (an
-            `awsIam`-provider iClient holding the role ARN to assume).
+            `awsIam`-provider iClient holding the role ARN to assume). For
+            Redshift the iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-data-warehouse-adaptor-` — the data-warehouse
+            service assumes only roles in that family, so a role created for an S3
+            or HTTP connection cannot be reused here.
           examples:
             - 66a1b2c3d4e5f60718293a4b
+          x-celigo-ai-guidance:
+            - |-
+              For a Redshift connection with redshift.authType "awsIam", the referenced iClient must
+              have awsIam.roleArn set (otherwise 422 missing_required_field on rdbms._iClientId
+              "Expected field: awsIam.roleArn to be present.") and its role name must start with
+              "celigo-data-warehouse-adaptor-" (otherwise 422 invalid_field_value on rdbms._iClientId
+              "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+              celigo-data-warehouse-adaptor."). Do not reuse a celigo-file-adaptor- or
+              celigo-http-adaptor- role.
+            - |-
+              With redshift.authType "awsIam", omit the top-level user and password — the API does not
+              reject them, it stores them on a connection whose form has no field that could ever
+              clear them; the database user is derived from the assumed role at runtime.
       if:
         properties:
           type:

package/dist/connection.yml

@@ -666,6 +666,27 @@ paths:
                       - field: http._iClientId
                         code: invalid_field_value
                         message: HTTP IAM Role authentication requires awsIam.roleArn to reference a role name starting with celigo-http-adaptor-.
+                awsIamRoleArnMissingOnS3:
+                  summary: S3 awsIam connection referencing an iClient without roleArn
+                  value:
+                    errors:
+                      - field: s3._iClientId
+                        code: missing_required_field
+                        message: 'Expected field: awsIam.roleArn to be present.'
+                awsIamRoleArnPrefixS3:
+                  summary: S3 awsIam iClient whose role name lacks the celigo-file-adaptor- prefix
+                  value:
+                    errors:
+                      - field: s3._iClientId
+                        code: invalid_field_value
+                        message: 'Invalid value for field "_iClientId": Your role ARN''s name must begin with celigo-file-adaptor.'
+                awsIamRoleArnPrefixRedshift:
+                  summary: Redshift awsIam iClient whose role name lacks the celigo-data-warehouse-adaptor- prefix
+                  value:
+                    errors:
+                      - field: rdbms._iClientId
+                        code: invalid_field_value
+                        message: 'Invalid value for field "_iClientId": Your role ARN''s name must begin with celigo-data-warehouse-adaptor.'
                 iClientOtherAccount:
                   summary: iClient owned by another account
                   value:
@@ -3124,16 +3145,16 @@ components:
                 netsuite: NetSuite ERP connection using token-based authentication (TBA).
                 salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
                 ftp: FTP, SFTP, or FTPS file transfer connection.
-                s3: Amazon S3 cloud storage connection.
+                s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
                 wrapper: Wrapper connection that delegates to another connection type.
                 http: Generic HTTP/REST API connection with full configuration control.
-                rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+                rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
                 mongodb: MongoDB NoSQL database connection.
                 as2: AS2 (Applicability Statement 2) EDI connection.
                 filesystem: Local or network filesystem connection (requires an Agent).
                 mcp: MCP (Model Context Protocol) server connection.
                 dynamodb: Amazon DynamoDB NoSQL database connection.
-                jdbc: JDBC database connection for systems not covered by RDBMS.
+                jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
                 van: Value-Added Network connection for EDI document exchange.
                 rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
             externalId:
@@ -4010,26 +4031,39 @@ components:
             (s3:GetObject, s3:PutObject, s3:ListBucket, etc.). Used when authType is `accesskey`.
           examples:
             - AKIAIOSFODNN7EXAMPLE
-          x-celigo-ui-override: The connection form marks accessKeyId required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks accessKeyId required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         secretAccessKey:
           type: string
           writeOnly: true
           description: AWS secret access key, paired with accessKeyId. Used when authType is `accesskey`. Encrypted at rest; returned masked as `"******"`.
           examples:
             - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-          x-celigo-ui-override: The connection form marks secretAccessKey required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks secretAccessKey required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         _iClientId:
           type: string
           format: objectId
           x-celigo-refModel: iclients
           description: |-
             Reference to an iClient that holds AWS IAM role credentials. Required when authType is
-            `awsIam`; ignored otherwise.
+            `awsIam`; ignored otherwise. The iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-file-adaptor-` — the S3 service assumes only roles in that family,
+            so a role created for an HTTP or Redshift connection cannot be reused here.
           examples:
             - 65f99e3e6b5b420fea998454
           x-celigo-ai-guidance:
             - When authType is "awsIam", set _iClientId to an existing iClient; omitting it fails the POST with 422 "Expected field: _iClientId to be present."
             - The referenced iClient must itself be an awsIam-provider iClient; referencing any other iClient fails the POST with 422 "IClient provider must be awsIam for S3 IAM Role authentication."
+            - |-
+              The referenced iClient must have awsIam.roleArn set (otherwise 422 missing_required_field on
+              s3._iClientId "Expected field: awsIam.roleArn to be present.") and its role name must start
+              with "celigo-file-adaptor-" (otherwise 422 invalid_field_value on s3._iClientId "Invalid
+              value for field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor.").
+              Point an S3 connection at an iClient whose role was named for S3; do not reuse a
+              celigo-http-adaptor- or celigo-data-warehouse-adaptor- role.
+            - |-
+              With authType "awsIam", omit accessKeyId and secretAccessKey — the API does not reject
+              them, it stores them alongside the iClient reference, leaving a stray static credential
+              on a connection that no longer uses one.
         pingBucket:
           type: string
           description: |-
@@ -6105,9 +6139,26 @@ components:
             rdbms object. Required when type is `mssql` and `mssql.authType` is
             `azure-service-principal` (Azure service-principal credentials), and
             when type is `redshift` and `redshift.authType` is `awsIam` (an
-            `awsIam`-provider iClient holding the role ARN to assume).
+            `awsIam`-provider iClient holding the role ARN to assume). For
+            Redshift the iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-data-warehouse-adaptor-` — the data-warehouse
+            service assumes only roles in that family, so a role created for an S3
+            or HTTP connection cannot be reused here.
           examples:
             - 66a1b2c3d4e5f60718293a4b
+          x-celigo-ai-guidance:
+            - |-
+              For a Redshift connection with redshift.authType "awsIam", the referenced iClient must
+              have awsIam.roleArn set (otherwise 422 missing_required_field on rdbms._iClientId
+              "Expected field: awsIam.roleArn to be present.") and its role name must start with
+              "celigo-data-warehouse-adaptor-" (otherwise 422 invalid_field_value on rdbms._iClientId
+              "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+              celigo-data-warehouse-adaptor."). Do not reuse a celigo-file-adaptor- or
+              celigo-http-adaptor- role.
+            - |-
+              With redshift.authType "awsIam", omit the top-level user and password — the API does not
+              reject them, it stores them on a connection whose form has no field that could ever
+              clear them; the database user is derived from the assumed role at runtime.
       if:
         properties:
           type:
@@ -8262,16 +8313,16 @@ components:
             netsuite: NetSuite ERP connection using token-based authentication (TBA).
             salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
             ftp: FTP, SFTP, or FTPS file transfer connection.
-            s3: Amazon S3 cloud storage connection.
+            s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
             wrapper: Wrapper connection that delegates to another connection type.
             http: Generic HTTP/REST API connection with full configuration control.
-            rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+            rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
             mongodb: MongoDB NoSQL database connection.
             as2: AS2 (Applicability Statement 2) EDI connection.
             filesystem: Local or network filesystem connection (requires an Agent).
             mcp: MCP (Model Context Protocol) server connection.
             dynamodb: Amazon DynamoDB NoSQL database connection.
-            jdbc: JDBC database connection for systems not covered by RDBMS.
+            jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
             van: Value-Added Network connection for EDI document exchange.
             rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
         externalId:

package/dist/enduser.yml

@@ -2137,16 +2137,16 @@ components:
                 netsuite: NetSuite ERP connection using token-based authentication (TBA).
                 salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
                 ftp: FTP, SFTP, or FTPS file transfer connection.
-                s3: Amazon S3 cloud storage connection.
+                s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
                 wrapper: Wrapper connection that delegates to another connection type.
                 http: Generic HTTP/REST API connection with full configuration control.
-                rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+                rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
                 mongodb: MongoDB NoSQL database connection.
                 as2: AS2 (Applicability Statement 2) EDI connection.
                 filesystem: Local or network filesystem connection (requires an Agent).
                 mcp: MCP (Model Context Protocol) server connection.
                 dynamodb: Amazon DynamoDB NoSQL database connection.
-                jdbc: JDBC database connection for systems not covered by RDBMS.
+                jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
                 van: Value-Added Network connection for EDI document exchange.
                 rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
             externalId:
@@ -3023,26 +3023,39 @@ components:
             (s3:GetObject, s3:PutObject, s3:ListBucket, etc.). Used when authType is `accesskey`.
           examples:
             - AKIAIOSFODNN7EXAMPLE
-          x-celigo-ui-override: The connection form marks accessKeyId required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks accessKeyId required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         secretAccessKey:
           type: string
           writeOnly: true
           description: AWS secret access key, paired with accessKeyId. Used when authType is `accesskey`. Encrypted at rest; returned masked as `"******"`.
           examples:
             - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-          x-celigo-ui-override: The connection form marks secretAccessKey required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks secretAccessKey required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         _iClientId:
           type: string
           format: objectId
           x-celigo-refModel: iclients
           description: |-
             Reference to an iClient that holds AWS IAM role credentials. Required when authType is
-            `awsIam`; ignored otherwise.
+            `awsIam`; ignored otherwise. The iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-file-adaptor-` — the S3 service assumes only roles in that family,
+            so a role created for an HTTP or Redshift connection cannot be reused here.
           examples:
             - 65f99e3e6b5b420fea998454
           x-celigo-ai-guidance:
             - When authType is "awsIam", set _iClientId to an existing iClient; omitting it fails the POST with 422 "Expected field: _iClientId to be present."
             - The referenced iClient must itself be an awsIam-provider iClient; referencing any other iClient fails the POST with 422 "IClient provider must be awsIam for S3 IAM Role authentication."
+            - |-
+              The referenced iClient must have awsIam.roleArn set (otherwise 422 missing_required_field on
+              s3._iClientId "Expected field: awsIam.roleArn to be present.") and its role name must start
+              with "celigo-file-adaptor-" (otherwise 422 invalid_field_value on s3._iClientId "Invalid
+              value for field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor.").
+              Point an S3 connection at an iClient whose role was named for S3; do not reuse a
+              celigo-http-adaptor- or celigo-data-warehouse-adaptor- role.
+            - |-
+              With authType "awsIam", omit accessKeyId and secretAccessKey — the API does not reject
+              them, it stores them alongside the iClient reference, leaving a stray static credential
+              on a connection that no longer uses one.
         pingBucket:
           type: string
           description: |-
@@ -5118,9 +5131,26 @@ components:
             rdbms object. Required when type is `mssql` and `mssql.authType` is
             `azure-service-principal` (Azure service-principal credentials), and
             when type is `redshift` and `redshift.authType` is `awsIam` (an
-            `awsIam`-provider iClient holding the role ARN to assume).
+            `awsIam`-provider iClient holding the role ARN to assume). For
+            Redshift the iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-data-warehouse-adaptor-` — the data-warehouse
+            service assumes only roles in that family, so a role created for an S3
+            or HTTP connection cannot be reused here.
           examples:
             - 66a1b2c3d4e5f60718293a4b
+          x-celigo-ai-guidance:
+            - |-
+              For a Redshift connection with redshift.authType "awsIam", the referenced iClient must
+              have awsIam.roleArn set (otherwise 422 missing_required_field on rdbms._iClientId
+              "Expected field: awsIam.roleArn to be present.") and its role name must start with
+              "celigo-data-warehouse-adaptor-" (otherwise 422 invalid_field_value on rdbms._iClientId
+              "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+              celigo-data-warehouse-adaptor."). Do not reuse a celigo-file-adaptor- or
+              celigo-http-adaptor- role.
+            - |-
+              With redshift.authType "awsIam", omit the top-level user and password — the API does not
+              reject them, it stores them on a connection whose form has no field that could ever
+              clear them; the database user is derived from the assumed role at runtime.
       if:
         properties:
           type:

package/dist/iclient.yml

@@ -4005,7 +4005,9 @@ components:
             (omitting the object fails with 422 `missing_required_field` "The awsIam sub-schema is
             required"). Celigo assumes `roleArn` using `externalId` as the trust-policy external ID.
             The iClient itself saves with `externalId` alone; the connection that references it
-            adds its own rules on `roleArn` (see that field).
+            adds its own rules on `roleArn` (see that field). One iClient serves one connection
+            family — Amazon S3, Amazon Redshift, or the AWS HTTP connectors — because each family
+            accepts only roles named with its own prefix.
           required:
             - externalId
           properties:
@@ -4026,19 +4028,31 @@ components:
               pattern: ^arn:[a-z-]+:iam::\d{12}:role/[A-Za-z0-9+=,.@_/-]{1,576}$
               description: |-
                 ARN of the AWS IAM role to assume for cross-account access. Optional on the iClient
-                (a malformed ARN fails with 422 `invalid_field_value`), but an HTTP connection with
-                `auth.type` `awsiam` cannot be saved against this iClient until it is set and its
-                role name starts with `celigo-http-adaptor-`.
+                (a malformed ARN fails with 422 `invalid_field_value`), but no connection in IAM-role
+                mode can be saved against this iClient until it is set, and each connection family
+                accepts only its own role-name prefix: `celigo-file-adaptor-` for Amazon S3,
+                `celigo-data-warehouse-adaptor-` for Amazon Redshift, `celigo-http-adaptor-` for the
+                AWS HTTP connectors (`auth.type` `awsiam`).
               x-celigo-ai-guidance:
                 - |-
-                  For an HTTP connection using auth.type "awsiam", name the role
-                  "celigo-http-adaptor-<anything>" — the connection save fails with 422
-                  invalid_field_value "HTTP IAM Role authentication requires awsIam.roleArn to
-                  reference a role name starting with celigo-http-adaptor-." otherwise, and with 422
-                  missing_required_field "Expected field: awsIam.roleArn to be present." while roleArn
-                  is unset. The prefix rule is specific to HTTP awsiam connections.
+                  Name the role for the connection family that will use this iClient:
+                  "celigo-file-adaptor-<anything>" for an S3 connection (s3.authType "awsIam"),
+                  "celigo-data-warehouse-adaptor-<anything>" for a Redshift connection
+                  (redshift.authType "awsIam"), "celigo-http-adaptor-<anything>" for an HTTP
+                  connection (auth.type "awsiam"). One iClient cannot serve two families.
+                - |-
+                  While roleArn is unset, every IAM-mode connection save fails with 422
+                  missing_required_field "Expected field: awsIam.roleArn to be present." on the
+                  connection's _iClientId field. With the wrong prefix the save fails with 422
+                  invalid_field_value: on HTTP "HTTP IAM Role authentication requires awsIam.roleArn to
+                  reference a role name starting with celigo-http-adaptor-."; on S3 "Invalid value for
+                  field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor."; on
+                  Redshift "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+                  celigo-data-warehouse-adaptor.".
               examples:
                 - arn:aws:iam::123456789012:role/celigo-http-adaptor-orders
+                - arn:aws:iam::123456789012:role/celigo-file-adaptor-data-lake
+                - arn:aws:iam::123456789012:role/celigo-data-warehouse-adaptor-analytics
         jwt:
           type: object
           description: |-

package/dist/mcp-server.yml

@@ -3947,16 +3947,16 @@ components:
                 netsuite: NetSuite ERP connection using token-based authentication (TBA).
                 salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
                 ftp: FTP, SFTP, or FTPS file transfer connection.
-                s3: Amazon S3 cloud storage connection.
+                s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
                 wrapper: Wrapper connection that delegates to another connection type.
                 http: Generic HTTP/REST API connection with full configuration control.
-                rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+                rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
                 mongodb: MongoDB NoSQL database connection.
                 as2: AS2 (Applicability Statement 2) EDI connection.
                 filesystem: Local or network filesystem connection (requires an Agent).
                 mcp: MCP (Model Context Protocol) server connection.
                 dynamodb: Amazon DynamoDB NoSQL database connection.
-                jdbc: JDBC database connection for systems not covered by RDBMS.
+                jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
                 van: Value-Added Network connection for EDI document exchange.
                 rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
             externalId:
@@ -4833,26 +4833,39 @@ components:
             (s3:GetObject, s3:PutObject, s3:ListBucket, etc.). Used when authType is `accesskey`.
           examples:
             - AKIAIOSFODNN7EXAMPLE
-          x-celigo-ui-override: The connection form marks accessKeyId required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks accessKeyId required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         secretAccessKey:
           type: string
           writeOnly: true
           description: AWS secret access key, paired with accessKeyId. Used when authType is `accesskey`. Encrypted at rest; returned masked as `"******"`.
           examples:
             - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-          x-celigo-ui-override: The connection form marks secretAccessKey required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks secretAccessKey required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         _iClientId:
           type: string
           format: objectId
           x-celigo-refModel: iclients
           description: |-
             Reference to an iClient that holds AWS IAM role credentials. Required when authType is
-            `awsIam`; ignored otherwise.
+            `awsIam`; ignored otherwise. The iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-file-adaptor-` — the S3 service assumes only roles in that family,
+            so a role created for an HTTP or Redshift connection cannot be reused here.
           examples:
             - 65f99e3e6b5b420fea998454
           x-celigo-ai-guidance:
             - When authType is "awsIam", set _iClientId to an existing iClient; omitting it fails the POST with 422 "Expected field: _iClientId to be present."
             - The referenced iClient must itself be an awsIam-provider iClient; referencing any other iClient fails the POST with 422 "IClient provider must be awsIam for S3 IAM Role authentication."
+            - |-
+              The referenced iClient must have awsIam.roleArn set (otherwise 422 missing_required_field on
+              s3._iClientId "Expected field: awsIam.roleArn to be present.") and its role name must start
+              with "celigo-file-adaptor-" (otherwise 422 invalid_field_value on s3._iClientId "Invalid
+              value for field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor.").
+              Point an S3 connection at an iClient whose role was named for S3; do not reuse a
+              celigo-http-adaptor- or celigo-data-warehouse-adaptor- role.
+            - |-
+              With authType "awsIam", omit accessKeyId and secretAccessKey — the API does not reject
+              them, it stores them alongside the iClient reference, leaving a stray static credential
+              on a connection that no longer uses one.
         pingBucket:
           type: string
           description: |-
@@ -6928,9 +6941,26 @@ components:
             rdbms object. Required when type is `mssql` and `mssql.authType` is
             `azure-service-principal` (Azure service-principal credentials), and
             when type is `redshift` and `redshift.authType` is `awsIam` (an
-            `awsIam`-provider iClient holding the role ARN to assume).
+            `awsIam`-provider iClient holding the role ARN to assume). For
+            Redshift the iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-data-warehouse-adaptor-` — the data-warehouse
+            service assumes only roles in that family, so a role created for an S3
+            or HTTP connection cannot be reused here.
           examples:
             - 66a1b2c3d4e5f60718293a4b
+          x-celigo-ai-guidance:
+            - |-
+              For a Redshift connection with redshift.authType "awsIam", the referenced iClient must
+              have awsIam.roleArn set (otherwise 422 missing_required_field on rdbms._iClientId
+              "Expected field: awsIam.roleArn to be present.") and its role name must start with
+              "celigo-data-warehouse-adaptor-" (otherwise 422 invalid_field_value on rdbms._iClientId
+              "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+              celigo-data-warehouse-adaptor."). Do not reuse a celigo-file-adaptor- or
+              celigo-http-adaptor- role.
+            - |-
+              With redshift.authType "awsIam", omit the top-level user and password — the API does not
+              reject them, it stores them on a connection whose form has no field that could ever
+              clear them; the database user is derived from the assumed role at runtime.
       if:
         properties:
           type:

package/dist/tool.yml

@@ -6562,16 +6562,16 @@ components:
                 netsuite: NetSuite ERP connection using token-based authentication (TBA).
                 salesforce: Salesforce CRM connection with OAuth 2.0 authentication.
                 ftp: FTP, SFTP, or FTPS file transfer connection.
-                s3: Amazon S3 cloud storage connection.
+                s3: Amazon S3 cloud storage connection, authenticated with an access key pair or an AWS IAM role (`s3.authType`).
                 wrapper: Wrapper connection that delegates to another connection type.
                 http: Generic HTTP/REST API connection with full configuration control.
-                rdbms: Relational database connection (MySQL, PostgreSQL, Snowflake, etc.).
+                rdbms: Native relational-database connection — MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, Azure Synapse, Oracle, Snowflake, Google BigQuery, Amazon Redshift (the database is `rdbms.type`).
                 mongodb: MongoDB NoSQL database connection.
                 as2: AS2 (Applicability Statement 2) EDI connection.
                 filesystem: Local or network filesystem connection (requires an Agent).
                 mcp: MCP (Model Context Protocol) server connection.
                 dynamodb: Amazon DynamoDB NoSQL database connection.
-                jdbc: JDBC database connection for systems not covered by RDBMS.
+                jdbc: JDBC connection for relational systems without a native `rdbms` type (Databricks, Db2, Workday, NetSuite JDBC) and for the driver-specific paths `jdbc.type` names (Oracle Thin, SQL Server with Active Directory); Redshift, BigQuery and Snowflake are `rdbms` types.
                 van: Value-Added Network connection for EDI document exchange.
                 rest: REST connection driven by a pre-built HTTP Connector template. Deprecated — use `http` instead.
             externalId:
@@ -7448,26 +7448,39 @@ components:
             (s3:GetObject, s3:PutObject, s3:ListBucket, etc.). Used when authType is `accesskey`.
           examples:
             - AKIAIOSFODNN7EXAMPLE
-          x-celigo-ui-override: The connection form marks accessKeyId required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks accessKeyId required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         secretAccessKey:
           type: string
           writeOnly: true
           description: AWS secret access key, paired with accessKeyId. Used when authType is `accesskey`. Encrypted at rest; returned masked as `"******"`.
           examples:
             - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-          x-celigo-ui-override: The connection form marks secretAccessKey required (the form only exposes static-key auth). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
+          x-celigo-ui-override: The connection form marks secretAccessKey required when Auth type is "Access key & secret" (`accesskey`) and removes it when Auth type is "IAM role" (`awsIam`). The API enforces it for authType `accesskey` (POST without it returns 422 missing_required_field) — encoded via the if/then/else rule below.
         _iClientId:
           type: string
           format: objectId
           x-celigo-refModel: iclients
           description: |-
             Reference to an iClient that holds AWS IAM role credentials. Required when authType is
-            `awsIam`; ignored otherwise.
+            `awsIam`; ignored otherwise. The iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-file-adaptor-` — the S3 service assumes only roles in that family,
+            so a role created for an HTTP or Redshift connection cannot be reused here.
           examples:
             - 65f99e3e6b5b420fea998454
           x-celigo-ai-guidance:
             - When authType is "awsIam", set _iClientId to an existing iClient; omitting it fails the POST with 422 "Expected field: _iClientId to be present."
             - The referenced iClient must itself be an awsIam-provider iClient; referencing any other iClient fails the POST with 422 "IClient provider must be awsIam for S3 IAM Role authentication."
+            - |-
+              The referenced iClient must have awsIam.roleArn set (otherwise 422 missing_required_field on
+              s3._iClientId "Expected field: awsIam.roleArn to be present.") and its role name must start
+              with "celigo-file-adaptor-" (otherwise 422 invalid_field_value on s3._iClientId "Invalid
+              value for field \"_iClientId\": Your role ARN's name must begin with celigo-file-adaptor.").
+              Point an S3 connection at an iClient whose role was named for S3; do not reuse a
+              celigo-http-adaptor- or celigo-data-warehouse-adaptor- role.
+            - |-
+              With authType "awsIam", omit accessKeyId and secretAccessKey — the API does not reject
+              them, it stores them alongside the iClient reference, leaving a stray static credential
+              on a connection that no longer uses one.
         pingBucket:
           type: string
           description: |-
@@ -9543,9 +9556,26 @@ components:
             rdbms object. Required when type is `mssql` and `mssql.authType` is
             `azure-service-principal` (Azure service-principal credentials), and
             when type is `redshift` and `redshift.authType` is `awsIam` (an
-            `awsIam`-provider iClient holding the role ARN to assume).
+            `awsIam`-provider iClient holding the role ARN to assume). For
+            Redshift the iClient must carry `awsIam.roleArn`, and that role's name
+            must start with `celigo-data-warehouse-adaptor-` — the data-warehouse
+            service assumes only roles in that family, so a role created for an S3
+            or HTTP connection cannot be reused here.
           examples:
             - 66a1b2c3d4e5f60718293a4b
+          x-celigo-ai-guidance:
+            - |-
+              For a Redshift connection with redshift.authType "awsIam", the referenced iClient must
+              have awsIam.roleArn set (otherwise 422 missing_required_field on rdbms._iClientId
+              "Expected field: awsIam.roleArn to be present.") and its role name must start with
+              "celigo-data-warehouse-adaptor-" (otherwise 422 invalid_field_value on rdbms._iClientId
+              "Invalid value for field \"_iClientId\": Your role ARN's name must begin with
+              celigo-data-warehouse-adaptor."). Do not reuse a celigo-file-adaptor- or
+              celigo-http-adaptor- role.
+            - |-
+              With redshift.authType "awsIam", omit the top-level user and password — the API does not
+              reject them, it stores them on a connection whose form has no field that could ever
+              clear them; the database user is derived from the assumed role at runtime.
       if:
         properties:
           type:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.72",
+  "version": "0.2.74",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "77f1be1",
-		"generatedAt": "2026-10-03"
+		"iasCommit": "d7dc6ff",
+		"generatedAt": "2026-10-05"
 	},
 	"roots": {
 		"aiagent": 133,