@celigo/api-specs 0.2.74 → 0.2.76

package/dist/api.yml

@@ -8617,7 +8617,10 @@ components:
                     SHA1: Sign returned MDNs using the SHA-1 hash algorithm.
                     MD5: Sign returned MDNs using the MD5 hash algorithm.
                     SHA256: Sign returned MDNs using the SHA-256 hash algorithm.
-                  description: Hash algorithm used to sign MDNs this station returns to the partner.
+                  description: |-
+                    Hash algorithm used to sign MDNs this station returns to the partner. Signs the MDN
+                    only — the hash algorithm of its `Received-Content-MIC` follows
+                    userStationInfo.signing, not this field.
                   examples:
                     - SHA256
                   x-celigo-ui-override: Required by the connection form (as2.userStationInfo.mdn.mdnSigning).
@@ -8640,11 +8643,17 @@ components:
                 - MD5
                 - SHA256
               x-enumDescriptions:
-                NONE: Accept inbound messages without verifying their signature.
+                NONE: Accept inbound messages without verifying their signature; returned MDNs then carry a SHA-1 MIC.
                 SHA1: Verify inbound message signatures using the SHA-1 hash algorithm.
                 MD5: Verify inbound message signatures using the MD5 hash algorithm.
                 SHA256: Verify inbound message signatures using the SHA-256 hash algorithm.
-              description: Hash algorithm for verifying signatures on inbound messages. Any value other than NONE requires unencrypted.partnerCertificate.
+              description: |-
+                Hash algorithm for verifying signatures on inbound messages; the same algorithm is used
+                for the `Received-Content-MIC` in the MDN returned for each message (NONE falls back to
+                SHA-1, and the algorithm the partner requests in `Disposition-Notification-Options` is
+                not used). The MIC is computed when a message is received, so a change here applies only
+                to messages received afterwards — the partner must resend to get an MDN with the new
+                algorithm. Any value other than NONE requires unencrypted.partnerCertificate.
               examples:
                 - SHA256
               x-celigo-ui-override: Required by the connection form (as2.userStationInfo.signing — labeled Signature verification algorithm).
@@ -8750,7 +8759,12 @@ components:
             - 5
         preventCanonicalization:
           type: boolean
-          description: When true, message content is not canonicalized before signing or encryption. Enable only when a partner reports signature-verification failures caused by canonicalization.
+          description: |-
+            When true, inbound messages are verified — and the `Received-Content-MIC` in the returned
+            MDN is computed — over the content exactly as received, without first normalizing line
+            endings to CRLF; the partner's MDN signatures are verified the same way. Enable only when a
+            partner reports signature-verification failures or MIC mismatches caused by
+            canonicalization.
           default: false
     Filesystem:
       type: object

package/dist/connection.yml

@@ -1536,6 +1536,345 @@ paths:
         - |-
           Read the status as the target's, not the proxy's: a 422 or 404 with a non-invalid_ref
           body is the downstream system's validation result for the forwarded request.
+  /v1/connections/{_id}/import:
+    post:
+      x-internal: false
+      operationId: invokeVirtualImport
+      tags:
+        - Connections
+      summary: Run an import document through a connection
+      description: |-
+        Runs an import document sent in the request body — a virtual import —
+        through this connection against the supplied records and returns one
+        result per record, synchronously. Nothing is saved: the document can be
+        an unsaved draft, a modified copy, or a saved import as fetched (`_id`
+        and metadata accepted). Each record runs the document's own pipeline —
+        input filter, preMap hook, mappings, postMap hook, request, postSubmit
+        hook — and the request executes against the live destination: a real
+        write, not a dry run; a saved `mockResponse` does not substitute. A
+        record the input filter excludes comes back `ignored`, never sent.
+        Adaptors `POST /v1/imports/preview` rejects with `invalid_adaptor` run
+        here — NetSuite and RDBMS verified alongside HTTP.
+
+        The step runs with the document's own `settings` only: hooks receive
+        `options.settings` with an `import` key but no `integration` or `flow`
+        key and no `_flowId` / `_integrationId`; `{{settings.integration.*}}`
+        and `{{settings.flow.*}}` templates render empty. A document that reads
+        integration- or flow-level settings behaves differently here than in a
+        flow run, and nothing in the request supplies that context. The
+        connection in the path is the one used; a `_connectionId` on the
+        document is ignored.
+
+        `POST /v1/imports/{_id}/invoke` runs a saved import the same way with
+        the same per-record shape; the read-side sibling is the virtual export,
+        `POST /v1/connections/{_id}/export`.
+      parameters:
+        - in: path
+          name: _id
+          required: true
+          schema:
+            type: string
+            format: objectId
+            x-celigo-refModel: connections
+            examples:
+              - 6a04b5309dc296c4efb1a6e0
+          description: Connection the import document runs through.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              description: The import document to run and the records to run through it.
+              x-celigo-ai-guidance:
+                - |-
+                  This executes the request against the live destination — a real write, even when the
+                  document carries a saved `mockResponse`. Treat it like a flow run, never like a preview.
+                - |-
+                  The step gets the document's own settings only: hooks see `options.settings = {import}`
+                  with no `integration` / `flow` key and no `_flowId` / `_integrationId`, and
+                  `{{settings.integration.*}}` / `{{settings.flow.*}}` render empty. A step whose hooks or
+                  templates read those settings builds a different record here than in a flow run — do
+                  not send it this way.
+                - |-
+                  NetSuite and RDBMS documents run here, where `POST /v1/imports/preview` answers
+                  `invalid_adaptor`. A record the input filter excludes comes back
+                  `{ignored: true, stage: "inputFilter"}` and was never sent; omitting `data` is a
+                  `400 invalid_request`.
+              required:
+                - import
+                - data
+              properties:
+                import:
+                  type: object
+                  description: |-
+                    The import document to run (mirror of the `POST /v1/imports`
+                    body shape); `name` and `_connectionId` are not needed, and a
+                    saved import's `_id` and metadata may ride along unchanged.
+                    Adaptor-specific blocks (`http`, `netsuite_da`, `rdbms`, …),
+                    `mapping`, `filter` and `hooks` apply exactly as on a saved
+                    import.
+                  additionalProperties: true
+                data:
+                  type: array
+                  description: |-
+                    Records to run through the document, each becoming one result.
+                    An empty array returns an empty array; omitting `data` is
+                    rejected.
+                  items:
+                    type: object
+                    additionalProperties: true
+              additionalProperties: true
+            examples:
+              unsaved_http_import:
+                summary: Run an unsaved HTTP import against one record
+                value:
+                  import:
+                    adaptorType: HTTPImport
+                    mapping:
+                      fields:
+                        - extract: email
+                          generate: Email
+                      lists: []
+                    http:
+                      relativeURI:
+                        - /post
+                      method:
+                        - POST
+                      requestType:
+                        - CREATE
+                      requestMediaType: json
+                      successMediaType: json
+                      sendPostMappedData: true
+                      formType: http
+                  data:
+                    - email: contact@acme.com
+      responses:
+        '200':
+          description: |-
+            One result per input record, in input order — accepted, failed at
+            the destination, or ignored by the document's own input filter.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/ImportRecordResult'
+              examples:
+                accepted:
+                  summary: Record accepted — the destination's response body in _json
+                  value:
+                    - statusCode: 200
+                      _json:
+                        Email: contact@acme.com
+                      _headers:
+                        content-type: application/json; charset=utf-8
+                destination_rejected:
+                  summary: Destination rejected the record
+                  value:
+                    - statusCode: 422
+                      _json: {}
+                      errors:
+                        - message: 'Failed to create, update/transform record because com.netledger.common.exceptions.NLUserError: The record type [CUSTOMRECORD_ZZ] is invalid.'
+                          code: javaexception
+                          source: application
+                          resolved: false
+                          occurredAt: 1791309460117
+                          stage: apiCall
+                          classification: missing
+                ignored_by_input_filter:
+                  summary: Record excluded by the input filter — nothing sent
+                  value:
+                    - statusCode: 200
+                      _json: {}
+                      ignored: true
+                      stage: inputFilter
+        '400':
+          description: |-
+            Request body is malformed — the top-level `import` object or the
+            `data` array is missing. Returned as a bare array of error objects,
+            not the standard `errors` envelope.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    code:
+                      type: string
+                    message:
+                      type: string
+              examples:
+                missing_import:
+                  value:
+                    - code: invalid_request
+                      message: Request body should contain an import object details.
+                missing_data:
+                  value:
+                    - code: invalid_request
+                      message: Request body should contain data which is to be imported.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          description: '`invalid_ref` — `_id` is not a connection in the account.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                connection_not_found:
+                  value:
+                    errors:
+                      - field: connection
+                        code: invalid_ref
+                        message: connection not found.
+                      - field: _connectionId
+                        code: invalid_ref
+                        message: a9e11dc0de1ec0de00000009 is not a valid _connectionId
+  /v1/connections/{_id}/export:
+    post:
+      x-internal: false
+      operationId: invokeVirtualExport
+      tags:
+        - Connections
+      summary: Run an export document through a connection
+      description: |-
+        Runs an export document sent in the request body — a virtual export —
+        through this connection against the live source and returns the fetched
+        records, synchronously. Nothing is saved and no job is created: the
+        document can be an unsaved draft, a modified copy of a saved export, or
+        a saved export as fetched. Use it to read from a system through an
+        existing connection before an export exists, or to check what a changed
+        export definition would return.
+
+        The connection in the path is the one used; a `_connectionId` on the
+        document is not needed. The read executes against the live source
+        (HTTP and NetSuite RESTlet searches verified) and `dataURIs` carries,
+        per record, a link to the record in the source system when the adaptor
+        provides one (`null` otherwise).
+
+        The export-side preview surfaces, `POST /v1/exports/preview` and the
+        flow-scoped `POST /v1/integrations/{_integrationId}/flows/{_flowId}/exports/preview`,
+        return the same records inside a stage-by-stage envelope; prefer them
+        when the export's transform or filter output matters. The write-side
+        sibling is the virtual import, `POST /v1/connections/{_id}/import`.
+      parameters:
+        - in: path
+          name: _id
+          required: true
+          schema:
+            type: string
+            format: objectId
+            x-celigo-refModel: connections
+            examples:
+              - 6a04b5309dc296c4efb1a6e0
+          description: Connection the export document runs through.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              description: The export document to run.
+              required:
+                - export
+              properties:
+                export:
+                  type: object
+                  description: |-
+                    The export document to run (mirror of the `POST /v1/exports`
+                    body shape); `name` and `_connectionId` are not needed.
+                    Adaptor-specific blocks (`http`, `netsuite`, `rdbms`, …) apply
+                    exactly as on a saved export.
+                  additionalProperties: true
+              additionalProperties: true
+            examples:
+              netsuite_search:
+                summary: Run an ad-hoc NetSuite search by externalid
+                value:
+                  export:
+                    adaptorType: NetSuiteExport
+                    netsuite:
+                      type: restlet
+                      skipGrouping: true
+                      restlet:
+                        recordType: customrecord_payout_variance
+                        restletVersion: suitebundle
+                        columns:
+                          - name: internalid
+                            label: internalid
+                          - name: externalid
+                            label: externalid
+                        criteria:
+                          - field: externalid
+                            operator: is
+                            searchValue: SEED-01
+      responses:
+        '200':
+          description: The records the source returned, with a per-record link when the adaptor provides one.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    type: array
+                    description: Records fetched from the source, in the order the source returned them.
+                    items:
+                      type: object
+                      additionalProperties: true
+                  dataURIs:
+                    type: array
+                    description: |-
+                      One entry per record in `data`: a link to the record in the
+                      source system when the adaptor provides one, otherwise `null`.
+                    items:
+                      type:
+                        - string
+                        - 'null'
+                additionalProperties: true
+              examples:
+                netsuite_rows:
+                  summary: NetSuite search result with record links
+                  value:
+                    data:
+                      - id: '1'
+                        recordType: customrecord_payout_variance
+                        internalid: '1'
+                        externalid: SEED-01
+                    dataURIs:
+                      - https://1234567.app.netsuite.com/app/common/custom/custrecordentry.nl?rectype=923&id=1
+        '400':
+          description: The top-level `export` object is missing.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                missing_export:
+                  value:
+                    errors:
+                      - code: invalid_request
+                        message: Request body should contain an export object details.
+        '401':
+          $ref: '#/components/responses/401-unauthorized'
+        '422':
+          description: '`invalid_ref` — `_id` is not a connection in the account.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                connection_not_found:
+                  value:
+                    errors:
+                      - field: _connectionId
+                        code: invalid_ref
+                        message: a9e11dc0de1ec0de00000009 is not a valid _connectionId
+                      - field: connection
+                        code: invalid_ref
+                        message: connection not found.
   /v1/connections/{_id}/debug:
     get:
       x-internal: false
@@ -6871,7 +7210,10 @@ components:
                     SHA1: Sign returned MDNs using the SHA-1 hash algorithm.
                     MD5: Sign returned MDNs using the MD5 hash algorithm.
                     SHA256: Sign returned MDNs using the SHA-256 hash algorithm.
-                  description: Hash algorithm used to sign MDNs this station returns to the partner.
+                  description: |-
+                    Hash algorithm used to sign MDNs this station returns to the partner. Signs the MDN
+                    only — the hash algorithm of its `Received-Content-MIC` follows
+                    userStationInfo.signing, not this field.
                   examples:
                     - SHA256
                   x-celigo-ui-override: Required by the connection form (as2.userStationInfo.mdn.mdnSigning).
@@ -6894,11 +7236,17 @@ components:
                 - MD5
                 - SHA256
               x-enumDescriptions:
-                NONE: Accept inbound messages without verifying their signature.
+                NONE: Accept inbound messages without verifying their signature; returned MDNs then carry a SHA-1 MIC.
                 SHA1: Verify inbound message signatures using the SHA-1 hash algorithm.
                 MD5: Verify inbound message signatures using the MD5 hash algorithm.
                 SHA256: Verify inbound message signatures using the SHA-256 hash algorithm.
-              description: Hash algorithm for verifying signatures on inbound messages. Any value other than NONE requires unencrypted.partnerCertificate.
+              description: |-
+                Hash algorithm for verifying signatures on inbound messages; the same algorithm is used
+                for the `Received-Content-MIC` in the MDN returned for each message (NONE falls back to
+                SHA-1, and the algorithm the partner requests in `Disposition-Notification-Options` is
+                not used). The MIC is computed when a message is received, so a change here applies only
+                to messages received afterwards — the partner must resend to get an MDN with the new
+                algorithm. Any value other than NONE requires unencrypted.partnerCertificate.
               examples:
                 - SHA256
               x-celigo-ui-override: Required by the connection form (as2.userStationInfo.signing — labeled Signature verification algorithm).
@@ -7004,7 +7352,12 @@ components:
             - 5
         preventCanonicalization:
           type: boolean
-          description: When true, message content is not canonicalized before signing or encryption. Enable only when a partner reports signature-verification failures caused by canonicalization.
+          description: |-
+            When true, inbound messages are verified — and the `Received-Content-MIC` in the returned
+            MDN is computed — over the content exactly as received, without first normalizing line
+            endings to CRLF; the partner's MDN signatures are verified the same way. Enable only when a
+            partner reports signature-verification failures or MIC mismatches caused by
+            canonicalization.
           default: false
     Filesystem:
       type: object
@@ -8792,6 +9145,82 @@ components:
       minItems: 1
       items:
         $ref: '#/components/schemas/JsonPatchOperation'
+    ImportRecordResult:
+      type: object
+      description: |-
+        The outcome of running one input record through an import — one element
+        per record, in input order — shared by `POST /v1/imports/{_id}/invoke`
+        and the virtual import `POST /v1/connections/{_id}/import`. A record the
+        import itself ignored before any request carries `ignored: true` and the
+        `stage` that dropped it; a record the destination accepted carries its
+        parsed response; a record the destination rejected — or that the
+        import's `failPath` / `failValues` rules judged a failure even on a
+        `2xx` — carries `errors[]`.
+      properties:
+        statusCode:
+          type: integer
+          description: |-
+            HTTP status of the record's outcome. The destination's status for an
+            accepted record; `422` when the import recorded a failure for the
+            record — including when the destination itself answered `200` and
+            the import's `failPath` rules declared it a failure.
+        _json:
+          type: object
+          description: |-
+            The destination's parsed response body for the record — the slice
+            under the import's `response.resourcePath` when one is defined — not
+            the record that was sent. `{}` when the record was ignored or the
+            destination returned no usable body.
+          additionalProperties: true
+        _headers:
+          type: object
+          description: Response headers the destination returned for the record.
+          additionalProperties: true
+        ignored:
+          type: boolean
+          description: |-
+            When true, the import dropped the record before sending anything and
+            `stage` names the gate; the destination was not called for it.
+        stage:
+          type: string
+          description: |-
+            The import stage that ignored the record — `inputFilter` when the
+            import's own input filter excluded it. Present only with `ignored`.
+          examples:
+            - inputFilter
+        errors:
+          type: array
+          description: |-
+            Errors recorded for the record. `source: application` with
+            `stage: apiCall` means the request reached the destination and its
+            answer was the failure; the destination's response body rides in
+            `message`.
+          items:
+            type: object
+            properties:
+              source:
+                type: string
+              code:
+                oneOf:
+                  - type: string
+                  - type: integer
+                description: |-
+                  The adaptor's error code, or the destination's HTTP status as
+                  an integer when the import's `failPath` rules turned a
+                  successful-looking response into a failure.
+              message:
+                type: string
+              resolved:
+                type: boolean
+              occurredAt:
+                type: integer
+                format: int64
+              stage:
+                type: string
+              classification:
+                type: string
+            additionalProperties: true
+      additionalProperties: true
     ConnectionMetadataRequest:
       type: object
       description: |-

package/dist/enduser.yml

@@ -5863,7 +5863,10 @@ components:
                     SHA1: Sign returned MDNs using the SHA-1 hash algorithm.
                     MD5: Sign returned MDNs using the MD5 hash algorithm.
                     SHA256: Sign returned MDNs using the SHA-256 hash algorithm.
-                  description: Hash algorithm used to sign MDNs this station returns to the partner.
+                  description: |-
+                    Hash algorithm used to sign MDNs this station returns to the partner. Signs the MDN
+                    only — the hash algorithm of its `Received-Content-MIC` follows
+                    userStationInfo.signing, not this field.
                   examples:
                     - SHA256
                   x-celigo-ui-override: Required by the connection form (as2.userStationInfo.mdn.mdnSigning).
@@ -5886,11 +5889,17 @@ components:
                 - MD5
                 - SHA256
               x-enumDescriptions:
-                NONE: Accept inbound messages without verifying their signature.
+                NONE: Accept inbound messages without verifying their signature; returned MDNs then carry a SHA-1 MIC.
                 SHA1: Verify inbound message signatures using the SHA-1 hash algorithm.
                 MD5: Verify inbound message signatures using the MD5 hash algorithm.
                 SHA256: Verify inbound message signatures using the SHA-256 hash algorithm.
-              description: Hash algorithm for verifying signatures on inbound messages. Any value other than NONE requires unencrypted.partnerCertificate.
+              description: |-
+                Hash algorithm for verifying signatures on inbound messages; the same algorithm is used
+                for the `Received-Content-MIC` in the MDN returned for each message (NONE falls back to
+                SHA-1, and the algorithm the partner requests in `Disposition-Notification-Options` is
+                not used). The MIC is computed when a message is received, so a change here applies only
+                to messages received afterwards — the partner must resend to get an MDN with the new
+                algorithm. Any value other than NONE requires unencrypted.partnerCertificate.
               examples:
                 - SHA256
               x-celigo-ui-override: Required by the connection form (as2.userStationInfo.signing — labeled Signature verification algorithm).
@@ -5996,7 +6005,12 @@ components:
             - 5
         preventCanonicalization:
           type: boolean
-          description: When true, message content is not canonicalized before signing or encryption. Enable only when a partner reports signature-verification failures caused by canonicalization.
+          description: |-
+            When true, inbound messages are verified — and the `Received-Content-MIC` in the returned
+            MDN is computed — over the content exactly as received, without first normalizing line
+            endings to CRLF; the partner's MDN signatures are verified the same way. Enable only when a
+            partner reports signature-verification failures or MIC mismatches caused by
+            canonicalization.
           default: false
     Filesystem:
       type: object

package/dist/flow.yml

@@ -3762,23 +3762,33 @@ paths:
       summary: Preview the output of a flow's page processor
       description: |-
         Runs a flow's page generators and page processors through the preview
-        pipeline and returns the record arriving at a specific page-processor
-        node, with the whole upstream chain applied server-side: the source
-        export executes live (its transform, output filter, and preSavePage
-        hook are applied), router branch filters and step input filters gate
-        the records, upstream lookups execute live unless a saved `mockOutput`
-        is present (a saved mock always wins), and upstream imports are NEVER
-        executed — each substitutes its saved `mockResponse`, or a platform
-        placeholder when none is saved, before its response mapping and
-        postResponseMap hook run. A target IMPORT obeys its map entry's
-        options flag: `{preview: true}` composes the request and returns it
-        without sending, while `{sendAndPreview: true}` (the import
-        editor's "Send" button) executes it against the live destination —
-        a real write. A target LOOKUP executes its live query
-        (even when it carries a saved `mockOutput` — the mock substitutes
-        only when the lookup is upstream of the target). With
-        `includeStages: false` the response is the bare result object
-        rather than the `{data, stages}` envelope.
+        pipeline and returns the record arriving at one page-processor node,
+        with the upstream chain applied server-side. A target IMPORT obeys its
+        map entry's options flag: `{preview: true}` composes the request
+        without sending; `{sendAndPreview: true}` (the import editor's "Send"
+        button) executes it against the live destination — a real write — and
+        stops at the parsed response (the target's postSubmit hook does not
+        run). Both composing modes serve HTTP import targets only: a NetSuite,
+        Salesforce, RDBMS or FTP target answers `422 no_data_available` ("You
+        must add at least one mock input record…") whatever records the chain
+        delivers — the generic "no record reached the target", not a data
+        problem; execute such a step as a virtual import instead
+        (`POST /v1/connections/{_id}/import`). No options flag returns the
+        arriving record for any adaptor without touching the target.
+
+        Upstream behavior: the source export executes live (transform, output
+        filter and preSavePage hook applied); router branch filters and step
+        input filters gate the records; upstream lookups execute live unless a
+        saved `mockOutput` is present (a saved mock always wins); upstream
+        imports are NEVER executed — each substitutes its saved `mockResponse`,
+        or a platform placeholder when none is saved, before its response
+        mapping and postResponseMap hook run. A target LOOKUP executes its
+        live query even when it carries a saved `mockOutput` (the mock
+        substitutes only upstream). When a target import's `failPath` rules
+        judge the destination's answer a failure, the response is `422` whose
+        `errors[]` carry `source: application` and `stage: apiCall` — the
+        request did execute. With `includeStages: false` the response is the
+        bare result object rather than the `{data, stages}` envelope.
 
         Body carries the flow shape plus resolved maps of page-generator and
         page-processor docs keyed by `_id`. The server uses those maps as the
@@ -3824,8 +3834,8 @@ paths:
                     6508ab8b20b16404da729c64:
                       doc:
                         _id: 6508ab8b20b16404da729c64
-                        name: Upsert NetSuite Customers
-                        adaptorType: NetSuiteImport
+                        name: Upsert customers in the destination API
+                        adaptorType: HTTPImport
                       options:
                         preview: true
                   includeStages: true
@@ -3878,6 +3888,39 @@ paths:
                         message: 'The pageGenerator doc corresponding to the _id:  is not found in the given pageGeneratorMap.'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '422':
+          description: |-
+            Two distinct meanings, told apart by `errors[].source`:
+            `no_data_available` with `source: integrator` — no record reached
+            the target in a composing mode (the target is a NetSuite,
+            Salesforce, RDBMS or FTP import, which these modes cannot drive, or
+            the chain's gates dropped every record); `source: application` with
+            `stage: apiCall` after `sendAndPreview` — the request DID execute
+            and the target import's `failPath` rules judged the destination's
+            answer a failure; `message` carries the destination's response body
+            and `code` its HTTP status.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                noRecordReachedTarget:
+                  summary: Composing mode on a non-HTTP target, or every record gated out
+                  value:
+                    errors:
+                      - code: no_data_available
+                        source: integrator
+                        message: You must add at least one mock input record. If you still get this error after adding an input record, verify that your current mapping configuration isn't ignoring all record output. Mock input records must pass through the input filter and hooks to qualify for Preview and Send.
+                failPathTripped:
+                  summary: sendAndPreview executed; the target's failPath rules judged the 200 a failure
+                  description: |-
+                    The live error also carries `stage: apiCall`, `classification`,
+                    `resolved` and `occurredAt` beside the fields shown.
+                  value:
+                    errors:
+                      - code: 200
+                        source: application
+                        message: '{"args":{},"json":{"FirstName":"FAILME"}}'
   /v1/flows/{_id}/dependencies:
     get:
       x-internal: false
@@ -7691,6 +7734,17 @@ components:
         Flow-page-processor preview request. Carries the flow shape plus
         side-loaded maps of page-generator and page-processor docs so the
         preview engine can run without reading the persisted flow doc.
+      x-celigo-ai-guidance:
+        - |-
+          The target import's `{preview: true}` / `{sendAndPreview: true}` composing modes serve HTTP
+          import targets only: a NetSuite, Salesforce, RDBMS or FTP target answers `422
+          no_data_available` whatever records the chain delivers — not a data problem. Execute such a
+          step as a virtual import (`POST /v1/connections/{_id}/import`) instead; with no options flag
+          this call still returns the arriving record for any adaptor.
+        - |-
+          A `422` whose `errors[]` carry `source: application` and `stage: apiCall` after
+          `sendAndPreview` means the request DID execute and the target's `failPath` rules judged the
+          destination's answer a failure — a completed send, not a request-validation error.
       properties:
         flow:
           type: object
@@ -7761,10 +7815,12 @@ components:
             the mock input the editor's "Mock input" pane would provide.
             Upstream entries carry `{}`.
             Request composition is adaptor-gated: the `preview`/`sendAndPreview`
-            modes work for HTTP, REST, and GraphQL import targets — RDBMS-family
-            import targets fail with `no_data_available` regardless of supplied
-            input (database imports have no request-preview surface; only the
-            no-flag input-data preview works for them).
+            modes work for HTTP, REST, and GraphQL import targets — a NetSuite,
+            Salesforce, RDBMS or FTP import target fails with
+            `422 no_data_available` regardless of supplied input (those
+            adaptors have no request-preview surface; only the no-flag
+            input-data preview works for them, and the virtual import
+            `POST /v1/connections/{_id}/import` executes them).
           additionalProperties:
             type: object
             properties:
@@ -7778,7 +7834,8 @@ components:
             64a1234567890abcdef12345:
               doc:
                 _id: 64a1234567890abcdef12345
-                name: Import Orders to NetSuite
+                name: Create orders in the destination API
+                adaptorType: HTTPImport
                 _connectionId: 5f7c579b6411271af4e7cefb
               options:
                 preview: true

package/dist/import.yml

@@ -533,16 +533,27 @@ paths:
         data records and returns per-record results synchronously.
 
         The request body should contain a `data` array of records to import. Each
-        record is processed through the import's mappings, transformations, and
-        hooks before being sent to the destination.
-
-        The response is an **array** of per-record result objects, each containing
-        a `statusCode`, the transformed `_json` payload, and any `errors`
-        encountered during processing. This endpoint writes to the destination
-        system — and so does `POST /v1/imports/preview` (verified to execute the
-        composed request), so neither is a dry run against a production
-        destination. A 200 response may still contain per-record failures in
-        each element's `errors` array.
+        record is processed through the import's input filter, mappings, hooks
+        (preMap, postMap, postSubmit) and transformations before being sent to
+        the destination; a record the input filter excludes comes back `ignored`
+        and is never sent.
+
+        The response is an **array** of per-record result objects — `statusCode`,
+        the destination's parsed response body as `_json`, `errors` when the
+        record failed. This endpoint writes to the destination system — and so
+        does `POST /v1/imports/preview` (verified to execute the composed
+        request), so neither is a dry run against a production destination. A
+        200 response may still contain per-record failures in each element's
+        `errors` array. Every import adaptor runs here (HTTP, NetSuite, RDBMS,
+        FTP verified), including the ones `POST /v1/imports/preview` rejects with
+        `invalid_adaptor`. For a file import the 200 reflects the file being
+        composed, not delivered — an FTP import against an unreachable host
+        still returns `{name, fileLocation}`.
+
+        The import must be saved; to run an import definition that is not saved
+        (or a modified copy of one), use the virtual import
+        `POST /v1/connections/{_id}/import`, which takes the import document in
+        the body and returns the same per-record results.
       parameters:
         - in: path
           name: _id
@@ -579,45 +590,25 @@ paths:
       responses:
         '200':
           description: |-
-            Import completed. Returns a per-record result array. Each element
-            contains the `statusCode` from the destination, the transformed
-            `_json` payload, and any `errors` encountered.
+            Import completed. One result per input record, in input order —
+            accepted, failed at the destination, or ignored by the import's own
+            input filter.
           content:
             application/json:
               schema:
                 type: array
                 items:
-                  type: object
-                  properties:
-                    statusCode:
-                      type: integer
-                      description: HTTP status code from the destination system
-                    _json:
-                      type: object
-                      description: The transformed record as sent to the destination
-                      additionalProperties: true
-                    errors:
-                      type: array
-                      description: Errors encountered processing this record
-                      items:
-                        type: object
-                        properties:
-                          source:
-                            type: string
-                          code:
-                            type: string
-                          message:
-                            type: string
-                          resolved:
-                            type: boolean
-                          occurredAt:
-                            type: integer
-                            format: int64
-                          stage:
-                            type: string
-                          classification:
-                            type: string
+                  $ref: '#/components/schemas/ImportRecordResult'
               examples:
+                accepted:
+                  summary: Record accepted — the destination's response body in _json
+                  value:
+                    - statusCode: 200
+                      _json:
+                        id: 0031U00001AbCdEQAV
+                        success: true
+                      _headers:
+                        content-type: application/json; charset=utf-8
                 destination_error:
                   summary: Record failed at destination
                   value:
@@ -631,6 +622,13 @@ paths:
                           occurredAt: 1777645680144
                           stage: apiCall
                           classification: value
+                ignored_by_input_filter:
+                  summary: Record excluded by the import's input filter — nothing sent
+                  value:
+                    - statusCode: 200
+                      _json: {}
+                      ignored: true
+                      stage: inputFilter
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '404':
@@ -780,10 +778,14 @@ paths:
         '422':
           description: |-
             Request body is malformed — most commonly the top-level `import`
-            object is missing — or the adaptor type is unsupported: RDBMS-family
-            imports are rejected with `invalid_adaptor` ("Import preview is not
-            supported for adaptor type: RDBMSImport"); database imports have no
-            request-preview surface anywhere (the SQL editor's Handlebars
+            object is missing — or the adaptor type is unsupported: NetSuite,
+            Salesforce, RDBMS and FTP imports are rejected with `invalid_adaptor`
+            ("Import preview is not supported for adaptor type: <adaptorType>")
+            before any connection is resolved, while HTTP-family and AI-agent
+            imports preview normally. The rejected adaptors execute through the
+            virtual import, `POST /v1/connections/{_id}/import`, which runs the
+            document for real and returns per-record results; database imports
+            have no compose-only surface anywhere (the SQL editor's Handlebars
             evaluation is their only preview). Structural validation returns the
             standard errors envelope.
           content:
@@ -801,6 +803,11 @@ paths:
                     errors:
                       - code: invalid_adaptor
                         message: 'Import preview is not supported for adaptor type: RDBMSImport.'
+                netsuite_unsupported:
+                  value:
+                    errors:
+                      - code: invalid_adaptor
+                        message: 'Import preview is not supported for adaptor type: NetSuiteDistributedImport.'
   /v1/netsuiteDA/previewImportMappingFields:
     put:
       x-internal: false
@@ -16663,6 +16670,82 @@ components:
           description: The stack id associated with the resource, or null if no stack is involved.
           examples:
             - 5f8d43a1b9e5a80011a35f2c
+    ImportRecordResult:
+      type: object
+      description: |-
+        The outcome of running one input record through an import — one element
+        per record, in input order — shared by `POST /v1/imports/{_id}/invoke`
+        and the virtual import `POST /v1/connections/{_id}/import`. A record the
+        import itself ignored before any request carries `ignored: true` and the
+        `stage` that dropped it; a record the destination accepted carries its
+        parsed response; a record the destination rejected — or that the
+        import's `failPath` / `failValues` rules judged a failure even on a
+        `2xx` — carries `errors[]`.
+      properties:
+        statusCode:
+          type: integer
+          description: |-
+            HTTP status of the record's outcome. The destination's status for an
+            accepted record; `422` when the import recorded a failure for the
+            record — including when the destination itself answered `200` and
+            the import's `failPath` rules declared it a failure.
+        _json:
+          type: object
+          description: |-
+            The destination's parsed response body for the record — the slice
+            under the import's `response.resourcePath` when one is defined — not
+            the record that was sent. `{}` when the record was ignored or the
+            destination returned no usable body.
+          additionalProperties: true
+        _headers:
+          type: object
+          description: Response headers the destination returned for the record.
+          additionalProperties: true
+        ignored:
+          type: boolean
+          description: |-
+            When true, the import dropped the record before sending anything and
+            `stage` names the gate; the destination was not called for it.
+        stage:
+          type: string
+          description: |-
+            The import stage that ignored the record — `inputFilter` when the
+            import's own input filter excluded it. Present only with `ignored`.
+          examples:
+            - inputFilter
+        errors:
+          type: array
+          description: |-
+            Errors recorded for the record. `source: application` with
+            `stage: apiCall` means the request reached the destination and its
+            answer was the failure; the destination's response body rides in
+            `message`.
+          items:
+            type: object
+            properties:
+              source:
+                type: string
+              code:
+                oneOf:
+                  - type: string
+                  - type: integer
+                description: |-
+                  The adaptor's error code, or the destination's HTTP status as
+                  an integer when the import's `failPath` rules turned a
+                  successful-looking response into a failure.
+              message:
+                type: string
+              resolved:
+                type: boolean
+              occurredAt:
+                type: integer
+                format: int64
+              stage:
+                type: string
+              classification:
+                type: string
+            additionalProperties: true
+      additionalProperties: true
     ImportPreviewResponse:
       type: object
       description: |-

package/dist/mcp-server.yml

@@ -7673,7 +7673,10 @@ components:
                     SHA1: Sign returned MDNs using the SHA-1 hash algorithm.
                     MD5: Sign returned MDNs using the MD5 hash algorithm.
                     SHA256: Sign returned MDNs using the SHA-256 hash algorithm.
-                  description: Hash algorithm used to sign MDNs this station returns to the partner.
+                  description: |-
+                    Hash algorithm used to sign MDNs this station returns to the partner. Signs the MDN
+                    only — the hash algorithm of its `Received-Content-MIC` follows
+                    userStationInfo.signing, not this field.
                   examples:
                     - SHA256
                   x-celigo-ui-override: Required by the connection form (as2.userStationInfo.mdn.mdnSigning).
@@ -7696,11 +7699,17 @@ components:
                 - MD5
                 - SHA256
               x-enumDescriptions:
-                NONE: Accept inbound messages without verifying their signature.
+                NONE: Accept inbound messages without verifying their signature; returned MDNs then carry a SHA-1 MIC.
                 SHA1: Verify inbound message signatures using the SHA-1 hash algorithm.
                 MD5: Verify inbound message signatures using the MD5 hash algorithm.
                 SHA256: Verify inbound message signatures using the SHA-256 hash algorithm.
-              description: Hash algorithm for verifying signatures on inbound messages. Any value other than NONE requires unencrypted.partnerCertificate.
+              description: |-
+                Hash algorithm for verifying signatures on inbound messages; the same algorithm is used
+                for the `Received-Content-MIC` in the MDN returned for each message (NONE falls back to
+                SHA-1, and the algorithm the partner requests in `Disposition-Notification-Options` is
+                not used). The MIC is computed when a message is received, so a change here applies only
+                to messages received afterwards — the partner must resend to get an MDN with the new
+                algorithm. Any value other than NONE requires unencrypted.partnerCertificate.
               examples:
                 - SHA256
               x-celigo-ui-override: Required by the connection form (as2.userStationInfo.signing — labeled Signature verification algorithm).
@@ -7806,7 +7815,12 @@ components:
             - 5
         preventCanonicalization:
           type: boolean
-          description: When true, message content is not canonicalized before signing or encryption. Enable only when a partner reports signature-verification failures caused by canonicalization.
+          description: |-
+            When true, inbound messages are verified — and the `Received-Content-MIC` in the returned
+            MDN is computed — over the content exactly as received, without first normalizing line
+            endings to CRLF; the partner's MDN signatures are verified the same way. Enable only when a
+            partner reports signature-verification failures or MIC mismatches caused by
+            canonicalization.
           default: false
     Filesystem:
       type: object

package/dist/tool.yml

@@ -10288,7 +10288,10 @@ components:
                     SHA1: Sign returned MDNs using the SHA-1 hash algorithm.
                     MD5: Sign returned MDNs using the MD5 hash algorithm.
                     SHA256: Sign returned MDNs using the SHA-256 hash algorithm.
-                  description: Hash algorithm used to sign MDNs this station returns to the partner.
+                  description: |-
+                    Hash algorithm used to sign MDNs this station returns to the partner. Signs the MDN
+                    only — the hash algorithm of its `Received-Content-MIC` follows
+                    userStationInfo.signing, not this field.
                   examples:
                     - SHA256
                   x-celigo-ui-override: Required by the connection form (as2.userStationInfo.mdn.mdnSigning).
@@ -10311,11 +10314,17 @@ components:
                 - MD5
                 - SHA256
               x-enumDescriptions:
-                NONE: Accept inbound messages without verifying their signature.
+                NONE: Accept inbound messages without verifying their signature; returned MDNs then carry a SHA-1 MIC.
                 SHA1: Verify inbound message signatures using the SHA-1 hash algorithm.
                 MD5: Verify inbound message signatures using the MD5 hash algorithm.
                 SHA256: Verify inbound message signatures using the SHA-256 hash algorithm.
-              description: Hash algorithm for verifying signatures on inbound messages. Any value other than NONE requires unencrypted.partnerCertificate.
+              description: |-
+                Hash algorithm for verifying signatures on inbound messages; the same algorithm is used
+                for the `Received-Content-MIC` in the MDN returned for each message (NONE falls back to
+                SHA-1, and the algorithm the partner requests in `Disposition-Notification-Options` is
+                not used). The MIC is computed when a message is received, so a change here applies only
+                to messages received afterwards — the partner must resend to get an MDN with the new
+                algorithm. Any value other than NONE requires unencrypted.partnerCertificate.
               examples:
                 - SHA256
               x-celigo-ui-override: Required by the connection form (as2.userStationInfo.signing — labeled Signature verification algorithm).
@@ -10421,7 +10430,12 @@ components:
             - 5
         preventCanonicalization:
           type: boolean
-          description: When true, message content is not canonicalized before signing or encryption. Enable only when a partner reports signature-verification failures caused by canonicalization.
+          description: |-
+            When true, inbound messages are verified — and the `Received-Content-MIC` in the returned
+            MDN is computed — over the content exactly as received, without first normalizing line
+            endings to CRLF; the partner's MDN signatures are verified the same way. Enable only when a
+            partner reports signature-verification failures or MIC mismatches caused by
+            canonicalization.
           default: false
     Filesystem:
       type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.74",
+  "version": "0.2.76",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "d7dc6ff",
-		"generatedAt": "2026-10-05"
+		"iasCommit": "1d2dcf0",
+		"generatedAt": "2026-10-06"
 	},
 	"roots": {
 		"aiagent": 133,