@celigo/api-specs 0.2.78 → 0.2.80

package/dist/agent.yml

@@ -600,6 +600,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/ai-agent.yml

@@ -5425,6 +5425,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/api.yml

@@ -4637,6 +4637,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -7260,11 +7268,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/asynchelper.yml

@@ -3154,6 +3154,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/connection.yml

@@ -701,6 +701,20 @@ paths:
                       - field: http._iClientId
                         code: invalid_field
                         message: IClient provider must be azureserviceprincipal for Azure Data Lake Storage Gen2 connections.
+                gcsIClientWrongProvider:
+                  summary: Google Cloud Storage connection referencing an iClient that is neither a service account nor OAuth
+                  value:
+                    errors:
+                      - field: http._iClientId
+                        code: invalid_field
+                        message: IClient provider must be googleserviceaccount or custom_oauth2 for Google Cloud Storage connections.
+                gcsProjectIdMissing:
+                  summary: Google Cloud Storage OAuth connection without a project id
+                  value:
+                    errors:
+                      - field: http.unencrypted.googleProjectId
+                        code: project_id_missing
+                        message: Default project ID is required on OAuth Google Cloud Storage connections (http.unencrypted.googleProjectId).
       x-celigo-ai-guidance:
         - |-
           Send exactly one adaptor config object, the one named by `type`. Credentials are accepted
@@ -3230,6 +3244,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -5853,11 +5875,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/connector.yml

@@ -1103,6 +1103,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/ediprofile.yml

@@ -656,6 +656,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/enduser.yml

@@ -1883,6 +1883,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -4506,11 +4514,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/environment.yml

@@ -393,6 +393,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/eventreport.yml

@@ -351,6 +351,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/export.yml

@@ -16787,6 +16787,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/filedefinition.yml

@@ -1173,6 +1173,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/flow.yml

@@ -5609,6 +5609,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/guardrail.yml

@@ -463,6 +463,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/httpconnector.yml

@@ -1850,6 +1850,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/httpconnectorendpoint.yml

@@ -932,6 +932,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/iclient.yml

@@ -254,6 +254,13 @@ paths:
                       - field: awsIam.roleArn
                         code: invalid_field_value
                         message: roleArn must match format arn:aws:iam::{account-id}:role/[path/]{role-name}.
+                googleServiceAccountInvalidJsonKey:
+                  summary: Google service account key is missing or not the required JSON
+                  value:
+                    errors:
+                      - field: googleserviceaccount.serviceAccountJSON
+                        code: invalid_json_key
+                        message: The service account JSON key is missing, empty, or not valid JSON with required fields (project_id, client_email, private_key).
   /v1/iclients/{_id}:
     get:
       x-internal: false
@@ -313,7 +320,8 @@ paths:
       description: |-
         Replaces an iClient. All mutable fields must be provided — omitted
         fields are reset to defaults. Secrets returned as `"******"` can be
-        sent back as-is to keep the existing value.
+        sent back as-is to keep the existing value, except a Google service
+        account: every update must include the full JSON key.
       operationId: updateIClient
       tags:
         - iClients
@@ -371,7 +379,22 @@ paths:
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
-          $ref: '#/components/responses/422-unprocessable-entity'
+          description: |-
+            Unprocessable entity. The body was well-formed but a credential
+            field failed validation. A Google service account update without
+            the full JSON key is rejected here.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                googleServiceAccountKeyOmitted:
+                  summary: Google service account update without the full JSON key
+                  value:
+                    errors:
+                      - field: googleserviceaccount.serviceAccountJSON
+                        code: invalid_json_key
+                        message: The service account JSON key is missing, empty, or not valid JSON with required fields (project_id, client_email, private_key).
     patch:
       x-internal: false
       summary: Patch an iClient
@@ -3986,12 +4009,22 @@ components:
               type: string
               writeOnly: true
               description: |-
-                Full Google service-account key file as a JSON string. Must parse
-                as JSON and contain `project_id`, `client_email`, and a valid PEM
-                `private_key` — otherwise the save fails with
-                ICLIENT_GOOGLESERVICEACCOUNT_INVALID_JSON_KEY (or _INVALID_PEM
-                when only the key material is malformed). On update, omitting it
-                (or sending the mask) keeps the stored credentials.
+                Google service-account key file, sent as a JSON string. The save
+                reads `project_id`, `client_email`, and a `private_key` that
+                includes its PEM armor (`-----BEGIN PRIVATE KEY-----` through
+                `-----END PRIVATE KEY-----`). Missing, empty, or incomplete JSON
+                fails with 422 `invalid_json_key`. Send the full key on every
+                create and every update — omitting it or sending `"******"`
+                fails the same way.
+              x-celigo-ai-guidance:
+                - |-
+                  A placeholder body inside the PEM armor is accepted on create.
+                  A PUT never keeps the stored key: omitting serviceAccountJSON,
+                  sending "******", or omitting the googleserviceaccount block
+                  all return 422 invalid_json_key on
+                  googleserviceaccount.serviceAccountJSON — "The service account
+                  JSON key is missing, empty, or not valid JSON with required
+                  fields (project_id, client_email, private_key)."
             clientEmail:
               type: string
               readOnly: true
@@ -4211,6 +4244,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -4300,9 +4341,12 @@ components:
         `salesforce`, `ebay`, `amazonmws`, `azureserviceprincipal`,
         `googleserviceaccount`, `awsIam`).
         For `custom_oauth2`, credentials go in the `oauth2` sub-object.
-        Secrets (`clientSecret`, `privateKey`, etc.) are returned masked
-        as `"******"`. On update, re-send that masked value to keep the
-        existing secret; secrets are not preserved if omitted.
+        Secrets (`clientSecret`, `privateKey`, and so on) come back masked
+        as `"******"`. Re-send that mask on update to keep the stored
+        secret; omitting it does not. A Google service account is the
+        exception: `serviceAccountJSON` is not returned, and every update
+        must send the full key — the mask or an omission fails with 422
+        `invalid_json_key`.
       required:
         - provider
       allOf:

package/dist/import.yml

@@ -16261,6 +16261,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/integration.yml

@@ -3531,9 +3531,21 @@ components:
           examples:
             - 1.2.0
           description: |-
-            Integration App version (or template version) associated with this integration.
-
-            Usually system-managed for Integration App installs; omit unless you are explicitly controlling versions.
+            Version of the Integration App (or template) currently installed in this integration.
+            For Integration Apps the connector's update workflow sets it; omit unless you are
+            explicitly controlling versions.
+          x-celigo-ai-guidance:
+            - |-
+              This is the installed version only. No API field carries an Integration App's newest
+              available version (the connector record has none), so whether a newer release exists
+              cannot be read from the platform — say so rather than inferring it from release notes,
+              which are labeled by their own scheme, not by this value.
+            - |-
+              To date an Integration App update, read the integration's audit log
+              (`GET /v1/integrations/{_id}/audit?source=connector`) for `version` field changes —
+              one entry per version step, and an update run usually writes several in a row.
+              `lastModified` moves on any write and `updateInProgress` can flip without a version
+              change, so neither dates an update.
         tag:
           type:
             - string
@@ -3551,6 +3563,9 @@ components:
             API, but normally managed by the platform's update workflow.
           x-celigo-ai-guidance:
             - Typically system-managed; omit unless a workflow explicitly requires setting it.
+            - |-
+              An update run can set and clear it without changing `version`; its audit entries alone
+              do not mean a new release was installed — the `version` changes do.
         celigoAgentAutoRunMode:
           type: boolean
           examples:
@@ -3569,6 +3584,10 @@ components:
             Timestamp indicating when the most recent install/update workflow was resolved/completed.
 
             Typically system-managed; omit in normal create/update payloads.
+          x-celigo-ai-guidance:
+            - |-
+              May be absent on an installed Integration App even after its update workflow has run —
+              date an update from the audit log's `version` changes, not from this field.
         settingsForm:
           description: Settings form definition for the integration.
           allOf:
@@ -4279,6 +4298,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/job.yml

@@ -1189,6 +1189,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/lookupcache.yml

@@ -758,6 +758,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/mcp-oauth-provider.yml

@@ -422,6 +422,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/mcp-server.yml

@@ -3315,6 +3315,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -6316,11 +6324,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/notification.yml

@@ -244,6 +244,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/tag.yml

@@ -336,6 +336,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/template.yml

@@ -643,6 +643,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/tool.yml

@@ -6273,6 +6273,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:
@@ -8959,11 +8967,15 @@ components:
               x-celigo-ai-guidance:
                 - |-
                   Required when the GCS connection authenticates through an OAuth
-                  iClient (provider custom_oauth2) — omitting it fails the save
-                  with GCS_PROJECT_ID_MISSING. With a googleserviceaccount
-                  iClient the server fills it automatically from the iClient's
-                  projectId; any other iClient provider is rejected with
-                  GCS_ICLIENT_INVALID_PROVIDER.
+                  iClient (provider custom_oauth2). Omitting it fails the save
+                  with 422 project_id_missing on http.unencrypted.googleProjectId
+                  — "Default project ID is required on OAuth Google Cloud Storage
+                  connections (http.unencrypted.googleProjectId)." With a
+                  googleserviceaccount iClient the server fills this from the
+                  key's project_id. Any other provider fails with 422
+                  invalid_field on http._iClientId — "IClient provider must be
+                  googleserviceaccount or custom_oauth2 for Google Cloud Storage
+                  connections."
         unencryptedFields:
           type: array
           description: |

package/dist/tradingpartnerconnector.yml

@@ -1307,6 +1307,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/dist/user.yml

@@ -737,6 +737,14 @@ components:
           description: Timestamp when the resource was last updated. Changes whenever any property is modified.
           x-celigo-ai-guidance:
             - Recorded in ISO 8601 with a UTC timezone (Z suffix); always equal to or later than `createdAt`.
+            - |-
+              Records that something was written, not what — a settings edit, a flag flip, or a
+              platform workflow all move it. What changed and when is in the audit log: the
+              per-resource route `GET /v1/{resourceType}/{_id}/audit` for the types its
+              `resourceType` enum lists, or the account-wide
+              `GET /v1/audit?resourceType=<singular>&_resourceId={_id}` for the further types that
+              endpoint's enum accepts (users, environments, notifications among them). A type absent
+              from both enums — jobs, connectors, templates — has only this timestamp.
           examples:
             - '2023-04-15T14:30:15Z'
         deletedAt:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.78",
+  "version": "0.2.80",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,8 +1,8 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "72d3caa",
-		"generatedAt": "2026-10-07"
+		"iasCommit": "09c1f65",
+		"generatedAt": "2026-10-08"
 	},
 	"roots": {
 		"aiagent": 133,