@celigo/api-specs 0.2.94 → 0.2.96

package/dist/integration.yml

@@ -5116,17 +5116,19 @@ components:
             - 6aab2870265e1cf39fcbee4d
         draft:
           type: boolean
-          readOnly: true
           description: |-
-            When true, the topic was created as a draft by the AI-assisted builder and has not been
-            confirmed yet. Absent on ordinary topics.
+            When true, the topic is an unconfirmed draft (created with `draft: true`, typically by
+            the AI-assisted builder) that auto-deletes at `draftExpiresAt`. Absent on ordinary
+            topics and once a `PUT` with `draft: false` promotes the draft.
           examples:
             - true
         draftExpiresAt:
           type: string
           format: date-time
           readOnly: true
-          description: Timestamp when an unconfirmed draft is deleted automatically. Present only when `draft` is true.
+          description: |-
+            Timestamp when an unconfirmed draft is deleted automatically — 48 hours after
+            creation. Present only while `draft` is true; cleared together with it.
           examples:
             - '2026-09-24T03:30:27.432Z'
         createdAt:
@@ -5212,6 +5214,21 @@ components:
             `GET /v1/topics?externalId=…`. Integration Apps use it to locate a topic across installs.
           examples:
             - erp-orders-created
+        draft:
+          type: boolean
+          description: |-
+            When true, the topic is a draft that auto-deletes 48 hours after creation
+            (`draftExpiresAt` in the response). Set at creation; an update can clear the
+            flag but never set it, and a PUT that omits it leaves an existing draft as is —
+            the one field the whole-document PUT does not clear.
+          x-celigo-ai-guidance:
+            - |-
+              POST with `draft: true` arms the 48-hour TTL (the server computes `draftExpiresAt`).
+              PUT with `draft: false` clears the flag and the expiry, promoting the draft to a
+              permanent topic. PUT with `draft: true` on a non-draft topic is silently ignored,
+              and a PUT that omits the field leaves an existing draft flag unchanged.
+          examples:
+            - true
         __integrationIds:
           type: array
           maxItems: 100

package/dist/mcp-oauth-provider.yml

@@ -35,13 +35,16 @@ paths:
     get:
       x-internal: false
       summary: List MCP OAuth providers
-      description: Returns all MCP OAuth providers in the account.
+      description: |-
+        Returns all MCP OAuth providers in the account.
+
+        Field projection via `include` / `exclude` is **not** supported for this
+        resource. Passing either query param returns `422 invalid_query_params`
+        (`Include or exclude query params are not applicable for mcpoauthproviders
+        resource`). Request the full document and filter client-side.
       operationId: listMcpOauthProviders
       tags:
         - MCP OAuth Providers
-      parameters:
-        - $ref: '#/components/parameters/Include'
-        - $ref: '#/components/parameters/Exclude'
       responses:
         '200':
           description: Provider list.
@@ -294,32 +297,6 @@ components:
     bearerAuth:
       type: http
       scheme: bearer
-  parameters:
-    Include:
-      name: include
-      in: query
-      required: false
-      description: |-
-        Comma-separated list of fields to project into each returned record.
-        Triggers summary projection: the response contains a minimal identity
-        set (`_id`, `name`, plus resource-specific fields) with the requested
-        fields added on top. Supports dot notation for nested fields.
-        Mutually exclusive with `exclude`.
-      schema:
-        type: string
-      example: _integrationId,disabled,lastModified
-    Exclude:
-      name: exclude
-      in: query
-      required: false
-      description: |-
-        Comma-separated list of fields to strip from the default response.
-        Unlike `include`, does not trigger summary projection — returns the
-        full record with the named fields removed. Protected identity fields
-        (e.g. `name`) cannot be stripped. Mutually exclusive with `include`.
-      schema:
-        type: string
-      example: createdAt,lastModified
   schemas:
     MCPOAuthProviderBase:
       type: object

package/dist/mcp-server.yml

@@ -2669,6 +2669,9 @@ components:
         every other field is taken from the stored row, and a write that includes
         `upstreamMcpConnections` re-approves the current upstream definitions
         (`approvedDefinitionHash` is re-pinned and `changedSinceApproval` reset).
+        Each attachment whitelists at most 500 rows across `tools`, `prompts`,
+        and `resources` combined; a larger whitelist is rejected with 422
+        `mcp_upstream_max_capabilities`.
       x-celigo-ai-guidance:
         - |-
           Attach only connections of type "mcp" that belong to this account: any
@@ -2679,6 +2682,16 @@ components:
           To edit one row (enable, disable, rename, retitle) send the complete
           upstreamMcpConnections array back via PUT: the array is preserved when
           omitted, and PATCH reaches only /upstreamMcpConnections/{index}/alias.
+        - |-
+          Keep each attachment at 500 rows or fewer across tools, prompts, and
+          resources combined: the 501st row fails the whole PUT with 422
+          "mcp_upstream_max_capabilities" on upstreamMcpConnections[{index}].
+          The cap is per attachment, so a second connection gets its own 500.
+        - |-
+          Set alias explicitly when the connection name is longer than 32
+          characters: the alias derived from the name on first attach fails the
+          PUT with 422 "size_limit_exceeded" on upstreamMcpConnections.{index}.alias,
+          the same response an explicit alias of 33 or more characters gets.
       required:
         - _connectionId
       properties:
@@ -2699,8 +2712,10 @@ components:
             Short handle that namespaces the upstream's capabilities on this
             server. Lowercased on save and unique per server (case-insensitive) —
             a duplicate is rejected with 422 `mcp_upstream_duplicate_alias`, an
-            invalid character with 422 `mcp_upstream_invalid_alias_charset`.
-            Derived from the connection name when omitted on the first attach.
+            invalid character with 422 `mcp_upstream_invalid_alias_charset`, and
+            an over-long value with 422 `size_limit_exceeded`.
+            Derived from the connection name when omitted on the first attach, so
+            a name longer than the alias cap needs an explicit alias.
           examples:
             - deepwiki
             - crm_tools

package/dist/subscription.yml

@@ -285,7 +285,21 @@ paths:
                           connections:
                             - _id: 62ac9ab6cd606e428737008e
                               name: HubSpot (Production)
+                        - type: http
+                          _httpConnectorId: 6425e536bd748551c63024bc
+                          connections:
+                            - _id: 68ae48d6b5f755d2dd38c294
+                              name: OpenAI
+                        - type: ftp
+                          hostURI: sftp.example.com
+                          port: 22
+                          connections:
+                            - _id: 62ac8142839f01546de4db2a
+                              name: Warehouse SFTP
                         - type: rdbms
+                          rdbms:
+                            type: snowflake
+                            host: celigo_partner
                           connections:
                             - _id: 69d096cd4e0c505cda036a3a
                               name: Snowflake DW
@@ -1235,14 +1249,20 @@ components:
                     type: string
                     description: Integration name.
                     example: POC – HubSpot → Snowflake
+                  isDeleted:
+                    type: boolean
+                    description: When true, the parent integration has been soft-deleted and sits in the recycle bin. Absent while the integration is live.
+                    example: true
     EndpointUsage:
       type: object
       description: |-
         Endpoint entitlement usage for the requesting environment. An endpoint is a connected
         application, not a connection record: connections that share a Celigo-managed application
-        profile (`assistant`) are one endpoint, generic HTTP connections without one are grouped by
-        `baseURI`, databases by `rdbms` engine and host, and other adaptor types by their own connection
-        identity (for example host and port). Each `endpoints[]` entry carries the fields it was grouped by.
+        profile (`assistant`) are one endpoint, HTTP connections linked to an HTTP connector but without
+        an `assistant` are grouped by `_httpConnectorId`, generic HTTP connections by `baseURI`,
+        databases by `rdbms` engine and host, FTP servers by `hostURI` and `port`, and other adaptor
+        types by their own connection identity. Each `endpoints[]` entry carries the fields it was
+        grouped by.
       properties:
         numConsumed:
           type: integer
@@ -1271,10 +1291,29 @@ components:
                 type: string
                 description: Application assistant identifier, if the connection uses a Celigo-managed application profile (e.g., `hubspot`, `netsuite`). Connections sharing an assistant are one endpoint.
                 example: hubspot
+              _httpConnectorId:
+                type: string
+                format: objectId
+                x-celigo-refModel: httpconnectors
+                description: |-
+                  HTTP connector the endpoint's connections are linked to. Present when `type` is `http`
+                  and the connections carry `http._httpConnectorId` without an `assistant`; connections
+                  sharing the connector are one endpoint.
+                example: 6425e536bd748551c63024bc
               baseURI:
                 type: string
-                description: Base URI that identifies this endpoint for generic HTTP connections (those without an `assistant`); connections whose base URIs differ are separate endpoints.
+                description: Base URI that identifies this endpoint for generic HTTP connections (those without an `assistant` or an HTTP connector); connections whose base URIs differ are separate endpoints.
                 example: https://api.hubspot.com
+              hostURI:
+                type: string
+                description: |-
+                  Server host the endpoint's connections point at. Present when `type` is `ftp`; with
+                  `port` it is the identity FTP endpoints are grouped by.
+                example: sftp.example.com
+              port:
+                type: integer
+                description: Server port the endpoint's connections use. Present when `type` is `ftp` and the connections set one.
+                example: 22
               rdbms:
                 type: object
                 description: Database connection details. Present when `type` is `rdbms`.

package/dist/topic.yml

@@ -1286,17 +1286,19 @@ components:
             - 6aab2870265e1cf39fcbee4d
         draft:
           type: boolean
-          readOnly: true
           description: |-
-            When true, the topic was created as a draft by the AI-assisted builder and has not been
-            confirmed yet. Absent on ordinary topics.
+            When true, the topic is an unconfirmed draft (created with `draft: true`, typically by
+            the AI-assisted builder) that auto-deletes at `draftExpiresAt`. Absent on ordinary
+            topics and once a `PUT` with `draft: false` promotes the draft.
           examples:
             - true
         draftExpiresAt:
           type: string
           format: date-time
           readOnly: true
-          description: Timestamp when an unconfirmed draft is deleted automatically. Present only when `draft` is true.
+          description: |-
+            Timestamp when an unconfirmed draft is deleted automatically — 48 hours after
+            creation. Present only while `draft` is true; cleared together with it.
           examples:
             - '2026-09-24T03:30:27.432Z'
         createdAt:
@@ -1422,6 +1424,21 @@ components:
             `GET /v1/topics?externalId=…`. Integration Apps use it to locate a topic across installs.
           examples:
             - erp-orders-created
+        draft:
+          type: boolean
+          description: |-
+            When true, the topic is a draft that auto-deletes 48 hours after creation
+            (`draftExpiresAt` in the response). Set at creation; an update can clear the
+            flag but never set it, and a PUT that omits it leaves an existing draft as is —
+            the one field the whole-document PUT does not clear.
+          x-celigo-ai-guidance:
+            - |-
+              POST with `draft: true` arms the 48-hour TTL (the server computes `draftExpiresAt`).
+              PUT with `draft: false` clears the flag and the expiry, promoting the draft to a
+              permanent topic. PUT with `draft: true` on a non-draft topic is silently ignored,
+              and a PUT that omits the field leaves an existing draft flag unchanged.
+          examples:
+            - true
         __integrationIds:
           type: array
           maxItems: 100

package/dist/user.yml

@@ -42,7 +42,9 @@ paths:
       summary: List users
       description: |-
         Returns all users with access to the account. The account owner is
-        not included — only invited users appear.
+        not included — only invited users appear. Without `userType` the list
+        holds workspace records only; end-user records (MCP-only consumers
+        managed through the End Users API) are included only when asked for.
       operationId: listUsers
       tags:
         - Users
@@ -55,13 +57,15 @@ paths:
             enum:
               - workspace
               - end-user
+              - workspace,end-user
             x-enumDescriptions:
-              workspace: Workspace (team member) access records — the records this endpoint returns.
-              end-user: End-user records; always empty here (204) — list them via the End Users API instead.
+              workspace: Workspace (team member) access records — the same records an unfiltered call returns.
+              end-user: End-user access records only, each carrying `resourceGrants`, `provisionedBy`, and — when the end user belongs to a group — `groupMemberships` and `_groupIds`.
+              workspace,end-user: Both planes in one list; tell the records apart by `userType`.
           description: |-
-            Filter by access-record type. `workspace` returns the same records as
-            an unfiltered call; `end-user` always returns 204 because end users
-            are served by the End Users API, not this endpoint.
+            Filter by access-record type. `end-user` returns the same records as
+            `GET /v1/endusers`, in this API's shape (`sharedWithUser` instead of the
+            joined `email` and `name`). Any other value is rejected with 400.
       responses:
         '200':
           description: All users with access to the account.
@@ -115,8 +119,51 @@ paths:
                         name: Integration User
                         allowedToResetMFA: false
                         accountSSOLinked: not_linked
+                endUsers:
+                  summary: ?userType=end-user — one end user with a group membership
+                  value:
+                    - _id: 6aacb5cd76dd63f8209a4c57
+                      accepted: true
+                      userType: end-user
+                      provisionedBy: invite
+                      resourceGrants:
+                        - resourceType: mcpServer
+                          _resourceId: 6aacaf0c1e2c183620e7253d
+                          capabilities:
+                            - tool:all
+                        - resourceType: mcpServer
+                          _resourceId: 6ab1ebd05af4c5a3ea6b0958
+                          capabilities:
+                            - pset:6ab1ec1d2d2c0e0d88aea1dc
+                      groupMemberships:
+                        - _groupId: 6abf4dd8fa3e52974f9f1d7a
+                          source: manual
+                      _groupIds:
+                        - 6abf4dd8fa3e52974f9f1d7a
+                      allowIntegrationWorkspaceCreation: false
+                      lastModified: '2026-09-22T02:47:05.390Z'
+                      createdAt: '2026-09-18T03:53:49.619Z'
+                      sharedWithUser:
+                        _id: 6aacb5cc76dd63f8209a4c28
+                        email: enduser@example.com
+                        name: Ana Enduser
+                        lastSignIn: '2026-09-18T04:10:35.199Z'
+                        allowedToResetMFA: false
+                        accountSSOLinked: not_linked
         '204':
           description: No users exist in the account
+        '400':
+          description: '`userType` is not one of the accepted values.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                invalidUserType:
+                  value:
+                    errors:
+                      - code: validation_failed
+                        message: Validation failed. userType must be workspace, end-user, or workspace,end-user.
         '401':
           $ref: '#/components/responses/401-unauthorized'
   /v1/ashares/{_id}:
@@ -702,6 +749,83 @@ components:
         allowIntegrationWorkspaceCreation:
           type: boolean
           description: When true, the user can create integration workspaces.
+    ResourceGrant:
+      type: object
+      description: |-
+        Grants access to a resource (currently MCP servers only). A grant names
+        the resource, or applies as a wildcard across all resources of the type,
+        and lists the capabilities granted on it.
+      required:
+        - resourceType
+        - capabilities
+      properties:
+        resourceType:
+          type: string
+          enum:
+            - mcpServer
+          x-enumDescriptions:
+            mcpServer: Grants access to an MCP server and its tools, APIs, or permission sets.
+          description: Resource type this grant applies to.
+        _resourceId:
+          type:
+            - string
+            - 'null'
+          format: objectId
+          x-celigo-refModel: mcpservers
+          examples:
+            - 6a1b2c3d4e5f6a7b8c9d0e1f
+          description: |-
+            MCP server this grant applies to. Omit or set to null for a wildcard
+            grant across all MCP servers in the account.
+        capabilities:
+          type: array
+          minItems: 1
+          description: |-
+            Capabilities granted on the target resource. Each `:all` capability
+            covers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,
+            and `resource:all` together to open every item on a server.
+          items:
+            type: string
+            pattern: ^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$
+            description: |-
+              Capability string for an `mcpServer` grant. `tool:`, `api:`,
+              `prompt:`, and `resource:` take `all` or a 24-hex id on the target
+              server — a `tools[]._toolId` or upstream tool row `_id`, an
+              `apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`
+              takes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:
+              older grants written as `tool:<prompt _id>` still validate but are
+              not reported by effective access. Any other shape is rejected with
+              400 `validation_failed` ("Invalid capability"), and an id that is
+              not attached to the target server with 400 `validation_failed`
+              naming the missing item.
+            examples:
+              - tool:all
+              - prompt:6b2c3d4e5f6a7b8c9d0e1f2a
+              - pset:6c3d4e5f6a7b8c9d0e1f2a3b
+    GroupMembership:
+      type: object
+      description: An end user's membership in a group, with the source that created it.
+      properties:
+        _groupId:
+          type: string
+          format: objectId
+          x-celigo-refModel: groups
+          examples:
+            - 68a1b2c3d4e5f6a7b8c9d0e1
+          description: Group the end user belongs to.
+        source:
+          type: string
+          enum:
+            - manual
+            - idp
+          x-enumDescriptions:
+            manual: Membership was added by an owner or administrator (invite or group members API)
+            idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
+          description: |-
+            How the membership was created. IdP-synced memberships cannot be
+            removed through the group members API — change the person's group in
+            the identity provider instead (its group mapping, or the SCIM group
+            assignment, whichever created the membership).
     ResourceResponse:
       type: object
       description: Response
@@ -764,9 +888,15 @@ components:
       type: object
       required:
         - _id
-        - integrationAccessLevel
         - createdAt
         - lastModified
+      if:
+        properties:
+          userType:
+            const: workspace
+      then:
+        required:
+          - integrationAccessLevel
       description: |-
         A user's access record in the account. Each user who has been invited
         (or shared access), or whom the identity provider provisioned through
@@ -817,14 +947,18 @@ components:
               readOnly: true
               enum:
                 - workspace
+                - end-user
               description: |-
                 Discriminates workspace users from end users on the underlying
-                access-record model. Reads on this API return only `workspace`
-                records — end users are managed through the End Users API, which
-                shares the update and disable routes. Sending it back on update
-                is rejected.
+                access-record model. An unfiltered list and `GET /v1/ashares/{_id}`
+                return `workspace` records only; `end-user` records appear in the
+                list only when it is filtered with `userType=end-user` (or
+                `workspace,end-user`) and are otherwise managed through the End
+                Users API, which shares the update and disable routes. Sending it
+                back on update is rejected.
               x-enumDescriptions:
                 workspace: A workspace (team member) access record.
+                end-user: An MCP-only end-user access record — carries `resourceGrants` (and group fields) in place of `accessLevel` and `integrationAccessLevel`.
             lastSignIn:
               type: string
               format: date-time
@@ -868,19 +1002,24 @@ components:
               type: string
               readOnly: true
               enum:
+                - invite
+                - jit
                 - scim
               x-enumDescriptions:
+                invite: End-user record created through an explicit invite (or by migration from a workspace user); never present on a workspace record
+                jit: End-user record provisioned just-in-time on first sign-in through an external IdP
                 scim: Created, or adopted from an existing invitation, by the identity provider through SCIM
               description: |-
-                Present only on workspace users the identity provider manages through
-                SCIM; every other workspace record omits the field, so an invited
-                user has no value here rather than `invite`. The identity provider
-                owns a SCIM-managed user's account-wide access level and active
-                state: `PUT /v1/ashares/{_id}` still accepts a new `accessLevel` and
-                `PUT /v1/ashares/{_userId}/disable` still toggles `disabled`, but the
-                identity provider's next push overwrites both — change them in the
-                IdP. SCIM never sets `integrationAccessLevel`, so integration-level
-                grants made here stay.
+                On workspace records, present only when the identity provider
+                manages the user through SCIM; every other workspace record omits
+                the field, so an invited workspace user has no value here rather
+                than `invite`. End-user records (`userType=end-user`) always carry
+                it. The identity provider owns a SCIM-managed user's account-wide
+                access level and active state: `PUT /v1/ashares/{_id}` still accepts
+                a new `accessLevel` and `PUT /v1/ashares/{_userId}/disable` still
+                toggles `disabled`, but the identity provider's next push overwrites
+                both — change them in the IdP. SCIM never sets
+                `integrationAccessLevel`, so integration-level grants made here stay.
             externalId:
               type: string
               readOnly: true
@@ -901,6 +1040,37 @@ components:
               description: |-
                 SSO client whose SCIM configuration provisioned this record. Present
                 only when `provisionedBy` is `scim`.
+            resourceGrants:
+              type: array
+              readOnly: true
+              description: |-
+                Present only on end-user records (`userType=end-user`): the MCP
+                server grants held directly by the end user, in addition to any
+                group- or role-derived access. Replace them with the End Users
+                body on `PUT /v1/ashares/{_ashareId}`.
+              items:
+                $ref: '#/components/schemas/ResourceGrant'
+            groupMemberships:
+              type: array
+              readOnly: true
+              description: |-
+                Present only on end-user records that belong to at least one
+                group. Each entry names the group and whether an administrator or
+                the identity provider created the membership.
+              items:
+                $ref: '#/components/schemas/GroupMembership'
+            _groupIds:
+              type: array
+              readOnly: true
+              description: |-
+                Group ids from `groupMemberships`, flattened for quick filtering.
+                Present exactly when `groupMemberships` is.
+              items:
+                type: string
+                format: objectId
+                x-celigo-refModel: groups
+                examples:
+                  - 6abf4dd8fa3e52974f9f1d7a
             sharedWithUser:
               type: object
               readOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.94",
+  "version": "0.2.96",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "29615c6c",
+		"iasCommit": "545ed6c7",
 		"generatedAt": "2026-10-12"
 	},
 	"roots": {