@celigo/api-specs 0.2.95 → 0.2.96

package/dist/mcp-oauth-provider.yml

@@ -35,13 +35,16 @@ paths:
     get:
       x-internal: false
       summary: List MCP OAuth providers
-      description: Returns all MCP OAuth providers in the account.
+      description: |-
+        Returns all MCP OAuth providers in the account.
+
+        Field projection via `include` / `exclude` is **not** supported for this
+        resource. Passing either query param returns `422 invalid_query_params`
+        (`Include or exclude query params are not applicable for mcpoauthproviders
+        resource`). Request the full document and filter client-side.
       operationId: listMcpOauthProviders
       tags:
         - MCP OAuth Providers
-      parameters:
-        - $ref: '#/components/parameters/Include'
-        - $ref: '#/components/parameters/Exclude'
       responses:
         '200':
           description: Provider list.
@@ -294,32 +297,6 @@ components:
     bearerAuth:
       type: http
       scheme: bearer
-  parameters:
-    Include:
-      name: include
-      in: query
-      required: false
-      description: |-
-        Comma-separated list of fields to project into each returned record.
-        Triggers summary projection: the response contains a minimal identity
-        set (`_id`, `name`, plus resource-specific fields) with the requested
-        fields added on top. Supports dot notation for nested fields.
-        Mutually exclusive with `exclude`.
-      schema:
-        type: string
-      example: _integrationId,disabled,lastModified
-    Exclude:
-      name: exclude
-      in: query
-      required: false
-      description: |-
-        Comma-separated list of fields to strip from the default response.
-        Unlike `include`, does not trigger summary projection — returns the
-        full record with the named fields removed. Protected identity fields
-        (e.g. `name`) cannot be stripped. Mutually exclusive with `include`.
-      schema:
-        type: string
-      example: createdAt,lastModified
   schemas:
     MCPOAuthProviderBase:
       type: object

package/dist/user.yml

@@ -42,7 +42,9 @@ paths:
       summary: List users
       description: |-
         Returns all users with access to the account. The account owner is
-        not included — only invited users appear.
+        not included — only invited users appear. Without `userType` the list
+        holds workspace records only; end-user records (MCP-only consumers
+        managed through the End Users API) are included only when asked for.
       operationId: listUsers
       tags:
         - Users
@@ -55,13 +57,15 @@ paths:
             enum:
               - workspace
               - end-user
+              - workspace,end-user
             x-enumDescriptions:
-              workspace: Workspace (team member) access records — the records this endpoint returns.
-              end-user: End-user records; always empty here (204) — list them via the End Users API instead.
+              workspace: Workspace (team member) access records — the same records an unfiltered call returns.
+              end-user: End-user access records only, each carrying `resourceGrants`, `provisionedBy`, and — when the end user belongs to a group — `groupMemberships` and `_groupIds`.
+              workspace,end-user: Both planes in one list; tell the records apart by `userType`.
           description: |-
-            Filter by access-record type. `workspace` returns the same records as
-            an unfiltered call; `end-user` always returns 204 because end users
-            are served by the End Users API, not this endpoint.
+            Filter by access-record type. `end-user` returns the same records as
+            `GET /v1/endusers`, in this API's shape (`sharedWithUser` instead of the
+            joined `email` and `name`). Any other value is rejected with 400.
       responses:
         '200':
           description: All users with access to the account.
@@ -115,8 +119,51 @@ paths:
                         name: Integration User
                         allowedToResetMFA: false
                         accountSSOLinked: not_linked
+                endUsers:
+                  summary: ?userType=end-user — one end user with a group membership
+                  value:
+                    - _id: 6aacb5cd76dd63f8209a4c57
+                      accepted: true
+                      userType: end-user
+                      provisionedBy: invite
+                      resourceGrants:
+                        - resourceType: mcpServer
+                          _resourceId: 6aacaf0c1e2c183620e7253d
+                          capabilities:
+                            - tool:all
+                        - resourceType: mcpServer
+                          _resourceId: 6ab1ebd05af4c5a3ea6b0958
+                          capabilities:
+                            - pset:6ab1ec1d2d2c0e0d88aea1dc
+                      groupMemberships:
+                        - _groupId: 6abf4dd8fa3e52974f9f1d7a
+                          source: manual
+                      _groupIds:
+                        - 6abf4dd8fa3e52974f9f1d7a
+                      allowIntegrationWorkspaceCreation: false
+                      lastModified: '2026-09-22T02:47:05.390Z'
+                      createdAt: '2026-09-18T03:53:49.619Z'
+                      sharedWithUser:
+                        _id: 6aacb5cc76dd63f8209a4c28
+                        email: enduser@example.com
+                        name: Ana Enduser
+                        lastSignIn: '2026-09-18T04:10:35.199Z'
+                        allowedToResetMFA: false
+                        accountSSOLinked: not_linked
         '204':
           description: No users exist in the account
+        '400':
+          description: '`userType` is not one of the accepted values.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                invalidUserType:
+                  value:
+                    errors:
+                      - code: validation_failed
+                        message: Validation failed. userType must be workspace, end-user, or workspace,end-user.
         '401':
           $ref: '#/components/responses/401-unauthorized'
   /v1/ashares/{_id}:
@@ -702,6 +749,83 @@ components:
         allowIntegrationWorkspaceCreation:
           type: boolean
           description: When true, the user can create integration workspaces.
+    ResourceGrant:
+      type: object
+      description: |-
+        Grants access to a resource (currently MCP servers only). A grant names
+        the resource, or applies as a wildcard across all resources of the type,
+        and lists the capabilities granted on it.
+      required:
+        - resourceType
+        - capabilities
+      properties:
+        resourceType:
+          type: string
+          enum:
+            - mcpServer
+          x-enumDescriptions:
+            mcpServer: Grants access to an MCP server and its tools, APIs, or permission sets.
+          description: Resource type this grant applies to.
+        _resourceId:
+          type:
+            - string
+            - 'null'
+          format: objectId
+          x-celigo-refModel: mcpservers
+          examples:
+            - 6a1b2c3d4e5f6a7b8c9d0e1f
+          description: |-
+            MCP server this grant applies to. Omit or set to null for a wildcard
+            grant across all MCP servers in the account.
+        capabilities:
+          type: array
+          minItems: 1
+          description: |-
+            Capabilities granted on the target resource. Each `:all` capability
+            covers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,
+            and `resource:all` together to open every item on a server.
+          items:
+            type: string
+            pattern: ^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$
+            description: |-
+              Capability string for an `mcpServer` grant. `tool:`, `api:`,
+              `prompt:`, and `resource:` take `all` or a 24-hex id on the target
+              server — a `tools[]._toolId` or upstream tool row `_id`, an
+              `apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`
+              takes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:
+              older grants written as `tool:<prompt _id>` still validate but are
+              not reported by effective access. Any other shape is rejected with
+              400 `validation_failed` ("Invalid capability"), and an id that is
+              not attached to the target server with 400 `validation_failed`
+              naming the missing item.
+            examples:
+              - tool:all
+              - prompt:6b2c3d4e5f6a7b8c9d0e1f2a
+              - pset:6c3d4e5f6a7b8c9d0e1f2a3b
+    GroupMembership:
+      type: object
+      description: An end user's membership in a group, with the source that created it.
+      properties:
+        _groupId:
+          type: string
+          format: objectId
+          x-celigo-refModel: groups
+          examples:
+            - 68a1b2c3d4e5f6a7b8c9d0e1
+          description: Group the end user belongs to.
+        source:
+          type: string
+          enum:
+            - manual
+            - idp
+          x-enumDescriptions:
+            manual: Membership was added by an owner or administrator (invite or group members API)
+            idp: Membership is synced from the identity provider — group claims at sign-in or a SCIM group push
+          description: |-
+            How the membership was created. IdP-synced memberships cannot be
+            removed through the group members API — change the person's group in
+            the identity provider instead (its group mapping, or the SCIM group
+            assignment, whichever created the membership).
     ResourceResponse:
       type: object
       description: Response
@@ -764,9 +888,15 @@ components:
       type: object
       required:
         - _id
-        - integrationAccessLevel
         - createdAt
         - lastModified
+      if:
+        properties:
+          userType:
+            const: workspace
+      then:
+        required:
+          - integrationAccessLevel
       description: |-
         A user's access record in the account. Each user who has been invited
         (or shared access), or whom the identity provider provisioned through
@@ -817,14 +947,18 @@ components:
               readOnly: true
               enum:
                 - workspace
+                - end-user
               description: |-
                 Discriminates workspace users from end users on the underlying
-                access-record model. Reads on this API return only `workspace`
-                records — end users are managed through the End Users API, which
-                shares the update and disable routes. Sending it back on update
-                is rejected.
+                access-record model. An unfiltered list and `GET /v1/ashares/{_id}`
+                return `workspace` records only; `end-user` records appear in the
+                list only when it is filtered with `userType=end-user` (or
+                `workspace,end-user`) and are otherwise managed through the End
+                Users API, which shares the update and disable routes. Sending it
+                back on update is rejected.
               x-enumDescriptions:
                 workspace: A workspace (team member) access record.
+                end-user: An MCP-only end-user access record — carries `resourceGrants` (and group fields) in place of `accessLevel` and `integrationAccessLevel`.
             lastSignIn:
               type: string
               format: date-time
@@ -868,19 +1002,24 @@ components:
               type: string
               readOnly: true
               enum:
+                - invite
+                - jit
                 - scim
               x-enumDescriptions:
+                invite: End-user record created through an explicit invite (or by migration from a workspace user); never present on a workspace record
+                jit: End-user record provisioned just-in-time on first sign-in through an external IdP
                 scim: Created, or adopted from an existing invitation, by the identity provider through SCIM
               description: |-
-                Present only on workspace users the identity provider manages through
-                SCIM; every other workspace record omits the field, so an invited
-                user has no value here rather than `invite`. The identity provider
-                owns a SCIM-managed user's account-wide access level and active
-                state: `PUT /v1/ashares/{_id}` still accepts a new `accessLevel` and
-                `PUT /v1/ashares/{_userId}/disable` still toggles `disabled`, but the
-                identity provider's next push overwrites both — change them in the
-                IdP. SCIM never sets `integrationAccessLevel`, so integration-level
-                grants made here stay.
+                On workspace records, present only when the identity provider
+                manages the user through SCIM; every other workspace record omits
+                the field, so an invited workspace user has no value here rather
+                than `invite`. End-user records (`userType=end-user`) always carry
+                it. The identity provider owns a SCIM-managed user's account-wide
+                access level and active state: `PUT /v1/ashares/{_id}` still accepts
+                a new `accessLevel` and `PUT /v1/ashares/{_userId}/disable` still
+                toggles `disabled`, but the identity provider's next push overwrites
+                both — change them in the IdP. SCIM never sets
+                `integrationAccessLevel`, so integration-level grants made here stay.
             externalId:
               type: string
               readOnly: true
@@ -901,6 +1040,37 @@ components:
               description: |-
                 SSO client whose SCIM configuration provisioned this record. Present
                 only when `provisionedBy` is `scim`.
+            resourceGrants:
+              type: array
+              readOnly: true
+              description: |-
+                Present only on end-user records (`userType=end-user`): the MCP
+                server grants held directly by the end user, in addition to any
+                group- or role-derived access. Replace them with the End Users
+                body on `PUT /v1/ashares/{_ashareId}`.
+              items:
+                $ref: '#/components/schemas/ResourceGrant'
+            groupMemberships:
+              type: array
+              readOnly: true
+              description: |-
+                Present only on end-user records that belong to at least one
+                group. Each entry names the group and whether an administrator or
+                the identity provider created the membership.
+              items:
+                $ref: '#/components/schemas/GroupMembership'
+            _groupIds:
+              type: array
+              readOnly: true
+              description: |-
+                Group ids from `groupMemberships`, flattened for quick filtering.
+                Present exactly when `groupMemberships` is.
+              items:
+                type: string
+                format: objectId
+                x-celigo-refModel: groups
+                examples:
+                  - 6abf4dd8fa3e52974f9f1d7a
             sharedWithUser:
               type: object
               readOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.95",
+  "version": "0.2.96",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "cb3fa5ae",
+		"iasCommit": "545ed6c7",
 		"generatedAt": "2026-10-12"
 	},
 	"roots": {