@celigo/api-specs 0.2.97 → 0.2.99

package/dist/flow.yml

@@ -418,7 +418,7 @@ paths:
       summary: Patch a flow
       description: |-
         Partially updates a flow using a JSON Patch document (RFC 6902).
-        Only the `replace` operation is supported, and only on the following
+        `replace`, `add`, and `remove` operations are accepted only on the following
         whitelisted paths:
 
         | Path | Description |
@@ -430,13 +430,12 @@ paths:
         | `/logging/mode` | Logging mode |
         | `/runPageGeneratorsInParallel` | Run page generators in parallel |
         | `/aiDescription` | AI-generated description object |
-        | `/schedule/frequency` | Schedule frequency |
-        | `/schedule/startDate` | Schedule start date |
-        | `/schedule/endDate` | Schedule end date |
-        | `/schedule/days` | Schedule days |
-        | `/schedule/cron` | Cron expression |
+        | `/schedule` | Celigo 6-field cron string (same as PUT `schedule`) |
+        | `/timezone` | IANA timezone string |
 
-        All other paths are rejected with 422.
+        All other paths are rejected with 422, except pointers nested under `/schedule`
+        (such as `/schedule/cron`): `schedule` is a string, so those return 204 and change
+        nothing. Send the whole cron string to `/schedule` instead.
 
         PATCH is safer than PUT for toggling `disabled` or arming debug logging because it won't
         accidentally reset other fields. To arm debug logging, `replace` `/logging/debugUntil` with
@@ -476,11 +475,11 @@ paths:
                     path: /logging/debugUntil
                     value: '2026-05-02T16:00:00.000Z'
               update_schedule:
-                summary: Change schedule frequency
+                summary: Change Celigo 6-field schedule cron
                 value:
                   - op: replace
-                    path: /schedule/frequency
-                    value: 0 */6 * * *
+                    path: /schedule
+                    value: '? 5 0,6,12,18 ? * *'
       responses:
         '204':
           description: Flow patched successfully.
@@ -3814,15 +3813,15 @@ paths:
               preview_import_step:
                 summary: Preview the import step of a one-generator flow
                 value:
-                  flowDoc:
+                  flow:
                     name: 'Accounts: HubSpot to NetSuite'
                     pageGenerators:
                       - _exportId: 652583cf9085040ecbf54303
                     pageProcessors:
                       - type: import
                         _importId: 6508ab8b20b16404da729c64
+                    _selectedPageGeneratorId: 652583cf9085040ecbf54303
                   _pageProcessorId: 6508ab8b20b16404da729c64
-                  _selectedPageGeneratorId: 652583cf9085040ecbf54303
                   pageGeneratorMap:
                     652583cf9085040ecbf54303:
                       doc:
@@ -7797,12 +7796,17 @@ components:
             match keys in the side-loaded maps. Full flow doc shape mirrors
             `POST /v1/flows` body. Accepted under key `flow` despite the
             server's stale `flowDoc` error message.
-          additionalProperties: true
-        flowDoc:
-          type: object
-          description: |-
-            Alias for `flow` — the server appears to accept either key.
-            Prefer `flow`.
+          properties:
+            _selectedPageGeneratorId:
+              type: string
+              format: objectId
+              x-celigo-refModel: exports
+              description: |-
+                Page generator to drive the preview when the flow has multiple.
+                Defaults to `pageGenerators[0]._exportId`. Set it inside `flow`: the
+                server ignores a top-level `_selectedPageGeneratorId`.
+              examples:
+                - 61f92026dd053843b5d72350
           additionalProperties: true
         _pageProcessorId:
           type: string
@@ -7812,14 +7816,6 @@ components:
             in `pageProcessorMap`.
           examples:
             - 64a1234567890abcdef12345
-        _selectedPageGeneratorId:
-          type: string
-          format: objectId
-          description: |-
-            Page generator to drive the preview when the flow has multiple.
-            Defaults to `flow.pageGenerators[0]._exportId`.
-          examples:
-            - 61f92026dd053843b5d72350
         pageGeneratorMap:
           type: object
           description: |-
@@ -7892,7 +7888,7 @@ components:
             the response carries the records the target would receive as input
             (for a lookup step, with its `responseMapping` already merged in).
       required:
-        - flowDoc
+        - flow
         - _pageProcessorId
         - pageGeneratorMap
         - pageProcessorMap

package/dist/iclient.yml

@@ -1160,27 +1160,16 @@ components:
             clientSecret:
               type: string
               description: |-
-                OAuth 2.0 client secret. Returned masked as `"******"`.
-                Re-send that value on update to keep it; it is not preserved if omitted.
+                OAuth 2.0 client secret. Returned masked as `"******"`; re-send that mask
+                on update to keep the stored secret. Required whenever `oauth2` is sent, on
+                create and update: omitting it or sending an empty string fails with 422
+                `missing_required_field` rather than clearing the secret.
               x-celigo-ai-guidance:
                 - |-
-                  ## IMPLEMENTATION GUIDANCE:
-                  - Provide the plain client secret value here to set/update it.
-                  - To keep the existing secret unchanged during an update, omit this field (or, if the API/UI returns a masked value, keep `"******"` as-is).
-                - |-
-                  This is the value you provide to configure or update the iClient.
-                  Internally,
-                  integrator.io stores this secret encrypted at rest (for example as
-                  `clientSecret_crypt` and `clientSecret_salt` fields in the underlying model),
-                  and API responses typically return a masked value (e.g.,
-                  `"******"`) when a secret is already set.
-                - |-
-                  This is the value you provide to configure or update the iClient.
-                  Internally,
-                  integrator.io stores this secret encrypted at rest (for example as
-                  `clientSecret_crypt` and `clientSecret_salt` fields in the underlying model),
-                  and API responses typically return a masked value (e.g.,
-                  `"******"`) when a secret is already set.
+                  Send the plain secret to set or replace it. To keep the stored secret on a
+                  PUT, send "******" (the masked value GET returns). Never omit clientSecret
+                  while sending other oauth2 fields: create and update both fail with 422
+                  missing_required_field on oauth2.clientSecret.
                 - |-
                   This is the value you provide to configure or update the iClient.
                   Internally,

package/dist/marketplace.yml

@@ -48,12 +48,14 @@ paths:
         an integration or an MCP server and therefore which install route to
         call. Entries have no `docType`.
 
-        The whole catalog is returned in one response, sorted by `name` unless
-        `sort_by` says otherwise. Templates that reference an application no
+        Results are sorted by `name` unless `sort_by` says otherwise, and the
+        list may be paginated: follow the `Link` header's `rel="next"` URL until
+        the header is absent. Templates that reference an application no
         longer available on the platform are left out, so this list can be
         shorter than the `docType: Template` subset of
         `POST /v1/published/combined`.
       parameters:
+        - $ref: '#/components/parameters/After'
         - name: sort_by
           in: query
           required: false
@@ -74,6 +76,14 @@ paths:
       responses:
         '200':
           description: Array of Template marketplace entries.
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination links. When more pages remain, includes a
+                `<...>; rel="next"` entry with an `after` cursor; absent on the
+                final page.
+              schema:
+                type: string
           content:
             application/json:
               schema:
@@ -110,7 +120,7 @@ paths:
         '204':
           description: No published templates are available.
         '400':
-          description: '`sort_by` is not one of the accepted keys.'
+          description: '`sort_by` is not one of the accepted keys, or `after` is not a valid pagination cursor.'
           content:
             application/json:
               schema:
@@ -121,6 +131,11 @@ paths:
                     errors:
                       - code: invalid_query_param
                         message: The query parameter "sort_by" has invalid value.
+                invalidCursor:
+                  value:
+                    errors:
+                      - code: invalid_query_param
+                        message: Please provide a valid cursor(i.e after or before query param) to encode or decode.
         '401':
           $ref: '#/components/responses/401-unauthorized'
   /v1/templates/{_id}/preview:
@@ -256,9 +271,22 @@ paths:
         use `POST /v1/published/combined` instead. Entries here have no
         `docType` field -- that discriminator only appears in the combined
         endpoint's response.
+
+        The list may be paginated: follow the `Link` header's `rel="next"` URL
+        until the header is absent.
+      parameters:
+        - $ref: '#/components/parameters/After'
       responses:
         '200':
           description: Array of Integration App (Connector) marketplace entries.
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination links. When more pages remain, includes a
+                `<...>; rel="next"` entry with an `after` cursor; absent on the
+                final page.
+              schema:
+                type: string
           content:
             application/json:
               schema:
@@ -283,6 +311,18 @@ paths:
                       trialEnabled: false
                       lastModified: '2026-04-22T14:23:56.528Z'
                       numInstalls: 1938
+        '400':
+          description: '`after` is not a valid pagination cursor.'
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                invalidCursor:
+                  value:
+                    errors:
+                      - code: invalid_query_param
+                        message: Please provide a valid cursor(i.e after or before query param) to encode or decode.
         '401':
           $ref: '#/components/responses/401-unauthorized'
   /v1/published/combined:
@@ -293,11 +333,12 @@ paths:
         - Marketplace
       summary: List Integration Apps and Templates together
       description: |-
-        Returns a unified array of **all** marketplace content — both Integration
+        Returns a unified array of marketplace content — both Integration
         Apps (`docType: Connector`) and Templates (`docType: Template`). Each
         entry carries the `docType` discriminator so callers can partition, and
         every Template entry also carries `type` (`integration` or `mcpserver`),
-        which decides its install route.
+        which decides its install route. The list may be paginated: follow the
+        `Link` header's `rel="next"` URL until the header is absent.
 
         Despite being a POST, this is a **read-only, safe** endpoint — the body
         is an empty `{}` in the default CLI invocation. POST is used purely to
@@ -308,6 +349,7 @@ paths:
         the body. For Connector-only listings, `GET /v1/published` is
         lighter.
       parameters:
+        - $ref: '#/components/parameters/After'
         - name: sort_by
           in: query
           required: false
@@ -342,6 +384,14 @@ paths:
       responses:
         '200':
           description: Array of marketplace entries, both Connectors and Templates.
+          headers:
+            Link:
+              description: |-
+                RFC 5988 pagination links. When more pages remain, includes a
+                `<...>; rel="next"` entry with an `after` cursor; absent on the
+                final page.
+              schema:
+                type: string
           content:
             application/json:
               schema:
@@ -380,7 +430,7 @@ paths:
         '400':
           description: |-
             Typically `invalid_query_param` when `sort_by` is outside the
-            accepted enum.
+            accepted enum or `after` is not a valid pagination cursor.
           content:
             application/json:
               schema:
@@ -391,6 +441,11 @@ paths:
                     errors:
                       - code: invalid_query_param
                         message: The query parameter "sort_by" has invalid value.
+                invalidCursor:
+                  value:
+                    errors:
+                      - code: invalid_query_param
+                        message: Please provide a valid cursor(i.e after or before query param) to encode or decode.
         '401':
           $ref: '#/components/responses/401-unauthorized'
         '415':
@@ -413,6 +468,16 @@ components:
     bearerAuth:
       type: http
       scheme: bearer
+  parameters:
+    After:
+      name: after
+      in: query
+      required: false
+      description: |-
+        Opaque cursor for forward pagination. Pass the value from the `Link`
+        response header (`rel="next"`) to fetch the next page.
+      schema:
+        type: string
   schemas:
     MarketplaceEntry:
       type: object

package/dist/notification.yml

@@ -203,6 +203,22 @@ paths:
           $ref: '#/components/responses/400-bad-request'
         '401':
           $ref: '#/components/responses/401-unauthorized'
+        '403':
+          description: |-
+            A `subscribedByUserEmail` value matches no user in the account, so the whole
+            request is rejected with `invalid_access`, including items that name valid
+            users. The message mentions monitor access even when the caller has full access.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                unknownEmail:
+                  summary: subscribedByUserEmail matches no account user
+                  value:
+                    errors:
+                      - code: invalid_access
+                        message: You can not subscribe notifications for others with monitor access. Please provide your email address while subscribing.
 components:
   securitySchemes:
     bearerAuth:
@@ -463,7 +479,8 @@ components:
             format: email
             description: |-
               Email of the user whose subscription is being modified. Must match a
-              user in the account — unknown emails are silently ignored (no-op).
+              user in the account: one unknown email fails the entire request with
+              **403** `invalid_access`, not just its own item.
             examples:
               - jane@example.com
         required:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.97",
+  "version": "0.2.99",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "94993951",
+		"iasCommit": "6feafe65",
 		"generatedAt": "2026-10-12"
 	},
 	"roots": {