> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/account.md).

# Account

Endpoints for discovering what the current account has access to.

Resolve a bearer token to a user, list the external applications connected to the account, and manage shared accounts and stacks.

### Shared account and stack share schemas

## The SharedAccount object

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"components":{"schemas":{"SharedAccount":{"type":"object","description":"A share record granting the current user access to another user's account.\nThis is the inverse of `GET /v1/ashares`: here the current user is the\nrecipient, and `ownerUser` is who shared.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this share record, not a user or account ID."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nUnaccepted shares appear in the list but cannot be acted on."},"accessLevel":{"type":"string","description":"Account-wide permission level. Mutually exclusive with\n`integrationAccessLevel` when set to `administrator` or `manage`.\nWhen set to `monitor`, per-integration overrides may elevate\nspecific integrations to `manage`. Absent when the user has\nonly per-integration access.","enum":["administrator","manage","monitor"]},"integrationAccessLevel":{"type":"array","description":"Per-integration access grants. Ignored when `accessLevel` is\n`administrator` or `manage`. When `accessLevel` is `monitor`,\nelevates specific integrations to `manage`. When `accessLevel`\nis absent, defines the only integrations the user can access.","items":{"type":"object","properties":{"_integrationId":{"type":"string","format":"objectId","description":"Integration this override applies to."},"accessLevel":{"type":"string","enum":["monitor","manage"],"description":"Permission level for this integration."}}}},"ownerUser":{"type":"object","description":"The user who shared their account.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the account owner."},"name":{"type":"string","description":"Display name of the account owner."},"email":{"type":"string","format":"email","description":"Email address of the account owner."}}},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was last updated."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was created."}}}}}}
```

## The StackShare object

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"components":{"schemas":{"StackShare":{"type":"object","description":"A share record granting the current user access to another user's stack.\nThe `_id` here is the share record — the stack's own ID is in `stack._id`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for the share record, not the stack itself."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nThe stack cannot be used until accepted."},"ownerUser":{"type":"object","description":"The user who shared the stack.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the stack owner."},"name":{"type":"string","description":"Display name of the stack owner."},"email":{"type":"string","format":"email","description":"Email address of the stack owner."}}},"stack":{"type":"object","description":"Summary of the shared stack.","properties":{"_id":{"type":"string","format":"objectId","description":"Stack identifier. Fetch full configuration with `GET /v1/stacks/{_id}`."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type."}}}}}}}}
```

## Identify the current token's owner

> Resolves a bearer token to the user it authenticates as.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to a user, list the external applications connected\nto the account, and manage shared accounts and stacks.\n\n## Shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/tokenInfo":{"get":{"operationId":"getTokenInfo","tags":["Account"],"summary":"Identify the current token's owner","description":"Resolves a bearer token to the user it authenticates as.","responses":{"200":{"description":"Token identity.","content":{"application/json":{"schema":{"type":"object","properties":{"_userId":{"type":"string","format":"objectId","description":"User this token authenticates as."}}}}}},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## List applications in use

> Returns every external application that has at least one connection\
> in the account, grouped with summaries of those connections.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to a user, list the external applications connected\nto the account, and manage shared accounts and stacks.\n\n## Shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ApplicationsResponse":{"type":"object","description":"List of external applications that have at least one connection in the account.","properties":{"applications":{"type":"array","description":"Applications in use, sorted alphabetically by `_id`.","items":{"$ref":"#/components/schemas/ApplicationUsage"}}}},"ApplicationUsage":{"type":"object","description":"An application and its connections in this account.","properties":{"_id":{"type":"string","description":"Application identifier — a well-known slug like `netsuite` or `shopify`,\na trading-partner code like `3mftp_tp`, or an HTTP-connector ID."},"refs":{"type":"object","description":"Resources tied to this application.","properties":{"connections":{"type":"array","description":"Connection summaries. Fetch `GET /v1/connections/{_id}` for full details.","items":{"type":"object","properties":{"_id":{"type":"string","format":"objectId","description":"Connection identifier."},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the connection was created."}}}}}}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/applications":{"get":{"operationId":"listAccountApplications","tags":["Account"],"summary":"List applications in use","description":"Returns every external application that has at least one connection\nin the account, grouped with summaries of those connections.","responses":{"200":{"description":"Applications in use, each with its connection references.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplicationsResponse"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## List accounts shared with you

> Returns every account that other users have shared with the current\
> user. This is the inverse of \`GET /v1/ashares\`, which lists users\
> who have access to \*your\* account.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to a user, list the external applications connected\nto the account, and manage shared accounts and stacks.\n\n## Shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"SharedAccount":{"type":"object","description":"A share record granting the current user access to another user's account.\nThis is the inverse of `GET /v1/ashares`: here the current user is the\nrecipient, and `ownerUser` is who shared.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this share record, not a user or account ID."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nUnaccepted shares appear in the list but cannot be acted on."},"accessLevel":{"type":"string","description":"Account-wide permission level. Mutually exclusive with\n`integrationAccessLevel` when set to `administrator` or `manage`.\nWhen set to `monitor`, per-integration overrides may elevate\nspecific integrations to `manage`. Absent when the user has\nonly per-integration access.","enum":["administrator","manage","monitor"]},"integrationAccessLevel":{"type":"array","description":"Per-integration access grants. Ignored when `accessLevel` is\n`administrator` or `manage`. When `accessLevel` is `monitor`,\nelevates specific integrations to `manage`. When `accessLevel`\nis absent, defines the only integrations the user can access.","items":{"type":"object","properties":{"_integrationId":{"type":"string","format":"objectId","description":"Integration this override applies to."},"accessLevel":{"type":"string","enum":["monitor","manage"],"description":"Permission level for this integration."}}}},"ownerUser":{"type":"object","description":"The user who shared their account.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the account owner."},"name":{"type":"string","description":"Display name of the account owner."},"email":{"type":"string","format":"email","description":"Email address of the account owner."}}},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was last updated."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was created."}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/ashares":{"get":{"operationId":"listSharedAccounts","tags":["Account"],"summary":"List accounts shared with you","description":"Returns every account that other users have shared with the current\nuser. This is the inverse of `GET /v1/ashares`, which lists users\nwho have access to *your* account.","responses":{"200":{"description":"Array of shared-account entries.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/SharedAccount"}}}}},"204":{"description":"No accounts are shared with the current user."},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## List stack share invitations

> Returns stack-share records for the current user, including share\
> status, the user who shared, and a stack summary. To list usable\
> stacks directly, use \`GET /v1/shared/stacks\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to a user, list the external applications connected\nto the account, and manage shared accounts and stacks.\n\n## Shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"StackShare":{"type":"object","description":"A share record granting the current user access to another user's stack.\nThe `_id` here is the share record — the stack's own ID is in `stack._id`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for the share record, not the stack itself."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nThe stack cannot be used until accepted."},"ownerUser":{"type":"object","description":"The user who shared the stack.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the stack owner."},"name":{"type":"string","description":"Display name of the stack owner."},"email":{"type":"string","format":"email","description":"Email address of the stack owner."}}},"stack":{"type":"object","description":"Summary of the shared stack.","properties":{"_id":{"type":"string","format":"objectId","description":"Stack identifier. Fetch full configuration with `GET /v1/stacks/{_id}`."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type."}}}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/sshares":{"get":{"operationId":"listSharedStacks","tags":["Account"],"summary":"List stack share invitations","description":"Returns stack-share records for the current user, including share\nstatus, the user who shared, and a stack summary. To list usable\nstacks directly, use `GET /v1/shared/stacks`.","responses":{"200":{"description":"Array of stack share entries.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/StackShare"}}}}},"204":{"description":"No stacks are shared with the current user."},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## List available stacks

> Returns every stack the current account can use — both owned and\
> accepted shared stacks. For share metadata (who shared, acceptance\
> status), use \`GET /v1/shared/sshares\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to a user, list the external applications connected\nto the account, and manage shared accounts and stacks.\n\n## Shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Stack":{"type":"object","description":"Summary of a stack available to the account, returned by\n`GET /v1/shared/stacks`. For the full stack resource (CRUD,\ndependencies), use `GET /v1/stacks/{_id}`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this stack."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type that determines which configuration block is present."},"server":{"type":"object","description":"Configuration for the on-premise agent process. Present when `type` is `server`.","properties":{"systemToken":{"type":"string","description":"Token the on-premise agent uses to authenticate with the\nCeligo platform. Masked in GET responses."},"hostURI":{"type":"string","format":"uri","description":"Base URL where the on-premise agent is reachable.\nThe platform sends integration traffic to this address."},"ipRanges":{"type":"array","description":"CIDR ranges allowed to connect to the agent. Requests from\nIPs outside these ranges are rejected.","items":{"type":"string"}}}},"lambda":{"type":"object","description":"Configuration for the AWS Lambda execution environment. Present when `type` is `lambda`.","properties":{"accessKeyId":{"type":"string","description":"AWS IAM access key ID with permission to invoke the Lambda\nfunction. Masked in GET responses."},"secretAccessKey":{"type":"string","description":"AWS IAM secret access key paired with `accessKeyId`.\nMasked in GET responses."},"awsRegion":{"type":"string","enum":["us-east-1","us-east-2","us-west-1","us-west-2","ap-northeast-2","ap-southeast-1","ap-southeast-2","ap-northeast-1","ap-south-1","eu-central-1","eu-west-1"],"description":"AWS region where the Lambda function is deployed.\nMust match the region used when creating the function."},"functionName":{"type":"string","description":"Exact name of the Lambda function to invoke.\nMust match the function name in your AWS account."},"language":{"type":"string","enum":["Node.js","C#","Java","Other"],"description":"Runtime language the Lambda function is written in.\nControls how the platform serializes payloads sent to the function."}}}},"if":{"properties":{"type":{"const":"server"}}},"then":{"required":["server"]},"else":{"required":["lambda"]}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/stacks":{"get":{"operationId":"listSharedStackResources","tags":["Account"],"summary":"List available stacks","description":"Returns every stack the current account can use — both owned and\naccepted shared stacks. For share metadata (who shared, acceptance\nstatus), use `GET /v1/shared/sshares`.","responses":{"200":{"description":"Array of stacks (may be empty).","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Stack"}}}}},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/api/api-reference/account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.