> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/account-and-admin/account.md).

# Account

Endpoints for discovering what the current account has access to.

Resolve a bearer token to the account, credential, and user behind it, list the external applications connected to the account, and manage shared accounts and stacks.

### Token info, shared account and stack share schemas

## The TokenInfo object

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"components":{"schemas":{"TokenInfo":{"type":"object","description":"Identity envelope for the bearer token on the request: the credential kind, the\naccount owner, the user acting through it, and the environment it is bound to.\nRead the account id from `ownerUser._id` and the actor from `byUser`; `_userId` is\nthe user record the token is bound to, which for a token on the production\nenvironment is the account owner.","required":["_userId","token","ownerUser"],"properties":{"_userId":{"type":"string","format":"objectId","description":"User record the token is bound to. For a token on the production environment this\nis the account owner, so it matches both `ownerUser._id` and\n`environment._envUserId`."},"token":{"type":"object","description":"The credential that authenticated the request. Never echoes the secret value.","required":["type"],"properties":{"type":{"type":"string","description":"Credential kind: `service` for an account API token, `agent` for an on-premise\nagent's access token. Read this field rather than inferring the kind from which\nother fields are present."},"_id":{"type":"string","format":"objectId","description":"Record the credential belongs to: the access token for a `service` token, the\non-premise agent (`GET /v1/agents/{_id}`) for an `agent` token."},"name":{"type":"string","description":"Display name of the access token for a `service` token; the agent's name for an\n`agent` token."},"fullAccess":{"type":"boolean","description":"When true, the token has unrestricted access to the account. Present on `service`\ntokens only; `agent` tokens omit it."}}},"ownerUser":{"type":"object","description":"Account (tenant) owner. Use `_id` as the account id.","required":["_id"],"properties":{"_id":{"type":"string","format":"objectId","description":"Account owner's user id, which identifies the account itself."},"email":{"type":"string","format":"email","description":"Account owner's email address."},"name":{"type":"string","description":"Account owner's display name."},"company":{"type":"string","description":"Company name on the owner's profile."}}},"byUser":{"type":"object","description":"User acting through the token. Omitted for `agent` tokens, which act as the account\nitself. For a `service` token created by the account owner this mirrors `ownerUser`\nwith `accessLevel: owner`.","required":["_id"],"properties":{"_id":{"type":"string","format":"objectId","description":"Acting user's id. Equals `ownerUser._id` when the owner is acting."},"email":{"type":"string","format":"email","description":"Acting user's email address."},"name":{"type":"string","description":"Acting user's display name."},"accessLevel":{"type":"string","description":"Acting user's account-wide access level. `owner` when the acting user is the\naccount owner."}}},"environment":{"type":"object","description":"Environment the token is bound to.","required":["name"],"properties":{"_id":{"type":"string","format":"objectId","description":"Environment id, as listed by `GET /v1/environments`."},"name":{"type":"string","description":"Environment display name."},"_envUserId":{"type":"string","format":"objectId","description":"User record that owns this environment's resources: the account owner for the\nproduction environment, a per-environment user for every other environment\n(the same ids `GET /v1/environments` lists)."}}}}}}}}
```

## The SharedAccount object

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"components":{"schemas":{"SharedAccount":{"type":"object","description":"A share record granting the current user access to another user's account.\nThis is the inverse of `GET /v1/ashares`: here the current user is the\nrecipient, and `ownerUser` is who shared.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this share record, not a user or account ID."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nUnaccepted shares appear in the list but cannot be acted on —\naccept one with `PUT /v1/ashares/{_id}/accept`."},"dismissed":{"type":"boolean","description":"When true, the current user declined the invitation. Present only while\ndismissed; the owner can reinvite, which clears it."},"disabled":{"type":"boolean","description":"When true, the owner has suspended the current user's access to the\naccount. Present only while suspended."},"accountSSORequired":{"type":"boolean","description":"When true, the owner requires the current user to sign in through SSO\nfor this account. Present only when the owner has an active SSO client;\nreads true while the owner enforces SSO for every user, even if the\nshare itself does not carry the flag."},"ssoSetupPending":{"type":"boolean","description":"When true, the current user has not yet completed SSO setup with this\nowner, so the SSO-required access is not fully active. Present only\nwhile pending."},"isProductionAdmin":{"type":"boolean","description":"When true, the share grants administrator access to the owner's production environment. Present only when it applies."},"accessLevel":{"type":"string","description":"Account-wide permission level. Mutually exclusive with\n`integrationAccessLevel` when set to `administrator` or `manage`.\nWhen set to `monitor`, per-integration overrides may elevate\nspecific integrations to `manage`. Absent when the user has\nonly per-integration access.","enum":["administrator","manage","monitor","none"]},"integrationAccessLevel":{"type":"array","description":"Per-integration access grants. Ignored when `accessLevel` is\n`administrator` or `manage`. When `accessLevel` is `monitor`,\nelevates specific integrations to `manage`. When `accessLevel`\nis absent, defines the only integrations the user can access.","items":{"type":"object","properties":{"_integrationId":{"type":"string","format":"objectId","description":"Integration this override applies to."},"accessLevel":{"type":"string","enum":["monitor","manage"],"description":"Permission level for this integration."}}}},"ownerUser":{"type":"object","description":"The user who shared their account.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the account owner."},"name":{"type":"string","description":"Display name of the account owner."},"email":{"type":"string","format":"email","description":"Email address of the account owner."}}},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was last updated."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was created."}}}}}}
```

## The StackShare object

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"components":{"schemas":{"StackShare":{"type":"object","description":"A share record granting the current user access to another user's stack.\nThe `_id` here is the share record — the stack's own ID is in `stack._id`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for the share record, not the stack itself."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nThe stack cannot be used until accepted."},"ownerUser":{"type":"object","description":"The user who shared the stack.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the stack owner."},"name":{"type":"string","description":"Display name of the stack owner."},"email":{"type":"string","format":"email","description":"Email address of the stack owner."}}},"stack":{"type":"object","description":"Summary of the shared stack.","properties":{"_id":{"type":"string","format":"objectId","description":"Stack identifier. Fetch full configuration with `GET /v1/stacks/{_id}`."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type."}}}}}}}}
```

## Resolve the current token's identity

> Resolves the bearer token on the request to the account it belongs to, the credential it\
> is, the user acting through it, and the environment it is bound to. Call it with the\
> same token you use for other requests — there is no body and no query parameter.\
> \
> \`token.type\` names the credential kind. An account API token (\`service\`) also reports\
> the acting user in \`byUser\`; an on-premise agent token (\`agent\`) acts as the account\
> itself and omits \`byUser\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"TokenInfo":{"type":"object","description":"Identity envelope for the bearer token on the request: the credential kind, the\naccount owner, the user acting through it, and the environment it is bound to.\nRead the account id from `ownerUser._id` and the actor from `byUser`; `_userId` is\nthe user record the token is bound to, which for a token on the production\nenvironment is the account owner.","required":["_userId","token","ownerUser"],"properties":{"_userId":{"type":"string","format":"objectId","description":"User record the token is bound to. For a token on the production environment this\nis the account owner, so it matches both `ownerUser._id` and\n`environment._envUserId`."},"token":{"type":"object","description":"The credential that authenticated the request. Never echoes the secret value.","required":["type"],"properties":{"type":{"type":"string","description":"Credential kind: `service` for an account API token, `agent` for an on-premise\nagent's access token. Read this field rather than inferring the kind from which\nother fields are present."},"_id":{"type":"string","format":"objectId","description":"Record the credential belongs to: the access token for a `service` token, the\non-premise agent (`GET /v1/agents/{_id}`) for an `agent` token."},"name":{"type":"string","description":"Display name of the access token for a `service` token; the agent's name for an\n`agent` token."},"fullAccess":{"type":"boolean","description":"When true, the token has unrestricted access to the account. Present on `service`\ntokens only; `agent` tokens omit it."}}},"ownerUser":{"type":"object","description":"Account (tenant) owner. Use `_id` as the account id.","required":["_id"],"properties":{"_id":{"type":"string","format":"objectId","description":"Account owner's user id, which identifies the account itself."},"email":{"type":"string","format":"email","description":"Account owner's email address."},"name":{"type":"string","description":"Account owner's display name."},"company":{"type":"string","description":"Company name on the owner's profile."}}},"byUser":{"type":"object","description":"User acting through the token. Omitted for `agent` tokens, which act as the account\nitself. For a `service` token created by the account owner this mirrors `ownerUser`\nwith `accessLevel: owner`.","required":["_id"],"properties":{"_id":{"type":"string","format":"objectId","description":"Acting user's id. Equals `ownerUser._id` when the owner is acting."},"email":{"type":"string","format":"email","description":"Acting user's email address."},"name":{"type":"string","description":"Acting user's display name."},"accessLevel":{"type":"string","description":"Acting user's account-wide access level. `owner` when the acting user is the\naccount owner."}}},"environment":{"type":"object","description":"Environment the token is bound to.","required":["name"],"properties":{"_id":{"type":"string","format":"objectId","description":"Environment id, as listed by `GET /v1/environments`."},"name":{"type":"string","description":"Environment display name."},"_envUserId":{"type":"string","format":"objectId","description":"User record that owns this environment's resources: the account owner for the\nproduction environment, a per-environment user for every other environment\n(the same ids `GET /v1/environments` lists)."}}}}}}},"paths":{"/v1/tokenInfo":{"get":{"operationId":"getTokenInfo","tags":["Account"],"summary":"Resolve the current token's identity","description":"Resolves the bearer token on the request to the account it belongs to, the credential it\nis, the user acting through it, and the environment it is bound to. Call it with the\nsame token you use for other requests — there is no body and no query parameter.\n\n`token.type` names the credential kind. An account API token (`service`) also reports\nthe acting user in `byUser`; an on-premise agent token (`agent`) acts as the account\nitself and omits `byUser`.","responses":{"200":{"description":"Token identity envelope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenInfo"}}}},"401":{"description":"Unauthorized. Unlike other routes, this one answers a missing `Authorization` header\nand an invalid token the same way: a bare text body `Unauthorized` with no\n`Content-Type` header and no `{errors: [...]}` or `{message}` JSON envelope. Key off\nthe HTTP status, not the body.","content":{"text/plain":{"schema":{"type":"string"}}}}}}}}}
```

## List applications in use

> Returns every external application that has at least one connection\
> in the account, grouped with summaries of those connections.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ApplicationsResponse":{"type":"object","description":"List of external applications that have at least one connection in the account.","properties":{"applications":{"type":"array","description":"Applications in use, sorted alphabetically by `_id`.","items":{"$ref":"#/components/schemas/ApplicationUsage"}}}},"ApplicationUsage":{"type":"object","description":"An application and its connections in this account.","properties":{"_id":{"type":"string","description":"Application identifier — a well-known slug like `netsuite` or `shopify`,\na trading-partner code like `3mftp_tp`, or an HTTP-connector ID."},"refs":{"type":"object","description":"Resources tied to this application.","properties":{"connections":{"type":"array","description":"Connection summaries. Fetch `GET /v1/connections/{_id}` for full details.","items":{"type":"object","properties":{"_id":{"type":"string","format":"objectId","description":"Connection identifier."},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the connection was created."}}}}}}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/applications":{"get":{"operationId":"listAccountApplications","tags":["Account"],"summary":"List applications in use","description":"Returns every external application that has at least one connection\nin the account, grouped with summaries of those connections.","responses":{"200":{"description":"Applications in use, each with its connection references.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplicationsResponse"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## List accounts shared with you

> Returns every account that other users have shared with the current\
> user. This is the inverse of \`GET /v1/ashares\`, which lists users\
> who have access to \*your\* account. Respond to a pending invitation\
> with \`PUT /v1/ashares/{\_id}/accept\` or \`PUT /v1/ashares/{\_id}/dismiss\`;\
> leave an account with \`DELETE /v1/shared/ashares/{\_id}\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"SharedAccount":{"type":"object","description":"A share record granting the current user access to another user's account.\nThis is the inverse of `GET /v1/ashares`: here the current user is the\nrecipient, and `ownerUser` is who shared.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this share record, not a user or account ID."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nUnaccepted shares appear in the list but cannot be acted on —\naccept one with `PUT /v1/ashares/{_id}/accept`."},"dismissed":{"type":"boolean","description":"When true, the current user declined the invitation. Present only while\ndismissed; the owner can reinvite, which clears it."},"disabled":{"type":"boolean","description":"When true, the owner has suspended the current user's access to the\naccount. Present only while suspended."},"accountSSORequired":{"type":"boolean","description":"When true, the owner requires the current user to sign in through SSO\nfor this account. Present only when the owner has an active SSO client;\nreads true while the owner enforces SSO for every user, even if the\nshare itself does not carry the flag."},"ssoSetupPending":{"type":"boolean","description":"When true, the current user has not yet completed SSO setup with this\nowner, so the SSO-required access is not fully active. Present only\nwhile pending."},"isProductionAdmin":{"type":"boolean","description":"When true, the share grants administrator access to the owner's production environment. Present only when it applies."},"accessLevel":{"type":"string","description":"Account-wide permission level. Mutually exclusive with\n`integrationAccessLevel` when set to `administrator` or `manage`.\nWhen set to `monitor`, per-integration overrides may elevate\nspecific integrations to `manage`. Absent when the user has\nonly per-integration access.","enum":["administrator","manage","monitor","none"]},"integrationAccessLevel":{"type":"array","description":"Per-integration access grants. Ignored when `accessLevel` is\n`administrator` or `manage`. When `accessLevel` is `monitor`,\nelevates specific integrations to `manage`. When `accessLevel`\nis absent, defines the only integrations the user can access.","items":{"type":"object","properties":{"_integrationId":{"type":"string","format":"objectId","description":"Integration this override applies to."},"accessLevel":{"type":"string","enum":["monitor","manage"],"description":"Permission level for this integration."}}}},"ownerUser":{"type":"object","description":"The user who shared their account.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the account owner."},"name":{"type":"string","description":"Display name of the account owner."},"email":{"type":"string","format":"email","description":"Email address of the account owner."}}},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was last updated."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when this share record was created."}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/ashares":{"get":{"operationId":"listSharedAccounts","tags":["Account"],"summary":"List accounts shared with you","description":"Returns every account that other users have shared with the current\nuser. This is the inverse of `GET /v1/ashares`, which lists users\nwho have access to *your* account. Respond to a pending invitation\nwith `PUT /v1/ashares/{_id}/accept` or `PUT /v1/ashares/{_id}/dismiss`;\nleave an account with `DELETE /v1/shared/ashares/{_id}`.","responses":{"200":{"description":"Array of shared-account entries.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/SharedAccount"}}}}},"204":{"description":"No accounts are shared with the current user."},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## Leave a shared account

> Revokes the current user's own access to an account that was shared with\
> them by deleting the share record. Leaving an administrator share also\
> removes the matching shares in the owner's other environments. The only\
> share a user holds cannot be deleted unless that account requires SSO for\
> the user — dismiss it through \`PUT /v1/ashares/{\_id}/dismiss\` instead. To\
> remove a user from \*your\* account, use \`DELETE /v1/ashares/{\_id}\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}},"schemas":{"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}}},"paths":{"/v1/shared/ashares/{_id}":{"delete":{"operationId":"deleteSharedAccount","tags":["Account"],"summary":"Leave a shared account","description":"Revokes the current user's own access to an account that was shared with\nthem by deleting the share record. Leaving an administrator share also\nremoves the matching shares in the owner's other environments. The only\nshare a user holds cannot be deleted unless that account requires SSO for\nthe user — dismiss it through `PUT /v1/ashares/{_id}/dismiss` instead. To\nremove a user from *your* account, use `DELETE /v1/ashares/{_id}`.","parameters":[{"name":"_id","in":"path","required":true,"description":"Share record id from `GET /v1/shared/ashares`, not a user or account id.","schema":{"type":"string","format":"objectId"}}],"responses":{"204":{"description":"Share record removed; the caller no longer has access to the account."},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"description":"No share with this id is addressed to the caller.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## List stack share invitations

> Returns stack-share records for the current user, including share\
> status, the user who shared, and a stack summary. To list usable\
> stacks directly, use \`GET /v1/shared/stacks\`. Respond to a pending\
> invitation with \`PUT /v1/sshares/{\_id}/accept\` or\
> \`PUT /v1/sshares/{\_id}/dismiss\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"StackShare":{"type":"object","description":"A share record granting the current user access to another user's stack.\nThe `_id` here is the share record — the stack's own ID is in `stack._id`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for the share record, not the stack itself."},"accepted":{"type":"boolean","description":"When true, the current user has accepted the invitation.\nThe stack cannot be used until accepted."},"ownerUser":{"type":"object","description":"The user who shared the stack.","properties":{"_id":{"type":"string","format":"objectId","description":"User ID of the stack owner."},"name":{"type":"string","description":"Display name of the stack owner."},"email":{"type":"string","format":"email","description":"Email address of the stack owner."}}},"stack":{"type":"object","description":"Summary of the shared stack.","properties":{"_id":{"type":"string","format":"objectId","description":"Stack identifier. Fetch full configuration with `GET /v1/stacks/{_id}`."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type."}}}}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/sshares":{"get":{"operationId":"listSharedStacks","tags":["Account"],"summary":"List stack share invitations","description":"Returns stack-share records for the current user, including share\nstatus, the user who shared, and a stack summary. To list usable\nstacks directly, use `GET /v1/shared/stacks`. Respond to a pending\ninvitation with `PUT /v1/sshares/{_id}/accept` or\n`PUT /v1/sshares/{_id}/dismiss`.","responses":{"200":{"description":"Array of stack share entries.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/StackShare"}}}}},"204":{"description":"No stacks are shared with the current user."},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```

## Accept a stack share invitation

> Accepts an invitation to use another user's stack on behalf of the caller.\
> The \`\_id\` is a share record addressed \*to\* the caller — take it from\
> \`GET /v1/shared/sshares\`. Once accepted, the stack appears in\
> \`GET /v1/shared/stacks\` and can be referenced by the caller's hooks and\
> wrappers. Accepting a share that is already accepted changes nothing.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}},"schemas":{"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}}},"paths":{"/v1/sshares/{_id}/accept":{"put":{"operationId":"acceptStackShareInvitation","tags":["Account"],"summary":"Accept a stack share invitation","description":"Accepts an invitation to use another user's stack on behalf of the caller.\nThe `_id` is a share record addressed *to* the caller — take it from\n`GET /v1/shared/sshares`. Once accepted, the stack appears in\n`GET /v1/shared/stacks` and can be referenced by the caller's hooks and\nwrappers. Accepting a share that is already accepted changes nothing.","parameters":[{"name":"_id","in":"path","required":true,"description":"Share record id from `GET /v1/shared/sshares`, not the stack id.","schema":{"type":"string","format":"objectId"}}],"responses":{"204":{"description":"Invitation accepted (or already accepted)."},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"description":"No stack share with this id is addressed to the caller.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Dismiss a stack share invitation

> Declines an invitation to use another user's stack on behalf of the caller.\
> The \`\_id\` is a share record addressed \*to\* the caller — take it from\
> \`GET /v1/shared/sshares\`. The owner can send the invitation again with\
> \`PUT /v1/sshares/{\_id}/reinvite\`. Dismissing a share that is already\
> dismissed changes nothing.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}},"schemas":{"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}}},"paths":{"/v1/sshares/{_id}/dismiss":{"put":{"operationId":"dismissStackShareInvitation","tags":["Account"],"summary":"Dismiss a stack share invitation","description":"Declines an invitation to use another user's stack on behalf of the caller.\nThe `_id` is a share record addressed *to* the caller — take it from\n`GET /v1/shared/sshares`. The owner can send the invitation again with\n`PUT /v1/sshares/{_id}/reinvite`. Dismissing a share that is already\ndismissed changes nothing.","parameters":[{"name":"_id","in":"path","required":true,"description":"Share record id from `GET /v1/shared/sshares`, not the stack id.","schema":{"type":"string","format":"objectId"}}],"responses":{"204":{"description":"Invitation dismissed (or already dismissed)."},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"description":"No stack share with this id is addressed to the caller.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## List available stacks

> Returns every stack the current account can use — both owned and\
> accepted shared stacks. For share metadata (who shared, acceptance\
> status), use \`GET /v1/shared/sshares\`.

```json
{"openapi":"3.2.0","info":{"title":"Account","version":"1.0.0"},"tags":[{"name":"Account","description":"Endpoints for discovering what the current account has access to.\n\nResolve a bearer token to the account, credential, and user behind it, list the\nexternal applications connected to the account, and manage shared accounts and stacks.\n\n## Token info, shared account and stack share schemas\n\n{% openapi-schemas spec=\"account\" schemas=\"TokenInfo,SharedAccount,StackShare\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Stack":{"type":"object","description":"Summary of a stack available to the account, returned by\n`GET /v1/shared/stacks`. For the full stack resource (CRUD,\ndependencies), use `GET /v1/stacks/{_id}`.","properties":{"_id":{"type":"string","format":"objectId","description":"Unique identifier for this stack."},"name":{"type":"string","description":"Display name shown in the UI when selecting a stack."},"type":{"type":"string","enum":["server","lambda"],"description":"Execution environment type that determines which configuration block is present."},"server":{"type":"object","description":"Configuration of a server stack. Present when `type` is `server`.","properties":{"systemToken":{"type":"string","description":"System token for authenticating with the server stack. Masked in\nGET responses."},"hostURI":{"type":"string","format":"uri","description":"Base URI of the server hosting the stack. The platform calls it to\nrun hooks and wrappers."},"ipRanges":{"type":"array","description":"Deprecated and not enforced: the list is stored and returned as\nsent, but no Celigo service checks it. Restrict who can reach the\nserver at the server or its firewall.","items":{"type":"string"}}}},"lambda":{"type":"object","description":"Configuration for the AWS Lambda execution environment. Present when `type` is `lambda`.","properties":{"accessKeyId":{"type":"string","description":"AWS IAM access key ID with permission to invoke the Lambda\nfunction. Masked in GET responses."},"secretAccessKey":{"type":"string","description":"AWS IAM secret access key paired with `accessKeyId`.\nMasked in GET responses."},"awsRegion":{"type":"string","enum":["us-east-1","us-east-2","us-west-1","us-west-2","ap-northeast-2","ap-southeast-1","ap-southeast-2","ap-northeast-1","ap-south-1","eu-central-1","eu-west-1"],"description":"AWS region where the Lambda function is deployed.\nMust match the region used when creating the function."},"functionName":{"type":"string","description":"Exact name of the Lambda function to invoke.\nMust match the function name in your AWS account."},"language":{"type":"string","enum":["Node.js","C#","Java","Other"],"description":"Runtime language the Lambda function is written in.\nControls how the platform serializes payloads sent to the function."}}}},"if":{"properties":{"type":{"const":"server"}}},"then":{"required":["server"]},"else":{"required":["lambda"]}}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/shared/stacks":{"get":{"operationId":"listSharedStackResources","tags":["Account"],"summary":"List available stacks","description":"Returns every stack the current account can use — both owned and\naccepted shared stacks. For share metadata (who shared, acceptance\nstatus), use `GET /v1/shared/sshares`.","responses":{"200":{"description":"Array of stacks (may be empty).","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Stack"}}}}},"401":{"$ref":"#/components/responses/401-unauthorized"}}}}}}
```