Users

Manage user access to a Celigo account. Each record represents a user's access grant, including their access level and invitation status.

Access is controlled at two levels:

• accessLevel — account-wide role (administrator, manage, monitor, etc.)

• integrationAccessLevel — per-integration overrides for finer control.

The account owner is not included — only invited users appear, plus any the identity provider provisioned through SCIM (provisionedBy: scim). Users can be disabled (reversible) or permanently removed.

User schema

List users

get

/v1/ashares

Returns all users with access to the account. The account owner is not included — only invited users appear.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

userTypestring · enumOptional

Filter by access-record type. workspace returns the same records as an unfiltered call; end-user always returns 204 because end users are served by the End Users API, not this endpoint.

Possible values:

Responses

200

All users with access to the account.

application/json

A user's access record in the account. Each user who has been invited (or shared access), or whom the identity provider provisioned through SCIM, gets one record per account they belong to. The _id is the access-record id, not the user's own id — the user's identity is in sharedWithUser._id on list and invite responses, and in _sharedWithUserId on GET /v1/ashares/{_id}. The account owner does not appear in this list.

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

On update (PUT /v1/ashares/{_id}) the body replaces the access settings: integrationAccessLevel and accountMFARequired are cleared when omitted, so resend them to keep them. accountSSORequired is different — it changes only when the body carries it.

none is written by SCIM provisioning for a user who has no account-wide grant; do not send it yourself — omit accessLevel and use integrationAccessLevel for integration-only access.

Possible values:

accountSSORequiredbooleanOptional

When true, the user must sign in through SSO to access this account. Written only when present in the update body — omitting it on PUT /v1/ashares/{_id} leaves the stored value unchanged. While the account enforces SSO for every user, the value sent is ignored and the stored value is kept until that enforcement is turned off.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account. Cleared when omitted on update — resend it with every PUT /v1/ashares/{_id}.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

_idstring · objectIdRead-onlyRequired

Unique identifier for the resource. Format is a 24-character hexadecimal string.

Example: 5f8d43a1b9e5a80011a35f2c

_sharedWithUserIdstring · objectIdRead-onlyOptional

The user's own account id. Present on GET /v1/ashares/{_id}, which returns the bare record; the list and invite responses expand it into sharedWithUser instead.

Example: 624774a6a7574d3ed9f9a5cc

acceptedbooleanRead-onlyOptional

When true, the user has accepted the invitation to join the account.

disabledbooleanRead-onlyOptional

When true, the user's access to the account is suspended. Changed only by PUT /v1/ashares/{_userId}/disable — a value sent on the update operation is accepted but not applied.

userTypestring · enumRead-onlyOptional

Discriminates workspace users from end users on the underlying access-record model. Reads on this API return only workspace records — end users are managed through the End Users API, which shares the update and disable routes. Sending it back on update is rejected.

Possible values:

lastSignInstring · date-timeRead-onlyOptional

When the user last signed in to this account.

Example: 2026-05-02T17:02:59.370Z

dismissedbooleanRead-onlyOptional

When true, the invitation has been declined by the user.

isProductionAdminbooleanRead-onlyOptional

When true, the user has production-admin privileges in this account.

createdViastring · enumRead-onlyOptional

How this user's access record was created.

Possible values:

ssoSetupPendingbooleanRead-onlyOptional

When true, the user must complete SSO setup for this account before their SSO-required access is fully active. Set by the server during SSO enrollment; cleared by removing the field, so it is never false.

provisionedBystring · enumRead-onlyOptional

Present only on workspace users the identity provider manages through SCIM; every other workspace record omits the field, so an invited user has no value here rather than invite. The identity provider owns a SCIM-managed user's account-wide access level and active state: PUT /v1/ashares/{_id} still accepts a new accessLevel and PUT /v1/ashares/{_userId}/disable still toggles disabled, but the identity provider's next push overwrites both — change them in the IdP. SCIM never sets integrationAccessLevel, so integration-level grants made here stay.

Possible values:

externalIdstringRead-onlyOptional

Identifier the identity provider uses for this person in its own directory, stored when the record is provisioned through SCIM. Present only when provisionedBy is scim. SCIM matches people by email, not by this value.

Example: 00u1a2b3c4d5e6f7g8h9

_scimSsoClientIdstring · objectIdRead-onlyOptional

SSO client whose SCIM configuration provisioned this record. Present only when provisionedBy is scim.

Example: 6a1b2c3d4e5f6a7b8c9d0e1f

createdAtstring · date-timeRead-onlyRequired

Timestamp when the resource was created. Set automatically and cannot be modified.

Example: 2023-04-01T09:15:32Z

lastModifiedstring · date-timeRead-onlyRequired

Timestamp when the resource was last updated. Changes whenever any property is modified.

Example: 2023-04-15T14:30:15Z

deletedAtstring · nullableRead-onlyOptional

Timestamp when the resource was soft-deleted. When null or absent, the resource is active.

Example: 2023-05-20T11:45:32Z

204

No users exist in the account

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

get/v1/ashares

GET /v1/ashares HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "_id": "6798f4dc43db9184f4bc8ee0",
    "accepted": true,
    "userType": "workspace",
    "accessLevel": "administrator",
    "integrationAccessLevel": [],
    "accountSSORequired": false,
    "accountMFARequired": false,
    "isProductionAdmin": true,
    "allowIntegrationWorkspaceCreation": false,
    "createdVia": "existing_account_invite",
    "lastModified": "2026-05-02T17:02:59.371Z",
    "createdAt": "2025-01-28T15:16:44.327Z",
    "lastSignIn": "2026-05-02T17:02:59.370Z",
    "sharedWithUser": {
      "_id": "624774a6a7574d3ed9f9a5cc",
      "email": "[e-mail]",
      "name": "Account Admin",
      "allowedToResetMFA": false,
      "accountSSOLinked": "not_linked"
    }
  },
  {
    "_id": "690954729ef09ab572f65e5d",
    "accepted": true,
    "userType": "workspace",
    "integrationAccessLevel": [
      {
        "_integrationId": "68f52162f00a35a1b26eaafb",
        "accessLevel": "manage"
      },
      {
        "_integrationId": "6842261335b64c0bcb308e4f",
        "accessLevel": "monitor"
      }
    ],
    "accountSSORequired": false,
    "accountMFARequired": false,
    "allowIntegrationWorkspaceCreation": false,
    "createdVia": "existing_account_invite",
    "lastModified": "2026-04-09T18:48:15.653Z",
    "createdAt": "2025-11-04T01:18:42.025Z",
    "sharedWithUser": {
      "_id": "69095422a6fa76e8c7c170eb",
      "email": "[e-mail]",
      "name": "Integration User",
      "allowedToResetMFA": false,
      "accountSSOLinked": "not_linked"
    }
  }
]

Get a user

get

/v1/ashares/{_id}

Retrieve a single user's access record by its id. Returns the bare record: the user is identified by _sharedWithUserId rather than the expanded sharedWithUser the list returns, and isProductionAdmin is not computed. Returns workspace records only — an end-user access-record id is not found here; read those from GET /v1/endusers.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Responses

200

The user record.

application/json

A user's access record in the account. Each user who has been invited (or shared access), or whom the identity provider provisioned through SCIM, gets one record per account they belong to. The _id is the access-record id, not the user's own id — the user's identity is in sharedWithUser._id on list and invite responses, and in _sharedWithUserId on GET /v1/ashares/{_id}. The account owner does not appear in this list.

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

On update (PUT /v1/ashares/{_id}) the body replaces the access settings: integrationAccessLevel and accountMFARequired are cleared when omitted, so resend them to keep them. accountSSORequired is different — it changes only when the body carries it.

none is written by SCIM provisioning for a user who has no account-wide grant; do not send it yourself — omit accessLevel and use integrationAccessLevel for integration-only access.

Possible values:

accountSSORequiredbooleanOptional

When true, the user must sign in through SSO to access this account. Written only when present in the update body — omitting it on PUT /v1/ashares/{_id} leaves the stored value unchanged. While the account enforces SSO for every user, the value sent is ignored and the stored value is kept until that enforcement is turned off.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account. Cleared when omitted on update — resend it with every PUT /v1/ashares/{_id}.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

_idstring · objectIdRead-onlyRequired

Unique identifier for the resource. Format is a 24-character hexadecimal string.

Example: 5f8d43a1b9e5a80011a35f2c

_sharedWithUserIdstring · objectIdRead-onlyOptional

The user's own account id. Present on GET /v1/ashares/{_id}, which returns the bare record; the list and invite responses expand it into sharedWithUser instead.

Example: 624774a6a7574d3ed9f9a5cc

acceptedbooleanRead-onlyOptional

When true, the user has accepted the invitation to join the account.

disabledbooleanRead-onlyOptional

When true, the user's access to the account is suspended. Changed only by PUT /v1/ashares/{_userId}/disable — a value sent on the update operation is accepted but not applied.

userTypestring · enumRead-onlyOptional

Discriminates workspace users from end users on the underlying access-record model. Reads on this API return only workspace records — end users are managed through the End Users API, which shares the update and disable routes. Sending it back on update is rejected.

Possible values:

lastSignInstring · date-timeRead-onlyOptional

When the user last signed in to this account.

Example: 2026-05-02T17:02:59.370Z

dismissedbooleanRead-onlyOptional

When true, the invitation has been declined by the user.

isProductionAdminbooleanRead-onlyOptional

When true, the user has production-admin privileges in this account.

createdViastring · enumRead-onlyOptional

How this user's access record was created.

Possible values:

ssoSetupPendingbooleanRead-onlyOptional

When true, the user must complete SSO setup for this account before their SSO-required access is fully active. Set by the server during SSO enrollment; cleared by removing the field, so it is never false.

provisionedBystring · enumRead-onlyOptional

Present only on workspace users the identity provider manages through SCIM; every other workspace record omits the field, so an invited user has no value here rather than invite. The identity provider owns a SCIM-managed user's account-wide access level and active state: PUT /v1/ashares/{_id} still accepts a new accessLevel and PUT /v1/ashares/{_userId}/disable still toggles disabled, but the identity provider's next push overwrites both — change them in the IdP. SCIM never sets integrationAccessLevel, so integration-level grants made here stay.

Possible values:

externalIdstringRead-onlyOptional

Identifier the identity provider uses for this person in its own directory, stored when the record is provisioned through SCIM. Present only when provisionedBy is scim. SCIM matches people by email, not by this value.

Example: 00u1a2b3c4d5e6f7g8h9

_scimSsoClientIdstring · objectIdRead-onlyOptional

SSO client whose SCIM configuration provisioned this record. Present only when provisionedBy is scim.

Example: 6a1b2c3d4e5f6a7b8c9d0e1f

createdAtstring · date-timeRead-onlyRequired

Timestamp when the resource was created. Set automatically and cannot be modified.

Example: 2023-04-01T09:15:32Z

lastModifiedstring · date-timeRead-onlyRequired

Timestamp when the resource was last updated. Changes whenever any property is modified.

Example: 2023-04-15T14:30:15Z

deletedAtstring · nullableRead-onlyOptional

Timestamp when the resource was soft-deleted. When null or absent, the resource is active.

Example: 2023-05-20T11:45:32Z

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

get/v1/ashares/{_id}

GET /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "_id": "6798f4dc43db9184f4bc8ee0",
  "_sharedWithUserId": "624774a6a7574d3ed9f9a5cc",
  "accepted": true,
  "accessLevel": "administrator",
  "integrationAccessLevel": [],
  "accountSSORequired": false,
  "accountMFARequired": false,
  "allowIntegrationWorkspaceCreation": false,
  "createdVia": "existing_account_invite",
  "lastModified": "2026-05-02T17:02:59.371Z",
  "createdAt": "2025-01-28T15:16:44.327Z",
  "lastSignIn": "2026-05-02T17:02:59.370Z",
  "userType": "workspace"
}

Update a user

put

/v1/ashares/{_id}

Replaces a workspace user's access settings. The body must grant access through accessLevel or a non-empty integrationAccessLevel, and integrationAccessLevel and accountMFARequired are cleared when omitted — send every value to keep. accountSSORequired is the exception: it changes only when the body carries it, and is ignored while the account enforces SSO for every user. disabled is not applied here; toggle it with PUT /v1/ashares/{_userId}/disable. Read-only fields echoed from the GET response are ignored, except userType, which is rejected. The user's email cannot be changed after invite. Callable from the production environment only.

End-user access records share this route with a different body — see the End Users API.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Body

Writable fields shared by the request and response schemas.

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

On update (PUT /v1/ashares/{_id}) the body replaces the access settings: integrationAccessLevel and accountMFARequired are cleared when omitted, so resend them to keep them. accountSSORequired is different — it changes only when the body carries it.

none is written by SCIM provisioning for a user who has no account-wide grant; do not send it yourself — omit accessLevel and use integrationAccessLevel for integration-only access.

Possible values:

accountSSORequiredbooleanOptional

When true, the user must sign in through SSO to access this account. Written only when present in the update body — omitting it on PUT /v1/ashares/{_id} leaves the stored value unchanged. While the account enforces SSO for every user, the value sent is ignored and the stored value is kept until that enforcement is turned off.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account. Cleared when omitted on update — resend it with every PUT /v1/ashares/{_id}.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

Responses

204

User updated.

No content

400

The body grants no access, or echoes the read-only userType.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

403

The call was made from a sandbox environment.

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

422

integrationAccessLevel is empty and no accessLevel was sent.

application/json

put/v1/ashares/{_id}

PUT /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 85

{
  "accessLevel": "administrator",
  "integrationAccessLevel": [],
  "accountMFARequired": true
}

No content

Delete a user

delete

/v1/ashares/{_id}

Remove a user from the current account. This is irreversible — for a reversible alternative, use PUT /v1/ashares/{_id}/disable. Works on both accepted and pending invites.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Responses

204

User removed from the account.

No content

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

delete/v1/ashares/{_id}

DELETE /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Toggle a user's account access (disable or re-enable)

put

/v1/ashares/{_userId}/disable

Toggles the disabled flag on a user's access record. Call again to re-enable — there is no separate /enable path, and this is the only way to change disabled (the update operation does not apply it). A pending invitation cannot be toggled until the invited user accepts or declines it.

End-user access records share this route — see the End Users API.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_userIdstring · objectIdRequired

The ashare record _id from GET /v1/ashares — despite the parameter name, this is NOT sharedWithUser._id.

Body

objectOptional

Empty body — the target is identified by the path parameter alone.

Responses

204

User access toggled.

No content

400

The invitation is still pending.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

User not found.

application/json

put/v1/ashares/{_userId}/disable

PUT /v1/ashares/{_userId}/disable HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Reinvite a user who dismissed their invite

put

/v1/ashares/{_id}/reinvite

Re-sends the invitation to a user who previously dismissed it. Only works on users with dismissed: true in the user record. After reinviting, the user returns to a pending state awaiting acceptance.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Body

objectOptional

Empty body.

Responses

204

Reinvitation sent.

No content

400

User has not dismissed the invite.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

put/v1/ashares/{_id}/reinvite

PUT /v1/ashares/{_id}/reinvite HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Accept an account invitation

put

/v1/ashares/{_id}/accept

Accepts an invitation to another user's account on behalf of the caller. The _id is a share record addressed to the caller — take it from GET /v1/shared/ashares, not from GET /v1/ashares. Pending invitations from the same owner's other environments are accepted with it, and the owner is notified by email. Accepting an invitation that is already accepted changes nothing. A user who still owns integrations, flows, or syncs must transfer or delete them before they can join another account.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

Share record id from GET /v1/shared/ashares.

Example: 612345abcdef6789012345ab

Responses

204

Invitation accepted (or already accepted).

No content

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

No share with this id is addressed to the caller.

application/json

put/v1/ashares/{_id}/accept

PUT /v1/ashares/{_id}/accept HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Dismiss an account invitation

put

/v1/ashares/{_id}/dismiss

Declines an invitation to another user's account on behalf of the caller. The _id is a share record addressed to the caller — take it from GET /v1/shared/ashares. Pending invitations from the same owner's other environments are dismissed with it, and the owner is notified by email; they can send it again with PUT /v1/ashares/{_id}/reinvite. Dismissing an invitation that is already dismissed changes nothing. To leave an account whose invitation you accepted, use DELETE /v1/shared/ashares/{_id}.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

Share record id from GET /v1/shared/ashares.

Example: 612345abcdef6789012345ab

Responses

204

Invitation dismissed (or already dismissed).

No content

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

No share with this id is addressed to the caller.

application/json

put/v1/ashares/{_id}/dismiss

PUT /v1/ashares/{_id}/dismiss HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Invite users to the account

post

/v1/invite/multiple

Invite one or more users by email. Each entry in the response array corresponds to the email at the same index — check statusCode per entry for partial failures.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

Fields that can be sent when inviting or updating an account user.

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

On update (PUT /v1/ashares/{_id}) the body replaces the access settings: integrationAccessLevel and accountMFARequired are cleared when omitted, so resend them to keep them. accountSSORequired is different — it changes only when the body carries it.

none is written by SCIM provisioning for a user who has no account-wide grant; do not send it yourself — omit accessLevel and use integrationAccessLevel for integration-only access.

Possible values:

accountSSORequiredbooleanOptional

When true, the user must sign in through SSO to access this account. Written only when present in the update body — omitting it on PUT /v1/ashares/{_id} leaves the stored value unchanged. While the account enforces SSO for every user, the value sent is ignored and the stored value is kept until that enforcement is turned off.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account. Cleared when omitted on update — resend it with every PUT /v1/ashares/{_id}.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

emailstring · emailOptional

Single email address to invite (use with POST /v1/invite).

Example: [e-mail]

emailsstring · email[]Optional

Email addresses to invite (use with POST /v1/invite/multiple).

Responses

200

Array of results, one per email.

application/json

statusCodeintegerOptional

Per-entry result code. 201 on success, 400 if the user already has access (use PUT /v1/ashares/{_id} to update permissions instead).

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

post/v1/invite/multiple

POST /v1/invite/multiple HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 76

{
  "emails": [
    "[e-mail]",
    "[e-mail]"
  ],
  "accessLevel": "monitor"
}

[
  {
    "statusCode": 201,
    "doc": {
      "_id": "6a02b1869a09438890230ae2",
      "accessLevel": "monitor",
      "integrationAccessLevel": [],
      "lastModified": "2026-05-12T04:50:14.342Z",
      "createdAt": "2026-05-12T04:50:14.330Z",
      "allowIntegrationWorkspaceCreation": false,
      "createdVia": "existing_account_invite",
      "sharedWithUser": {
        "_id": "6a02b1859a09438890230a9f",
        "email": "[e-mail]"
      }
    }
  },
  {
    "statusCode": 201,
    "doc": {
      "_id": "6a02b1869a09438890230aef",
      "accessLevel": "monitor",
      "integrationAccessLevel": [],
      "lastModified": "2026-05-12T04:50:14.355Z",
      "createdAt": "2026-05-12T04:50:14.345Z",
      "allowIntegrationWorkspaceCreation": false,
      "createdVia": "existing_account_invite",
      "sharedWithUser": {
        "_id": "6a02b1859a09438890230aab",
        "email": "[e-mail]"
      }
    }
  }
]