> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/groups.md).

# Groups

Groups bundle roles and resource grants so end-user access can be managed collectively. End users receive a group's access through membership, added manually or synced from an identity provider's group claims.

### Group schema

## The Group object

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"components":{"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider's group claims. Maintained by the server —\nIdP-synced memberships cannot be removed through the group members\nAPI."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource.","items":{"type":"string","description":"Capability string. For `mcpServer` grants: `tool:all`,\n`tool:<24-char-hex-id>` (an IO tool `_toolId` or attached prompt `_id`),\n`api:all`, `api:<24-char-hex-apiId>`, or\n`pset:<24-char-hex-permissionSetId>` referencing a permission set\ndefined on the target MCP server."}}}}}}}
```

## List groups

> Returns all active groups in the account. Requires account owner or\
> administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider's group claims. Maintained by the server —\nIdP-synced memberships cannot be removed through the group members\nAPI."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource.","items":{"type":"string","description":"Capability string. For `mcpServer` grants: `tool:all`,\n`tool:<24-char-hex-id>` (an IO tool `_toolId` or attached prompt `_id`),\n`api:all`, `api:<24-char-hex-apiId>`, or\n`pset:<24-char-hex-permissionSetId>` referencing a permission set\ndefined on the target MCP server."}}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups":{"get":{"summary":"List groups","operationId":"listGroups","tags":["Groups"],"description":"Returns all active groups in the account. Requires account owner or\nadministrator access.","responses":{"200":{"description":"List of groups.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Group"}}}}},"204":{"description":"No groups exist in the account."},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"}}}}}}
```

## Create a group

> Creates a group for end-user access management. Group names must be\
> unique within the account (case-insensitive), and any \`\_roleIds\` or\
> \`resourceGrants.\_resourceId\` values must reference resources owned by\
> the same account. Requires account owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupRequest":{"type":"object","description":"Writable fields for creating or replacing a group.","required":["name"],"properties":{"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles to pin to this group. Must reference roles owned by the same account.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants to attach directly to the group. `_resourceId` values must reference resources owned by the same account.","items":{"$ref":"#/components/schemas/ResourceGrant"}}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource.","items":{"type":"string","description":"Capability string. For `mcpServer` grants: `tool:all`,\n`tool:<24-char-hex-id>` (an IO tool `_toolId` or attached prompt `_id`),\n`api:all`, `api:<24-char-hex-apiId>`, or\n`pset:<24-char-hex-permissionSetId>` referencing a permission set\ndefined on the target MCP server."}}}},"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider's group claims. Maintained by the server —\nIdP-synced memberships cannot be removed through the group members\nAPI."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups":{"post":{"summary":"Create a group","operationId":"createGroup","tags":["Groups"],"description":"Creates a group for end-user access management. Group names must be\nunique within the account (case-insensitive), and any `_roleIds` or\n`resourceGrants._resourceId` values must reference resources owned by\nthe same account. Requires account owner or administrator access.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupRequest"}}}},"responses":{"201":{"description":"Group created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"409":{"description":"A group with this name already exists in the account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get a group

> Retrieves a single group by ID.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider's group claims. Maintained by the server —\nIdP-synced memberships cannot be removed through the group members\nAPI."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource.","items":{"type":"string","description":"Capability string. For `mcpServer` grants: `tool:all`,\n`tool:<24-char-hex-id>` (an IO tool `_toolId` or attached prompt `_id`),\n`api:all`, `api:<24-char-hex-apiId>`, or\n`pset:<24-char-hex-permissionSetId>` referencing a permission set\ndefined on the target MCP server."}}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_id}":{"get":{"summary":"Get a group","operationId":"getGroup","tags":["Groups"],"description":"Retrieves a single group by ID.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"responses":{"200":{"description":"Group details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Update a group

> Replaces the group's writable fields. Prefer resending the complete\
> object — omitted fields are not preserved. Requires account owner or\
> administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupRequest":{"type":"object","description":"Writable fields for creating or replacing a group.","required":["name"],"properties":{"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles to pin to this group. Must reference roles owned by the same account.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants to attach directly to the group. `_resourceId` values must reference resources owned by the same account.","items":{"$ref":"#/components/schemas/ResourceGrant"}}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource.","items":{"type":"string","description":"Capability string. For `mcpServer` grants: `tool:all`,\n`tool:<24-char-hex-id>` (an IO tool `_toolId` or attached prompt `_id`),\n`api:all`, `api:<24-char-hex-apiId>`, or\n`pset:<24-char-hex-permissionSetId>` referencing a permission set\ndefined on the target MCP server."}}}},"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider's group claims. Maintained by the server —\nIdP-synced memberships cannot be removed through the group members\nAPI."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_id}":{"put":{"summary":"Update a group","operationId":"updateGroup","tags":["Groups"],"description":"Replaces the group's writable fields. Prefer resending the complete\nobject — omitted fields are not preserved. Requires account owner or\nadministrator access.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupRequest"}}}},"responses":{"200":{"description":"Updated group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"},"409":{"description":"A group with this name already exists in the account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Delete a group

> Soft-deletes the group and removes the corresponding membership entry\
> from every end user in the account. Requires account owner or\
> administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}}},"paths":{"/v1/groups/{_id}":{"delete":{"summary":"Delete a group","operationId":"deleteGroup","tags":["Groups"],"description":"Soft-deletes the group and removes the corresponding membership entry\nfrom every end user in the account. Requires account owner or\nadministrator access.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"responses":{"204":{"description":"Group deleted."},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Add end users to a group

> Bulk-adds up to 100 end users to the group as manual memberships. The\
> operation is idempotent for end users already in the group. Requires\
> account owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupMembersRequest":{"type":"object","description":"End users to add to or remove from the group.","required":["_ashareIds"],"properties":{"_ashareIds":{"type":"array","minItems":1,"maxItems":100,"description":"End-user access-record ids to add or remove.","items":{"type":"string","format":"objectId"}}}},"GroupMembersResponse":{"type":"object","description":"Outcome of a bulk membership change.","properties":{"updated":{"type":"integer","description":"Number of end-user records updated. Members already in (or absent from) the group are not counted."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_groupId}/members":{"post":{"summary":"Add end users to a group","operationId":"addGroupMembers","tags":["Groups"],"description":"Bulk-adds up to 100 end users to the group as manual memberships. The\noperation is idempotent for end users already in the group. Requires\naccount owner or administrator access.","parameters":[{"name":"_groupId","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersRequest"}}}},"responses":{"200":{"description":"Members added.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Remove end users from a group

> Bulk-removes manual memberships from the group. Only manual memberships\
> can be removed this way — attempting to remove an IdP-synced membership\
> returns 409; change the IdP group mapping instead. Uses POST rather than\
> DELETE so the request body survives proxies and CDNs. Requires account\
> owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider's group\nclaims.\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupMembersRequest":{"type":"object","description":"End users to add to or remove from the group.","required":["_ashareIds"],"properties":{"_ashareIds":{"type":"array","minItems":1,"maxItems":100,"description":"End-user access-record ids to add or remove.","items":{"type":"string","format":"objectId"}}}},"GroupMembersResponse":{"type":"object","description":"Outcome of a bulk membership change.","properties":{"updated":{"type":"integer","description":"Number of end-user records updated. Members already in (or absent from) the group are not counted."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_groupId}/members/remove":{"post":{"summary":"Remove end users from a group","operationId":"removeGroupMembers","tags":["Groups"],"description":"Bulk-removes manual memberships from the group. Only manual memberships\ncan be removed this way — attempting to remove an IdP-synced membership\nreturns 409; change the IdP group mapping instead. Uses POST rather than\nDELETE so the request body survives proxies and CDNs. Requires account\nowner or administrator access.","parameters":[{"name":"_groupId","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersRequest"}}}},"responses":{"200":{"description":"Members removed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"},"409":{"description":"One or more of the memberships is IdP-synced and cannot be removed\nmanually. Error code: `conflict`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/api/api-reference/groups.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.