Users

Manage user access to a Celigo account. Each record represents a user's access grant, including their access level and invitation status.

Access is controlled at two levels:

• accessLevel — account-wide role (administrator, manage, monitor, etc.)
• integrationAccessLevel — per-integration overrides for finer control.

The account owner is not included — only invited users appear. Users can be disabled (reversible) or permanently removed.

User schema

List users

get

/v1/ashares

Returns all users with access to the account. The account owner is not included — only invited users appear.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

userTypestring · enumOptional

Filter by access-record type. workspace returns the same records as an unfiltered call; end-user always returns 204 because end users are served by the End Users API, not this endpoint.

Possible values:

Responses

200

All users with access to the account.

application/json

A user's access record in the account. Each user who has been invited (or shared access) gets one record per account they belong to. The _id is the access-record id, not the user's own id — the user's identity is in sharedWithUser._id. The account owner does not appear in this list.

disabledbooleanOptional

Set to False to enable a disabled user, or True to maintain disabled

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

Possible values:

accountSSORequiredbooleanOptional

When true, SSO is required for this user in this account.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

_idstring · objectIdRead-onlyRequired

Unique identifier for the resource. Format is a 24-character hexadecimal string.

Example: 5f8d43a1b9e5a80011a35f2c

acceptedbooleanRead-onlyOptional

When true, the user has accepted the invitation to join the account.

userTypestring · enumRead-onlyOptional

Discriminates workspace users from end users on the underlying access-record model. This endpoint only returns workspace records — end users are managed through the End Users API.

Possible values:

lastSignInstring · date-timeRead-onlyOptional

When the user last signed in to this account.

Example: 2026-05-02T17:02:59.370Z

dismissedbooleanRead-onlyOptional

When true, the invitation has been declined by the user.

isProductionAdminbooleanRead-onlyOptional

When true, the user has production-admin privileges in this account.

createdViastring · enumRead-onlyOptional

How this user's access record was created.

Possible values:

ssoSetupPendingbooleanRead-onlyOptional

When true, the user must complete SSO setup for this account before their SSO-required access is fully active. Set by the server during SSO enrollment; cleared by removing the field, so it is never false.

createdAtstring · date-timeRead-onlyRequired

Timestamp when the resource was created. Set automatically and cannot be modified.

Example: 2023-04-01T09:15:32Z

lastModifiedstring · date-timeRead-onlyRequired

Timestamp when the resource was last updated. Changes whenever any property is modified.

Example: 2023-04-15T14:30:15Z

deletedAtstring · nullableRead-onlyOptional

Timestamp when the resource was soft-deleted. When null or absent, the resource is active.

Example: 2023-05-20T11:45:32Z

204

No users exist in the account

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

get/v1/ashares

GET /v1/ashares HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "_id": "6798f4dc43db9184f4bc8ee0",
    "accepted": true,
    "userType": "workspace",
    "accessLevel": "administrator",
    "integrationAccessLevel": [],
    "accountSSORequired": false,
    "accountMFARequired": false,
    "isProductionAdmin": true,
    "allowIntegrationWorkspaceCreation": false,
    "createdVia": "existing_account_invite",
    "lastModified": "2026-05-02T17:02:59.371Z",
    "createdAt": "2025-01-28T15:16:44.327Z",
    "lastSignIn": "2026-05-02T17:02:59.370Z",
    "sharedWithUser": {
      "_id": "624774a6a7574d3ed9f9a5cc",
      "email": "[e-mail]",
      "name": "Account Admin",
      "allowedToResetMFA": false,
      "accountSSOLinked": "not_linked"
    }
  },
  {
    "_id": "690954729ef09ab572f65e5d",
    "accepted": true,
    "userType": "workspace",
    "integrationAccessLevel": [
      {
        "_integrationId": "68f52162f00a35a1b26eaafb",
        "accessLevel": "manage"
      },
      {
        "_integrationId": "6842261335b64c0bcb308e4f",
        "accessLevel": "monitor"
      }
    ],
    "accountSSORequired": false,
    "accountMFARequired": false,
    "allowIntegrationWorkspaceCreation": false,
    "createdVia": "existing_account_invite",
    "lastModified": "2026-04-09T18:48:15.653Z",
    "createdAt": "2025-11-04T01:18:42.025Z",
    "sharedWithUser": {
      "_id": "69095422a6fa76e8c7c170eb",
      "email": "[e-mail]",
      "name": "Integration User",
      "allowedToResetMFA": false,
      "accountSSOLinked": "not_linked"
    }
  }
]

Get a user

get

/v1/ashares/{_id}

Retrieve a single user's access record by its id.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Responses

200

The user record.

application/json

A user's access record in the account. Each user who has been invited (or shared access) gets one record per account they belong to. The _id is the access-record id, not the user's own id — the user's identity is in sharedWithUser._id. The account owner does not appear in this list.

disabledbooleanOptional

Set to False to enable a disabled user, or True to maintain disabled

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

Possible values:

accountSSORequiredbooleanOptional

When true, SSO is required for this user in this account.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

_idstring · objectIdRead-onlyRequired

Unique identifier for the resource. Format is a 24-character hexadecimal string.

Example: 5f8d43a1b9e5a80011a35f2c

acceptedbooleanRead-onlyOptional

When true, the user has accepted the invitation to join the account.

userTypestring · enumRead-onlyOptional

Discriminates workspace users from end users on the underlying access-record model. This endpoint only returns workspace records — end users are managed through the End Users API.

Possible values:

lastSignInstring · date-timeRead-onlyOptional

When the user last signed in to this account.

Example: 2026-05-02T17:02:59.370Z

dismissedbooleanRead-onlyOptional

When true, the invitation has been declined by the user.

isProductionAdminbooleanRead-onlyOptional

When true, the user has production-admin privileges in this account.

createdViastring · enumRead-onlyOptional

How this user's access record was created.

Possible values:

ssoSetupPendingbooleanRead-onlyOptional

When true, the user must complete SSO setup for this account before their SSO-required access is fully active. Set by the server during SSO enrollment; cleared by removing the field, so it is never false.

createdAtstring · date-timeRead-onlyRequired

Timestamp when the resource was created. Set automatically and cannot be modified.

Example: 2023-04-01T09:15:32Z

lastModifiedstring · date-timeRead-onlyRequired

Timestamp when the resource was last updated. Changes whenever any property is modified.

Example: 2023-04-15T14:30:15Z

deletedAtstring · nullableRead-onlyOptional

Timestamp when the resource was soft-deleted. When null or absent, the resource is active.

Example: 2023-05-20T11:45:32Z

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

get/v1/ashares/{_id}

GET /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "_id": "6798f4dc43db9184f4bc8ee0",
  "accepted": true,
  "accessLevel": "administrator",
  "integrationAccessLevel": [],
  "accountSSORequired": false,
  "accountMFARequired": false,
  "isProductionAdmin": true,
  "allowIntegrationWorkspaceCreation": false,
  "createdVia": "existing_account_invite",
  "lastModified": "2026-05-02T17:02:59.371Z",
  "createdAt": "2025-01-28T15:16:44.327Z",
  "lastSignIn": "2026-05-02T17:02:59.370Z",
  "sharedWithUser": {
    "_id": "624774a6a7574d3ed9f9a5cc",
    "email": "[e-mail]",
    "name": "Account Admin",
    "allowedToResetMFA": false,
    "accountSSOLinked": "not_linked"
  }
}

Update a user

put

/v1/ashares/{_id}

Update a user's access level, integration permissions, or account settings. The user's email cannot be changed after invite. To disable a user without deleting, use PUT /v1/ashares/{_id}/disable instead.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Body

Writable fields shared by the request and response schemas.

disabledbooleanOptional

Set to False to enable a disabled user, or True to maintain disabled

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

Possible values:

accountSSORequiredbooleanOptional

When true, SSO is required for this user in this account.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

Responses

204

User updated.

No content

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

put/v1/ashares/{_id}

PUT /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 31

{
  "accessLevel": "administrator"
}

No content

Delete a user

delete

/v1/ashares/{_id}

Remove a user from the current account. This is irreversible — for a reversible alternative, use PUT /v1/ashares/{_id}/disable. Works on both accepted and pending invites.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Responses

204

User removed from the account.

No content

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

delete/v1/ashares/{_id}

DELETE /v1/ashares/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Toggle a user's account access (disable or re-enable)

put

/v1/ashares/{_userId}/disable

Toggles the disabled flag on a user's access record. Call again to re-enable — there is no separate /enable path. Only works on users with accepted: true.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_userIdstring · objectIdRequired

The ashare record _id from GET /v1/ashares — despite the parameter name, this is NOT sharedWithUser._id.

Body

objectOptional

Empty body — the target is identified by the path parameter alone.

Responses

204

User access toggled.

No content

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

User not found.

application/json

put/v1/ashares/{_userId}/disable

PUT /v1/ashares/{_userId}/disable HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Reinvite a user who dismissed their invite

put

/v1/ashares/{_id}/reinvite

Re-sends the invitation to a user who previously dismissed it. Only works on users with dismissed: true in the user record. After reinviting, the user returns to a pending state awaiting acceptance.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

_idstring · objectIdRequired

User access-record id.

Body

objectOptional

Empty body.

Responses

204

Reinvitation sent.

No content

400

User has not dismissed the invite.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

put/v1/ashares/{_id}/reinvite

PUT /v1/ashares/{_id}/reinvite HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Invite users to the account

post

/v1/invite/multiple

Invite one or more users by email. Each entry in the response array corresponds to the email at the same index — check statusCode per entry for partial failures.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

Fields that can be sent when inviting or updating an account user.

disabledbooleanOptional

Set to False to enable a disabled user, or True to maintain disabled

accessLevelstring · enumOptional

Account-level access for the user.

CRITICAL: This controls account-wide access. Choose your strategy:

• Integration-only access: omit accessLevel and specify integrations in integrationAccessLevel
• Account-wide monitoring + selective management: set accessLevel: monitor and use integrationAccessLevel to grant manage access for specific integrations
• Full account access: set accessLevel: manage or accessLevel: administrator and leave integrationAccessLevel undefined/empty

If per-integration level permissions are needed, omit accessLevel and instead populate integrationAccessLevel.

Possible values:

accountSSORequiredbooleanOptional

When true, SSO is required for this user in this account.

accountMFARequiredbooleanOptional

When true, MFA is required for this user in this account.

allowAccessToAPIMbooleanOptional

When true, the user can access API Management (APIM) features for this account.

allowToEditRetryDatabooleanOptional

When true, the user can edit retry data when troubleshooting flow run errors (Error Management).

All users with Monitor access can view, retry, and resolve errant records. This flag controls whether they can also edit the retry data payload. If set to false, the user cannot edit retry data for flow runs in any integration workspace where they only have Monitor access.

This setting only applies when:

• accessLevel is monitor, or
• an entry in integrationAccessLevel grants monitor access for a specific integration.

allowIntegrationWorkspaceCreationbooleanOptional

When true, the user can create integration workspaces.

emailstring · emailOptional

Single email address to invite (use with POST /v1/invite).

Example: [e-mail]

emailsstring · email[]Optional

Email addresses to invite (use with POST /v1/invite/multiple).

Responses

200

Array of results, one per email.

application/json

statusCodeintegerOptional

Per-entry result code. 201 on success, 400 if the user already has access (use PUT /v1/ashares/{_id} to update permissions instead).

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

post/v1/invite/multiple

POST /v1/invite/multiple HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 76

{
  "emails": [
    "[e-mail]",
    "[e-mail]"
  ],
  "accessLevel": "monitor"
}

[
  {
    "statusCode": 201,
    "doc": {
      "_id": "6a02b1869a09438890230ae2",
      "accessLevel": "monitor",
      "integrationAccessLevel": [],
      "lastModified": "2026-05-12T04:50:14.342Z",
      "createdAt": "2026-05-12T04:50:14.330Z",
      "allowIntegrationWorkspaceCreation": false,
      "createdVia": "existing_account_invite",
      "sharedWithUser": {
        "_id": "6a02b1859a09438890230a9f",
        "email": "[e-mail]"
      }
    }
  },
  {
    "statusCode": 201,
    "doc": {
      "_id": "6a02b1869a09438890230aef",
      "accessLevel": "monitor",
      "integrationAccessLevel": [],
      "lastModified": "2026-05-12T04:50:14.355Z",
      "createdAt": "2026-05-12T04:50:14.345Z",
      "allowIntegrationWorkspaceCreation": false,
      "createdVia": "existing_account_invite",
      "sharedWithUser": {
        "_id": "6a02b1859a09438890230aab",
        "email": "[e-mail]"
      }
    }
  }
]