Managing Users

<!-- TIER:1 -->

Managing Users

A user (internally called an "ashare") represents a person's access grant to a Celigo account, defining what they can see and do. Concerns when managing users:

• Access strategy -- choosing between account-wide access (administrator, manage, monitor) and per-integration access for least-privilege control
• Integration-level permissions -- granting manage or monitor access to specific integrations, optionally combined with account-wide monitor as a baseline
• Security enforcement -- requiring MFA or SSO per user to meet compliance requirements
• Feature flags -- controlling access to APIM features and whether monitor-level users can edit retry data
• Lifecycle -- inviting, disabling, and removing users as team composition changes

Users are an account administration concern, not a flow or integration resource.

Access Strategies

There are four strategies for granting access. Choose based on the principle of least privilege.

Administrator

Full account administration. Can edit all resources, manage users, and change account settings. Cannot transfer ownership or manage owner permissions.

Manage (Account-Wide)

Can edit all integrations and resources. Cannot view or edit account settings, invite users, or manage other users.

Monitor (Account-Wide)

Read-only plus operational access. Can view all integrations, run flows, and troubleshoot errors (retry/resolve). Cannot modify configurations, enable/disable flows, or view connections and API tokens. Optionally grant allowToEditRetryData so monitor users can edit retry payloads.

Integration-Only (Custom)

No account-wide accessLevel. Access is granted per-integration via integrationAccessLevel[], each entry specifying an integration ID and either monitor or manage. The user sees only the integrations they are granted.

A common hybrid pattern: set accessLevel: monitor for baseline read-only access across all integrations, then use integrationAccessLevel to grant manage for specific integrations the user owns.

Effective Permissions

A user's effective permissions are the union of both fields. On any integration granted by both, the higher level wins (manage over monitor). Account-wide accessLevel also covers every integration created later, whereas integrationAccessLevel[] applies only to the integrations explicitly listed and must be extended by hand as new integrations are added. In the UI these composed shapes surface as Monitor all (account-wide monitor), Manage all (account-wide manage), and Custom (per-integration only).

Manage vs Monitor: Exact Allowances

The same two levels apply at both the account-wide and per-integration scopes. On the integrations each covers:

• Manage -- create, view, modify, and delete the integration's resources (connections, flows, exports, imports, APIs, Tools, scripts, lookup caches) and troubleshoot errors (retry, resolve, edit retry data, view error history). Cannot view or edit account-wide settings or API tokens (those stay with administrators and the owner).
• Monitor -- view resources (read-only on configuration), run flows on demand, and retry/resolve errored records. By default cannot edit the retry-data payload being retried (grant allowToEditRetryData to allow it), cannot modify resource definitions, cannot enable/disable flows, and cannot change settings.

Quick Reference

Access Strategy Decision Matrix

Minimum Required Fields

Inviting a user requires at minimum:

• email -- the user's email address (the only required field)
• One of: accessLevel or integrationAccessLevel (technically optional; omitting both creates a user with no access)

Schema Index

All schemas are in references/schemas/:

• Invite fields: invite-request.yml -- POST /v1/invite body
• Update fields: request.yml -- PUT /v1/ashares/{id} body (accessLevel, integrationAccessLevel, MFA/SSO, feature flags)
• Response shape: response.yml -- includes accepted, dismissed, lastSignIn, sharedWithUser embedded object

Related Skills

• troubleshooting-flows > Diagnostic Workflow -- users with monitor access troubleshoot errors here
• building-flows > How to Build a Flow -- understanding what manage vs monitor users can do with flows
• building-apis > Quick Reference -- APIM access controlled by allowAccessToAPIM flag

<!-- TIER:2 -->

How to Manage Users

1. Audit current users

Before inviting or changing permissions, understand the current state:

# List all users in the account
celigo users list

# Get details for a specific user
celigo users get <id>

Review accessLevel, integrationAccessLevel, accepted (pending invitations), and disabled status.

2. Decide the access strategy

Use the Access Strategy Decision Matrix to determine the right level. Key considerations:

• Start with the least privilege needed. Integration-only access is safest for users who only work with specific integrations.
• Monitor + selective manage is the most common hybrid -- the user sees everything but can only edit their integrations.
• Administrator should be rare. Only for users who need to manage account settings and other users.

3. Invite a new user

Use the invite command (there is no users create -- invitations are the only way to add users):

# Account-wide access
celigo users invite --email user@example.com --access-level monitor

# Integration-only access
celigo users invite --email user@example.com --integration <intId1>=manage --integration <intId2>=monitor

# Monitor baseline + manage for specific integrations
celigo users invite --email user@example.com --access-level monitor --integration <intId>=manage

# With security enforcement
celigo users invite --email user@example.com --access-level manage --force-mfa
celigo users invite --email user@example.com --access-level manage --force-sso

4. Update permissions for an existing user

Use set for simple field changes or update for full replacement:

# Change access level
celigo users set <id> accessLevel=manage

# Enable MFA requirement
celigo users set <id> accountMFARequired=true

# Grant APIM access
celigo users set <id> allowAccessToAPIM=true

# Allow monitor user to edit retry data
celigo users set <id> allowToEditRetryData=true

# Full update (GET + modify + PUT for complex changes like integrationAccessLevel)
celigo users get <id> > user.json
# Edit user.json to add/modify integrationAccessLevel array
celigo users update <id> < user.json

5. Disable or remove a user

# Disable a user (preserves record, blocks access)
celigo users set <id> disabled=true

# Re-enable a disabled user
celigo users set <id> disabled=false

# Permanently remove a user from the account
celigo users delete <id>

Disabling is preferred over deleting when you may need to restore access later.

Celigo Support Access