Celigo Ora CLI

The Celigo Ora CLI is the command-line interface for Celigo integrator.io. Manage integrations, flows, connections, and 30+ resource types from your terminal.

Install

npm install -g @celigo/celigo-cli

Requires Node.js 22+.

Setup

Get a token from integrator.io: Resources (left nav) > API tokens > Create API token. You must be an account admin or owner.

# Create a profile with your token
celigo profile add <name> --api-token <token>

# EU users
celigo profile add <name> --api-token <token> --api-base-url https://api.eu.integrator.io

You can also pass credentials via CELIGO_API_TOKEN / --token. Priority: CLI flag > env var > active profile.

Multiple accounts

celigo profile add <name> --api-token <token>
celigo profile use <name>                   # switch active profile
celigo profile list                         # show all profiles
celigo --profile <name> flows list          # one-off override without switching

Permission modes

Each profile runs in one of three modes. Default is full.

| Mode | Allows | |---|---| | read | GET requests only. All mutations blocked at the HTTP client. | | operate | Read + operational actions (run flows, retry/resolve errors, enable debug, invoke, ping, cancel jobs, etc.). Cannot create/delete resources or restructure flows. set limited to disabled, debugUntil, debugDate, schedule, autoResolveAt, logging.debugUntil. | | full | No gates. |

celigo profile add prod --api-token <token> --mode read
celigo config set mode operate              # change the active profile's mode

See the command tables below for the mode of every command.

Global options

--token <token>      API bearer token (overrides config/env)
--base-url <url>     API base URL (default: https://api.integrator.io)
--profile <name>     Use a named config profile instead of the active one
--format <fmt>       json (default) or table
--jq <expr>          Transform JSON output with a jq expression (bundled)
--verbose            Log every HTTP request to stderr

Examples

# Explore your account
celigo account snapshot
celigo account search "shopify"

# Build a flow (bottom-up: connection → export → import → flow)
celigo connections create < connection.json
celigo exports create < export.json
celigo imports create < import.json
celigo flows create < flow.json

# Modify resources (prefer `set` over `update` — `set` is safe GET+modify+PUT)
celigo flows set <flowId> disabled=false
celigo exports replace-connection <exportId> <newConnectionId>

# Investigate errors
celigo flows error-summary <flowId>
celigo flows error-analyze <flowId> <exportOrImportId>

# Run and monitor
celigo flows run <flowId> -y
celigo jobs current

Commands

Most resources support list, get <id>, create, update <id>, set <id> key=value, and delete <id>. Exceptions: connections and iclients exclude set; environments excludes delete; users excludes create (use invite). Input for create/update is JSON piped via stdin. set supports dot notation (http.relativeURI=/new) and array indexing (pageGenerators[0]._exportId=abc).

| Resource | Description | |---|---| | Core | | | integrations | Integration packages | | flows | Integration flows (pipelines) | | connections | App connections (credentials) | | exports | Data sources | | imports | Data destinations | | Supporting | | | async-helpers | Async polling helpers | | scripts | Custom JavaScript hooks | | stacks | Server / Lambda stacks | | environments | Sandbox / staging environments | | lookup-caches | In-memory key/value stores | | file-definitions | CSV / EDI / fixed-width formats | | edi-profiles | EDI document profiles | | iclients | OAuth2 app registrations | | apis | Custom HTTP endpoints | | tags | Resource tags | | tools | Celigo AI Tools (reusable building blocks) | | mcp-servers | MCP endpoints for AI clients | | agents | AI agents (LLM-powered imports) | | guardrails | AI safety checks (PII, moderation) | | opa | On-premise agents (network gateways) | | B2B | | | edi-transactions | B2B Manager EDI transaction log | | Discovery & Metadata | | | http-connectors | HTTP connector catalog (550+) | | tp-connectors | Trading partner catalog (590+) | | templates | Marketplace templates (340+) | | metadata | Connection metadata (NetSuite, Salesforce, RDBMS) | | Operations | | | jobs | Flow run jobs | | notifications | Notification subscriptions | | Admin | | | users | Account users | | audit | Audit trail | | subscriptions | License and usage | | account | Account-wide operations (snapshot, search, deps, lint) | | account-info | Account metadata |

Command reference

Every command the Celigo Ora CLI exposes, grouped by resource. Each row lists the command, its arguments and options, its minimum permission mode, and any notes you need to use it.

Use celigo --help for the top-level command list or celigo <resource> --help for a resource's commands.

Mode enforcement

set field allow-list in operate mode: disabled, debugUntil, debugDate, schedule, autoResolveAt, logging.debugUntil. Any other field assignment fails before the GET. Switch to full to modify other fields.

Enforcement: read is enforced at the HTTP client (throws before the network call). operate is enforced at the CLI layer (throws before the action runs). full has no gates. Profile/config management commands don't hit the Celigo API and are not mode-gated.

A command's mode is usually obvious from its name. list, get, show, search, errors, logs, debug-requests, preview, current, ping, snapshot* are read. create, update, delete, clone, replace-connection, add-processor, remove-processor, add-generator, remove-generator, invite are full. run, invoke, retry-errors, resolve-errors, debug-enable, debug-disable, test-run, execution-logs-enable/execution-logs-disable, put-data, delete-data, purge-data, cancel, change-token, recycle-token, assign-errors, tag-errors, update-error-data, delete-resolved, subscribe, unsubscribe, authorize are operate.

* account snapshot is read; integrations snapshot is full (it persists a revision).

Standard verbs

Most resources support the same six verbs (exceptions are called out per resource).

| Command | Args / options | Mode | Notes | |---|---|---|---| | <resource> list | | read | Use --format table for a compact view. | | <resource> get <id> | | read | | | <resource> create | stdin JSON | full | Body piped on stdin. | | <resource> update <id> | stdin JSON | full | Full PUT replace — fields you omit are erased. Prefer set. | | <resource> set <id> <key>=<value>... | | operate/full | GET → modify → PUT. Dot/bracket paths: a.b.c, a[0].b. Values parse as JSON first (so null removes, true/false are booleans, JSON literals work). In operate mode, only allow-list fields are accepted. | | <resource> delete <id> | -y | full | Prompts unless -y. |

Profile management

Not mode-gated — these commands don't hit the Celigo API.

| Command | Args / options | Notes | |---|---|---| | profile list | | Show all profiles (marks the active one). | | profile show [name] | | Show a profile's config (tokens redacted). Defaults to the active profile. | | profile add <name> | --api-token, --api-base-url, --default-format, --mode | Create a profile. | | profile use <name> | | Switch the active profile. | | profile delete <name> | | Delete a profile. Cannot delete the active profile. | | profile rename <old> <new> | | Rename a profile. |

Configuration (active profile)

Not mode-gated. Combine with --profile <name> to write to a non-active profile.

| Command | Args / options | Notes | |---|---|---| | config show | | Show all config for the active profile (tokens redacted). | | config get <key> | | Read a single key. | | config set <key> <value> | | Write a key. |

Keys: api_token, base_url, default_format (json | table), mode (read | operate | full).

Core resources

integrations

Containers for flows and other resources.

| Command | Args / options | Mode | Notes | |---|---|---|---| | integrations list | | read | | | integrations get <id> | | read | | | integrations create | stdin JSON | full | | | integrations update <id> | stdin JSON | full | Full PUT replace. | | integrations set <id> <k>=<v>... | | operate/full | | | integrations delete <id> | -y | full | | | integrations clone <id> <environmentId> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). Same-env clones auto-build a self-map; pipe stdin only for cross-env remapping. | | integrations flow-groups <id> | | read | List flow groups (sections). | | integrations flow-group-create <id> <name> | | full | | | integrations flow-group-assign <flowGroupingId> <flowIds...> | | full | | | integrations register-connections <id> <connIds...> | | full | | | integrations deregister-connections <id> <connIds...> | -y | full | | | integrations download <id> | -o <path> | read | Download as ZIP. Default path <name>.zip. Rejects Integration App installations. | | integrations errors <id> | | read | All open errors across the integration. | | integrations assign-errors <id> <email> [errorIds] | -y | operate | Omit errorIds and pass -y to assign all open errors. | | integrations revisions <id> | | read | All revisions (snapshots, pulls, pushes). | | integrations revision <id> <revisionId> | | read | | | integrations snapshot <id> | --description "text" | full | Persists a snapshot revision. | | integrations revision-diff <id> <revisionId> | | read | Only pending revisions (pull, revert) can be diffed. |

flows

Pipelines that move data from source to destination.

| Command | Args / options | Mode | Notes | |---|---|---|---| | flows list | | read | | | flows get <id> | | read | | | flows create | stdin JSON | full | Create with disabled: true and enable only after verification. | | flows update <id> | stdin JSON | full | Full PUT replace. | | flows set <id> <k>=<v>... | | operate/full | | | flows delete <id> | -y | full | | | flows run <id> | --start-date, --end-date, --export-ids, -y | operate | Prompts for confirmation unless -y. | | flows clone <id> <integrationId> <environmentId> | --name <name> (optional), --flow-group <id> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). Same-env clones auto-build a self-map; pipe stdin only for cross-env remapping. | | flows last-export-date <id> | | read | Latest delta checkpoint across all generators. | | flows errors <id> <exportOrImportId> | | read | Open errors for a step. | | flows resolved-errors <id> <exportOrImportId> | | read | | | flows resolve-errors <id> <exportOrImportId> [errorIds] | -y | operate | Omit errorIds to resolve all (use -y). | | flows retry-errors <id> <exportOrImportId> [retryDataKeys] | -y | operate | Omit keys to retry all. | | flows assign-errors <id> <exportOrImportId> <email> [errorIds] | -y | operate | Omit errorIds and pass -y to assign all. | | flows delete-resolved <id> <exportOrImportId> [errorIds] | -y | operate | Operational cleanup of resolved errors. | | flows error-data <id> <exportOrImportId> <retryDataKey> | | read | Retry data for an error. | | flows update-error-data <id> <exportOrImportId> <retryDataKey> | stdin JSON from error-data | operate | | | flows error-request-detail <id> <exportOrImportId> <reqAndResKey> | | read | Full HTTP request/response detail. | | flows tag-errors <id> <exportOrImportId> | stdin JSON: {errors, tagIds} | operate | Tag or untag errors. | | flows error-summary <id> | | read | Per-step error counts. | | flows error-analyze <id> <exportOrImportId> | --limit <n> | read | Groups errors by pattern. | | flows add-processor <id> <exportOrImportId> | --router, --branch, -y | full | Auto-detects export vs import. | | flows remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | flows add-generator <id> <exportId> | --index, --schedule, -y | full | | | flows remove-generator <id> <exportId> | -y | full | | | flows replace-connection <id> <oldConnId> <newConnId> | | full | Swaps the connection across the entire flow. | | flows debug-requests <id> <exportOrImportId> | --since <minutes> | read | Default window 60 min. | | flows debug-request-detail <id> <exportOrImportId> <key> | | read | | | flows test-run <id> | --export <exportId> (required) | operate | Returns metadata, flowJob, childJobs. | | flows test-run-step <id> <runId> <exportOrImportId> | | read | Auto-decodes base64-encoded responses. | | flows test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | flows execution-logs-enable <id> | | operate | PATCHes logging.debugUntil. | | flows execution-logs-disable <id> | | operate | | | flows execution-logs <id> <jobId> | | read | | | flows execution-log-query <id> <jobId> | --export-or-import-id, --group-id, --record-id, --trace-key | read | --trace-key widens results to every step sharing that trace (traceView). | | flows execution-log-data <id> <jobId> | --export-or-import-id, --stage, --group-id, --record-id | read | |

connections

App connections and credentials.

No set command. PUT is a full replace and GET masks encrypted fields with "******", so GET + modify + PUT would overwrite real credentials. update refuses payloads containing masked placeholders; pass --force to submit anyway, or replace the masked values with real credentials (or "" to clear) before calling.

| Command | Args / options | Mode | Notes | |---|---|---|---| | connections list | | read | | | connections get <id> | | read | | | connections create | stdin JSON | full | | | connections update <id> | stdin JSON; --force | full | Full PUT replace; refuses masked placeholders. | | connections delete <id> | -y | full | | | connections ping <id> | | read | Test connectivity. | | connections debug-enable <id> | --duration <minutes> | operate | Default 60 min (max 60). | | connections debug-disable <id> | | operate | | | connections debug-logs <id> | | read | | | connections authorize <id> | --timeout <seconds>, --print-url | operate | Completes OAuth2 in a browser. Default timeout 180s. |

exports

Data sources (e.g. HTTPExport, FTPExport, NetSuiteExport).

| Command | Args / options | Mode | Notes | |---|---|---|---| | exports list | | read | | | exports get <id> | | read | | | exports create | stdin JSON | full | | | exports update <id> | stdin JSON | full | | | exports set <id> <k>=<v>... | | operate/full | | | exports delete <id> | -y | full | | | exports invoke [id] | stdin JSON (for ad-hoc doc); --all | operate | Invoke by ID or pipe a full export doc. --all paginates. | | exports clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | exports replace-connection <id> <newConnId> | | full | | | exports debug-enable <id> | --duration <minutes> | operate | Default 60 min. | | exports debug-disable <id> | | operate | |

imports

Data destinations (e.g. NetSuiteDistributedImport, HTTPImport).

| Command | Args / options | Mode | Notes | |---|---|---|---| | imports list | | read | | | imports get <id> | | read | | | imports create | stdin JSON | full | | | imports update <id> | stdin JSON | full | | | imports set <id> <k>=<v>... | | operate/full | | | imports delete <id> | -y | full | | | imports invoke <id> | stdin JSON records | operate | | | imports clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | imports replace-connection <id> <newConnId> | | full | | | imports debug-enable <id> | --duration <minutes> | operate | Default 60 min. | | imports debug-disable <id> | | operate | |

Supporting resources

async-helpers

Polling configuration for long-running API operations (Amazon SP-API feeds, Salesforce Bulk 2.0, Shopify Bulk). Referenced by exports and imports via _asyncHelperId.

Standard verbs only (list, get, create, update, set, delete).

scripts

Custom JavaScript hooks (preSavePage, preMap, postMap, postSubmit, postResponseMap, filter, transform, handleRequest).

| Command | Args / options | Mode | Notes | |---|---|---|---| | scripts list | | read | | | scripts get <id> | | read | | | scripts create | stdin JSON | full | | | scripts update <id> | stdin JSON | full | | | scripts set <id> <k>=<v>... | | operate/full | | | scripts delete <id> | -y | full | | | scripts logs <id> | --limit, --offset, --level, --start-date, --end-date | read | Execution logs. | | scripts debug-enable <id> | --duration <minutes> | operate | Default 60 min. | | scripts debug-disable <id> | | operate | | | scripts debug-logs <id> | --since <minutes>, --flow-id <flowId> | read | |

stacks

Server and Lambda stacks for custom code.

| Command | Args / options | Mode | Notes | |---|---|---|---| | stacks list | | read | | | stacks get <id> | | read | | | stacks create | stdin JSON | full | | | stacks update <id> | stdin JSON | full | | | stacks set <id> <k>=<v>... | | operate/full | | | stacks delete <id> | -y | full | | | stacks system-token <id> | | read | Show the system token. | | stacks recycle-token <id> | | operate | Rotate the system token. |

environments

Sandbox and staging environments.

No delete command (not supported by the API).

| Command | Args / options | Mode | Notes | |---|---|---|---| | environments list | | read | | | environments get <id> | | read | | | environments create | stdin JSON | full | | | environments update <id> | stdin JSON | full | | | environments set <id> <k>=<v>... | | operate/full | |

lookup-caches

In-memory key/value stores for lookups, deduplication, and cross-reference.

| Command | Args / options | Mode | Notes | |---|---|---|---| | lookup-caches list | | read | | | lookup-caches get <id> | | read | | | lookup-caches create | stdin JSON | full | | | lookup-caches update <id> | stdin JSON | full | | | lookup-caches set <id> <k>=<v>... | | operate/full | | | lookup-caches delete <id> | -y | full | | | lookup-caches put-data <id> | stdin JSON: {"data":[{"key":"k","value":"v"}]} | operate | Upserts entries. Auto-batches when > 1000. Runtime write, not a resource change. | | lookup-caches get-data <id> | stdin JSON (optional): {"keys":[...]} or {"startsWith":"abc"} | read | | | lookup-caches delete-data <id> | stdin JSON: {"keys":["k1","k2"]}; -y | operate | | | lookup-caches purge-data <id> | -y | operate | Wipes all cache data (not the cache resource). |

file-definitions

File format definitions (CSV, EDI, fixed-width, etc.).

Standard verbs only.

edi-profiles

EDI document profiles for trading partners.

Standard verbs only.

iclients

OAuth2 iClients (app registrations shared across connections).

No set command. update uses the same masked-credential guard as connections update — pass --force to submit a payload containing masked placeholders. Global iClients (Google, Slack, etc., managed by Celigo) are read-only and embedded in connector definitions.

| Command | Args / options | Mode | Notes | |---|---|---|---| | iclients list | | read | | | iclients get <id> | | read | | | iclients create | stdin JSON | full | | | iclients update <id> | stdin JSON; --force | full | Refuses masked placeholders unless --force. | | iclients delete <id> | -y | full | |

apis

Custom HTTP endpoints exposed by the account.

| Command | Args / options | Mode | Notes | |---|---|---|---| | apis list | | read | | | apis get <id> | | read | | | apis create | stdin JSON | full | | | apis update <id> | stdin JSON | full | | | apis set <id> <k>=<v>... | | operate/full | | | apis delete <id> | -y | full | | | apis logs <id> | | read | Request logs. | | apis log-detail <id> <key> | | read | Full request/response for a log entry. | | apis clone <id> | --api-version <ver> (required); --name, --description, --environment <envId> | full | Builder-mode only. Refuses script-mode APIs. | | apis add-processor <id> <exportOrImportId> | --router, --branch, -y | full | Auto-detects export vs import. | | apis remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | apis test-run <id> | | operate | | | apis test-run-step <id> <runId> <exportOrImportId> | | read | Auto-decodes base64. | | apis test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | apis debug-requests <id> <exportOrImportId> | --since <minutes> | read | | | apis debug-request-detail <id> <exportOrImportId> <key> | | read | |

tags

Resource tags.

Standard verbs only. create stdin: {"tag": "My Tag"}.

tools

Celigo AI Tools — reusable building blocks callable from flows, APIs, AI agents, MCP servers, and other tools.

| Command | Args / options | Mode | Notes | |---|---|---|---| | tools list | | read | | | tools get <id> | | read | | | tools create | stdin JSON | full | | | tools update <id> | stdin JSON | full | | | tools set <id> <k>=<v>... | | operate/full | | | tools delete <id> | -y | full | | | tools add-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | tools remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | tools test-run <id> | | operate | | | tools test-run-step <id> <runId> <exportOrImportId> | | read | Auto-decodes base64. | | tools test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | tools debug-requests <id> <exportOrImportId> | --since <minutes> | read | | | tools debug-request-detail <id> <exportOrImportId> <key> | | read | |

mcp-servers

MCP endpoints that expose Celigo tools and builder-mode APIs to external AI clients.

Standard verbs only.

agents

LLM-powered import steps (adaptorType: AiAgentImport). The agents command filters and auto-tags the imports endpoint — create forces adaptorType = AiAgentImport.

| Command | Args / options | Mode | Notes | |---|---|---|---| | agents list | | read | Filters imports by adaptorType = AiAgentImport. | | agents get <id> | | read | | | agents create | stdin JSON | full | adaptorType auto-set. | | agents update <id> | stdin JSON | full | | | agents set <id> <k>=<v>... | | operate/full | | | agents delete <id> | -y | full | | | agents invoke <id> | stdin JSON | operate | | | agents debug-enable <id> | --duration <minutes> | operate | | | agents debug-disable <id> | | operate | | | agents clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | agents replace-connection <id> <newConnId> | | full | Replace BYOK connection. |

guardrails

AI safety checks (adaptorType: GuardrailImport) — PII detection, content moderation, custom AI evaluation. Same command surface as agents.

| Command | Args / options | Mode | Notes | |---|---|---|---| | guardrails list | | read | Filters imports by adaptorType = GuardrailImport. | | guardrails get <id> | | read | | | guardrails create | stdin JSON | full | adaptorType auto-set. | | guardrails update <id> | stdin JSON | full | | | guardrails set <id> <k>=<v>... | | operate/full | | | guardrails delete <id> | -y | full | | | guardrails invoke <id> | stdin JSON | operate | | | guardrails debug-enable <id> | --duration <minutes> | operate | | | guardrails debug-disable <id> | | operate | | | guardrails clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | guardrails replace-connection <id> <newConnId> | | full | |

opa

On-premise agents — gateway processes that bridge private networks to integrator.io. (Not to be confused with agents, which are LLM-powered imports.)

| Command | Args / options | Mode | Notes | |---|---|---|---| | opa list | | read | | | opa get <id> | | read | | | opa create | stdin JSON | full | | | opa update <id> | stdin JSON | full | | | opa set <id> <k>=<v>... | | operate/full | | | opa delete <id> | -y | full | | | opa display-token <id> | | read | Show the access token. | | opa change-token <id> | | operate | Rotate the access token. |

B2B

edi-transactions

Query EDI transaction logs from the B2B Manager dashboard.

| Command | Args / options | Mode | Notes | |---|---|---|---| | edi-transactions list | --file-type <X12\|EDIFACT> (default X12), --direction <Inbound\|Outbound>, --document-type, --document-number, --integration <id>, --start-date (default 30 days ago), --end-date, --sandbox, --limit <n> (default 100) | read | Returns X12 or EDIFACT documents with envelope details, functional acknowledgement status, and control numbers. |

See also edi-profiles and file-definitions.

Discovery and metadata

http-connectors

Read-only catalog of 550+ Celigo-managed HTTP connector definitions (endpoints, resources, global iClient refs).

| Command | Args / options | Mode | Notes | |---|---|---|---| | http-connectors list | | read | | | http-connectors get <id> | --full | read | --full includes all endpoints, resources, supportedBy fields, and global iClient refs. | | http-connectors search <query> | | read | Case-insensitive name match. |

tp-connectors

Read-only catalog of 590+ trading partner connector definitions (NetSuite, SAP, Salesforce, etc.).

| Command | Args / options | Mode | Notes | |---|---|---|---| | tp-connectors list | | read | | | tp-connectors get <id> | | read | | | tp-connectors search <query> | | read | |

templates

Marketplace integration templates (340+).

| Command | Args / options | Mode | Notes | |---|---|---|---| | templates list | --type <Template\|Connector>, --include-connectors | read | Sorted by installs. Connectors are excluded by default; --type narrows to one docType, --include-connectors keeps both. | | templates search <query> | --type <Template\|Connector>, --include-connectors | read | Same filtering as list. | | templates preview <id> | --summary, --model <type> | read | --summary shows object type counts; --model filters (Flow, Export, Import, Script, Connection, Integration). |

metadata

Query connection metadata. Auto-detects NetSuite, Salesforce, or RDBMS from the connection.

| Command | Args / options | Mode | Notes | |---|---|---|---| | metadata types <connectionId> | --refresh | read | Record types + saved searches (NS), sObject types (SF), tables (RDBMS). | | metadata fields <connectionId> <entityType> | --refresh | read | Fields for a record type / sObject / table. |

Operations

jobs

Flow run jobs.

| Command | Args / options | Mode | Notes | |---|---|---|---| | jobs get <id> | | read | | | jobs list | --flow, --integration, --export, --import, --type, --status, --created-gte, --created-lte, --started-gte, --started-lte, --limit | read | Historical job query across statuses. At least one filter is recommended — unfiltered responses can be very large. | | jobs current | --sandbox, --integration, --flow, --status | read | Currently running jobs. | | jobs cancel <id> | -y | operate | | | jobs diagnostics <id> | | read | | | jobs files <id> | | read | Signed download URLs for files produced by a job. | | jobs download <id> | --file-id <id>, -o <path> | read | Download a specific file (by s3Key from EDI transactions, etc.) or get signed URLs. | | jobs purge-files <id> | -y | operate | Delete stored files (not the job). | | jobs family <id> | | read | Parent + child jobs. | | jobs latest-flow <flowId> | | read | | | jobs latest-integration <integrationId> | | read | | | jobs errors <id> | --resolved | read | Up to 1000 errors. Pass --resolved to fetch resolved errors instead of open ones. | | jobs run-stats | --sandbox, --integration, --flow, --status | read | Flow run statistics. |

notifications

Notification subscriptions. Not standard CRUD — subscribe/unsubscribe by batch PUT.

| Command | Args / options | Mode | Notes | |---|---|---|---| | notifications list | | read | All subscriptions for the current user. | | notifications subscribe | --user <email>, --flow <id>, --connection <id>, --integration <id> | operate | Subscribe to one or more resources (flags repeatable). | | notifications unsubscribe | --user <email>, --flow <id>, --connection <id>, --integration <id> | operate | |

Admin

users

Account users.

No create command — use invite instead.

| Command | Args / options | Mode | Notes | |---|---|---|---| | users list | | read | | | users get <id> | | read | | | users update <id> | stdin JSON | full | Full PUT replace. | | users set <id> <k>=<v>... | | operate/full | | | users delete <id> | -y | full | Remove a user from the account. | | users invite | --email <email> (required); --access-level <administrator\|manage\|monitor> or --integration <id>=<monitor\|manage> (repeatable); --force-mfa, --force-sso, --allow-edit-retry-data | full | Use --access-level for account-wide access, or --integration (repeat for multiple) for per-integration access. --allow-edit-retry-data only applies with monitor. |

audit

Audit trail.

| Command | Args / options | Mode | Notes | |---|---|---|---| | audit list | --resource-type, --resource-id, --user-id, --source, --action, --start-date, --end-date, --limit | read | Recent audit events. | | audit download | --resource-type + --resource-id (comma-separated accepted), --user-id, --source, --action, --start-date, --end-date | read | Signed URL to download audit CSV (max 20k rows). --resource-type must be paired with --resource-id — the server rejects type-only filters. Omit both to download the full account log. |

subscriptions

License and usage.

| Command | Args / options | Mode | Notes | |---|---|---|---| | subscriptions licenses | | read | License information. | | subscriptions usage | | read | Current usage metrics. | | subscriptions entitlement-usage | | read | Usage by license entitlement. | | subscriptions historical | | read | Historical monthly usage breakdown. | | subscriptions api-usage | | read | API call detail. |

account

Account-wide operations.

| Command | Args / options | Mode | Notes | |---|---|---|---| | account snapshot | | read | Fetches all resources and builds a local index. | | account search <query> | --type <type>, --limit <n> (default 20), --no-refresh | read | Searches the local index. Auto-refreshes if stale (>4h); pass --no-refresh to skip. | | account deps <type> <id> | --direction <uses\|used-by\|both>, --no-refresh | read | Dependency graph. Auto-refreshes stale index. | | account lint | --no-refresh | read | Runs anomaly-detection rules. Auto-refreshes stale index. | | account stats | --no-refresh | read | Resource counts. Auto-refreshes stale index. |

account-info

Account metadata (settings, tokens, applications, data processors, shared accounts, discovery).

| Command | Args / options | Mode | Notes | |---|---|---|---| | account-info settings | | read | Account-wide settings (access level, MFA/SSO). | | account-info profile | | read | Current API token info (returns v1/tokenInfo). | | account-info applications | | read | Applications in use + resource references. | | account-info processors | | read | Available data processor types. | | account-info shared-accounts | | read | Accounts shared with the current user. | | account-info discover | --application <name> | read | In-use applications with resource references. |

OPA vs AI agents

Two different things share the word "agent" in the Celigo platform:

• On-premise agents (OPA) — gateway processes that bridge private networks to integrator.io. Manage with opa.
• AI agents — LLM-powered import steps (adaptorType: AiAgentImport). Manage with agents.