Celigo CLI

The Celigo CLI is the command-line interface for Celigo integrator.io. Manage integrations, flows, connections, and 30+ resource types from your terminal.

Install

npm install -g @celigo/celigo-cli

Requires Node.js 22+.

Setup

Get a token from integrator.io: Resources (left nav) > API tokens > Create API token. You must be an account admin or owner.

# Create a profile with your token
celigo profile add <name> --api-token <token>

# EU users
celigo profile add <name> --api-token <token> --api-base-url https://api.eu.integrator.io

You can also pass credentials via CELIGO_API_TOKEN / --token. Priority: CLI flag > env var > active profile.

Multiple accounts

celigo profile add <name> --api-token <token>
celigo profile use <name>                   # switch active profile
celigo profile list                         # show all profiles
celigo --profile <name> flows list          # one-off override without switching

Permission modes

Each profile runs in one of three modes. Default is full.

| Mode | Allows | |---|---| | read | GET requests only. All mutations blocked at the HTTP client. | | operate | Read + operational actions (run flows, retry/resolve errors, enable debug, invoke, ping, cancel jobs, etc.). Cannot create/delete resources or restructure flows. set limited to disabled, debugUntil, debugDate, schedule, autoResolveAt, logging.debugUntil. | | full | No gates. |

celigo profile add prod --api-token <token> --mode read
celigo config set mode operate              # change the active profile's mode

See the command tables below for the mode of every command.

Global options

--token <token>      API bearer token (overrides config/env)
--base-url <url>     API base URL (default: https://api.integrator.io)
--profile <name>     Use a named config profile instead of the active one
--format <fmt>       json (default) or table
--jq <expr>          Transform JSON output with a jq expression (bundled)
--verbose            Log every HTTP request to stderr

Examples

# Explore your account
celigo account snapshot
celigo account search "shopify"

# Build a flow (bottom-up: connection → export → import → flow)
celigo connections create < connection.json
celigo exports create < export.json
celigo imports create < import.json
celigo flows create < flow.json

# Modify resources (prefer `set` over `update` — `set` is safe GET+modify+PUT)
celigo flows set <flowId> disabled=false
celigo exports replace-connection <exportId> <newConnectionId>

# Investigate errors
celigo flows error-summary <flowId>
celigo flows error-analysis <flowId> <exportOrImportId>

# Run and monitor
celigo flows run <flowId> -y
celigo jobs current

Commands

Most resources support list, get <id>, create, update <id>, set <id> key=value, and delete <id>. Exceptions: environments excludes delete; users excludes create (use invite). For connections and iclients, set changes only credential-safe whitelisted fields (via PATCH) and update refuses payloads containing masked "******" values unless --force — see their sections. Input for create/update (and other body-taking commands like invoke and lookup-caches put-data/get-data/delete-data) is JSON piped via stdin, or read from a file with -f, --file <path> (- also means stdin). set supports dot notation (http.relativeURI=/new) and array indexing (pageGenerators[0]._exportId=abc); to load a single field's value from a file (e.g. a script's content), use set <id> <field>=file://<path>.

| Resource | Description | |---|---| | Core | | | integrations | Integration packages | | flows | Integration flows (pipelines) | | connections | App connections (credentials) | | exports | Data sources | | imports | Data destinations | | Supporting | | | async-helpers | Async polling helpers | | scripts | Custom JavaScript hooks | | stacks | Server / Lambda stacks | | environments | Sandbox / staging environments | | lookup-caches | In-memory key/value stores | | file-definitions | CSV / EDI / fixed-width formats | | edi-profiles | EDI document profiles | | iclients | OAuth2 app registrations | | apis | Custom HTTP endpoints | | tags | Resource tags | | tools | Celigo AI Tools (reusable building blocks) | | mcp-servers | MCP endpoints for AI clients | | ai-agents | AI agents (LLM-powered imports) | | guardrails | AI safety checks (PII, moderation) | | on-premise-agents | On-premise agents / OPA (network gateways) | | B2B | | | edi-transactions | B2B Manager EDI transaction log | | Discovery & Metadata | | | http-connectors | HTTP connector catalog (550+) | | tp-connectors | Trading partner catalog (590+) | | templates | Marketplace templates (340+) | | metadata | Connection metadata (NetSuite, Salesforce, RDBMS) | | Operations | | | jobs | Flow run jobs | | notifications | Notification subscriptions | | Admin | | | users | Account users | | audit | Audit trail | | subscriptions | License and usage | | account | Account-wide operations (snapshot, search, dependencies, lint) |

Command reference

Every command the Celigo CLI exposes, grouped by resource. Each row lists the command, its arguments and options, its minimum permission mode, and any notes you need to use it.

Use celigo --help for the top-level command list or celigo <resource> --help for a resource's commands.

Mode enforcement

set field allow-list in operate mode: disabled, debugUntil, debugDate, schedule, autoResolveAt, logging.debugUntil. Any other field assignment fails before the GET. Switch to full to modify other fields.

Enforcement: read is enforced at the HTTP client (throws before the network call). operate is enforced at the CLI layer (throws before the action runs). full has no gates. Profile/config management commands don't hit the Celigo API and are not mode-gated.

A command's mode is usually obvious from its name. list, get, show, search, errors, logs, debug-requests, preview, current, ping, used-by, dependencies, audit, snapshot* are read. create, update, delete, clone, replace-connection, add-processor, remove-processor, add-generator, remove-generator, invite are full. run, invoke, retry-errors, resolve-errors, enable-debug, disable-debug, test-run, enable-execution-logs/disable-execution-logs, put-data, delete-data, purge-data, cancel, rotate-token, assign-errors, unassign-errors, tag-errors, update-error-data, delete-resolved-errors, subscribe, unsubscribe, authorize are operate.

* account snapshot is read; integrations create-snapshot is full (it persists a revision).

Standard verbs

Most resources support the same six verbs (exceptions are called out per resource).

| Command | Args / options | Mode | Notes | |---|---|---|---| | <resource> list | | read | Use --format table for a compact view. | | <resource> get <id> | | read | | | <resource> create | stdin JSON | full | Body piped on stdin. | | <resource> update <id> | stdin JSON | full | Full PUT replace — fields you omit are erased. Prefer set. | | <resource> set <id> <key>=<value>... | | operate/full | GET → modify → PUT. Dot/bracket paths: a.b.c, a[0].b. Values parse as JSON first (so null removes, true/false are booleans, JSON literals work). In operate mode, only allow-list fields are accepted. | | <resource> delete <id> | -y | full | Prompts unless -y. | | <resource> dependencies <id> | (alias used-by) | read | Lists resources that depend on this one, via GET /v1/<type>/<id>/dependencies. Server-computed and authoritative — walks every reference path (including flow-level pageProcessor hooks and router scripts) and resolves transitively. Empty result means no dependents (safe to delete / orphaned). Available on most resources; not tags, users, or environments. | | <resource> audit <id> | | read | Change history for one record, via GET /v1/<type>/<id>/audit — who changed what field, when, and from which source (ui/api/system). Available on the same resources as dependencies. scripts, stacks, and syncs expose the same command via their dedicated audit endpoints. |

Profile management

Not mode-gated. These manage local credential sets; only whoami hits the Celigo API (a read-only identity check).

| Command | Args / options | Notes | |---|---|---| | profile list | | Show all profiles (marks the active one). | | profile show [name] | | Show a profile's config (tokens redacted). Defaults to the active profile. | | profile whoami | | Resolve the active token to its user (GET /v1/tokenInfo). Confirms which account/user the token authenticates as. | | profile add <name> | --api-token, --api-base-url, --default-format, --mode | Create a profile. | | profile use <name> | | Switch the active profile. | | profile delete <name> | | Delete a profile. Cannot delete the active profile. | | profile rename <old> <new> | | Rename a profile. |

Configuration (active profile)

Not mode-gated. Combine with --profile <name> to write to a non-active profile.

| Command | Args / options | Notes | |---|---|---| | config show | | Show all config for the active profile (tokens redacted). | | config get <key> | | Read a single key. | | config set <key> <value> | | Write a key. |

Keys: api_token, base_url, default_format (json | table), mode (read | operate | full).

Core resources

integrations

Containers for flows and other resources.

| Command | Args / options | Mode | Notes | |---|---|---|---| | integrations list | | read | | | integrations get <id> | | read | | | integrations create | stdin JSON | full | | | integrations update <id> | stdin JSON | full | Full PUT replace. | | integrations set <id> <k>=<v>... | | operate/full | | | integrations delete <id> | -y | full | | | integrations clone <id> <environmentId> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). Same-env clones auto-build a self-map; pipe stdin only for cross-env remapping. | | integrations flow-groups <id> | | read | List flow groups (sections). | | integrations create-flow-group <id> <name> | | full | Creates a group on the integration. Assign flows with flows set-group. | | integrations delete-flow-group <id> <flowGroupingId> | -y | full | Removes a group (flows in it become ungrouped, not deleted). | | integrations api-groups <id> | | read | List API groups (sections). | | integrations create-api-group <id> <name> | | full | Creates a group on the integration. Assign APIs with apis set-group. | | integrations delete-api-group <id> <apiGroupingId> | -y | full | Removes a group (APIs in it become ungrouped, not deleted). | | integrations register-connections <id> <connIds...> | | full | | | integrations deregister-connections <id> <connIds...> | -y | full | | | integrations download <id> | -o <path> | read | Download as ZIP. Default path <name>.zip. Rejects Integration App installations. | | integrations errors <id> | | read | All open errors across the integration's flows. | | integrations revisions <id> | | read | All revisions (snapshots, pulls, pushes). | | integrations revision <id> <revisionId> | | read | | | integrations create-snapshot <id> | --description "text" | full | Persists a snapshot revision. | | integrations revision-diff <id> <revisionId> | | read | Only pending revisions (pull, revert) can be diffed. |

flows

Pipelines that move data from source to destination.

| Command | Args / options | Mode | Notes | |---|---|---|---| | flows list | | read | | | flows get <id> | | read | | | flows create | stdin JSON | full | Create with disabled: true and enable only after verification. | | flows update <id> | stdin JSON | full | Full PUT replace. | | flows set <id> <k>=<v>... | | operate/full | | | flows delete <id> | -y | full | | | flows run <id> | --start-date, --end-date, --export-ids, -y | operate | Prompts for confirmation unless -y. | | flows clone <id> <integrationId> <environmentId> | --name <name> (optional), --flow-group <id> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). Same-env clones auto-build a self-map; pipe stdin only for cross-env remapping. | | flows last-export-date <id> | | read | Latest delta checkpoint across all generators. | | flows errors <id> <exportOrImportId> | | read | Open errors for a step. | | flows resolved-errors <id> <exportOrImportId> | | read | | | flows resolve-errors <id> <exportOrImportId> [errorIds] | -y | operate | Omit errorIds to resolve all (use -y). | | flows retry-errors <id> <exportOrImportId> [retryDataKeys] | -y | operate | Omit keys to retry all. | | flows assign-errors <id> <exportOrImportId> <email> [errorIds] | -y | operate | Omit errorIds and pass -y to assign all. | | flows unassign-errors <id> <exportOrImportId> [errorIds] | -y | operate | Omit errorIds and pass -y to unassign all. | | flows delete-resolved-errors <id> <exportOrImportId> [errorIds] | -y | operate | Operational cleanup of resolved errors. | | flows error <id> <exportOrImportId> <errorId> | --request-detail, --retry-data | read | One open error by id. --request-detail adds the captured HTTP request/response (via the error's reqAndResKey); --retry-data adds the editable retry data (via its retryDataKey). | | flows update-error-data <id> <exportOrImportId> <errorId> | stdin JSON from error --retry-data | operate | Resolves the error's retryDataKey internally. | | flows tag-errors <id> <exportOrImportId> | stdin JSON: {errors, tagIds} | operate | Tag or untag errors. | | flows error-summary <id> | | read | Per-step error counts. | | flows error-analysis <id> <exportOrImportId> | --limit <n> | read | Groups errors by pattern. | | flows add-processor <id> <exportOrImportId> | --router, --branch, -y | full | Auto-detects export vs import. | | flows remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | flows add-generator <id> <exportId> | --index, --schedule, -y | full | | | flows remove-generator <id> <exportId> | -y | full | | | flows replace-connection <id> <oldConnId> <newConnId> | | full | Swaps the connection across the entire flow. | | flows set-group <flowGroupingId> <flowIds...> | | full | Assign flows to a flow group. Groups are created via integrations create-flow-group. | | flows unset-group <flowIds...> | | full | Remove flows from their flow group (leaves them ungrouped). | | flows debug-requests <id> <exportOrImportId> | --since <minutes> | read | Default window 60 min. | | flows debug-request-detail <id> <exportOrImportId> <key> | | read | Trace by reqAndResKey (from debug-requests). | | flows delete-debug-requests <id> <exportOrImportId> [reqAndResKeys] | -y | operate | Delete stored request/response traces (specific keys, or all the step's current errors' traces). | | flows test-run <id> | --export <exportId> (required) | operate | Returns metadata, flowJob, childJobs. | | flows test-run-step-results <id> <runId> <exportOrImportId> | | read | Auto-decodes base64-encoded responses. | | flows test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | flows enable-execution-logs <id> | | operate | PATCHes logging.debugUntil. | | flows disable-execution-logs <id> | | operate | | | flows execution-logs <id> <jobId> | | read | | | flows query-execution-logs <id> <jobId> | --export-or-import-id, --group-id, --record-id, --trace-key | read | --trace-key widens results to every step sharing that trace (traceView). | | flows execution-log-detail <id> <jobId> | --export-or-import-id, --stage, --group-id, --record-id | read | |

connections

App connections and credentials.

set is credential-safe; update is a full replace. set applies only whitelisted fields (name, debugDate, debugUntil) via an atomic PATCH that never re-sends encrypted fields; any other field errors rather than falling back to a GET + modify + PUT, which would overwrite real credentials masked as "******". update (full PUT) refuses payloads containing masked placeholders; pass --force to submit anyway, or replace the masked values with real credentials (or "" to clear) before calling.

| Command | Args / options | Mode | Notes | |---|---|---|---| | connections list | | read | | | connections applications | --application <name> | read | Applications in use + resource references. Filter by name (case-insensitive substring). | | connections get <id> | | read | | | connections create | stdin JSON | full | | | connections update <id> | stdin JSON; --force | full | Full PUT replace; refuses masked placeholders. | | connections set <id> <k>=<v>... | | operate/full | PATCHes whitelisted fields (name, debugDate, debugUntil); other fields error to protect masked credentials. | | connections delete <id> | -y | full | | | connections ping <id> | | read | Test connectivity. | | connections enable-debug <id> | --duration <minutes> | operate | Default 60 min (max 60). | | connections disable-debug <id> | | operate | | | connections debug-logs <id> | | read | | | connections authorize <id> | --timeout <seconds>, --print-url | operate | Completes OAuth2 in a browser. Default timeout 180s. |

exports

Data sources (e.g. HTTPExport, FTPExport, NetSuiteExport).

| Command | Args / options | Mode | Notes | |---|---|---|---| | exports list | | read | | | exports get <id> | | read | | | exports create | stdin JSON | full | | | exports update <id> | stdin JSON | full | | | exports set <id> <k>=<v>... | | operate/full | | | exports delete <id> | -y | full | | | exports invoke [id] | stdin JSON or -f, --file <path> (for ad-hoc doc); --all | operate | Invoke by ID or supply a full export doc (stdin/--file) to preview. --all paginates. | | exports clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | exports replace-connection <id> <newConnId> | | full | | | exports enable-debug <id> | --duration <minutes> | operate | Default 60 min. | | exports disable-debug <id> | | operate | |

imports

Data destinations (e.g. NetSuiteDistributedImport, HTTPImport).

| Command | Args / options | Mode | Notes | |---|---|---|---| | imports list | | read | | | imports get <id> | | read | | | imports create | stdin JSON | full | | | imports update <id> | stdin JSON | full | | | imports set <id> <k>=<v>... | | operate/full | | | imports delete <id> | -y | full | | | imports invoke [id] | stdin JSON or -f, --file <path> | operate | With id: run a saved import against records (stdin/--file). Without id: supply an import doc to preview (POST /imports/preview). | | imports clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | imports replace-connection <id> <newConnId> | | full | | | imports enable-debug <id> | --duration <minutes> | operate | Default 60 min. | | imports disable-debug <id> | | operate | |

Supporting resources

async-helpers

Polling configuration for long-running API operations (Amazon SP-API feeds, Salesforce Bulk 2.0, Shopify Bulk). Referenced by exports and imports via _asyncHelperId.

Standard verbs only (list, get, create, update, set, delete).

scripts

Custom JavaScript hooks (preSavePage, preMap, postMap, postSubmit, postResponseMap, filter, transform, handleRequest).

| Command | Args / options | Mode | Notes | |---|---|---|---| | scripts list | | read | | | scripts get <id> | | read | | | scripts create | stdin JSON | full | | | scripts update <id> | stdin JSON | full | | | scripts set <id> <k>=<v>... | | operate/full | | | scripts delete <id> | -y | full | | | scripts enable-debug <id> | --duration <minutes> | operate | Default 60 min. | | scripts disable-debug <id> | | operate | | | scripts debug-logs <id> | --level, --limit, --offset, --since <minutes>, --flow-id, --start-date, --end-date | read | Console output captured while debug is enabled. Filter by level, time window, or flow. |

stacks

Server and Lambda stacks for custom code.

| Command | Args / options | Mode | Notes | |---|---|---|---| | stacks list | | read | | | stacks get <id> | | read | | | stacks create | stdin JSON | full | | | stacks update <id> | stdin JSON | full | | | stacks set <id> <k>=<v>... | | operate/full | | | stacks delete <id> | -y | full | | | stacks token <id> | | read | Show the system token (server stacks only). | | stacks rotate-token <id> | -y | operate | Rotate the system token (old one invalidated immediately). |

environments

Sandbox and staging environments.

No delete command (not supported by the API).

| Command | Args / options | Mode | Notes | |---|---|---|---| | environments list | | read | | | environments get <id> | | read | | | environments create | stdin JSON | full | | | environments update <id> | stdin JSON | full | | | environments set <id> <k>=<v>... | | operate/full | |

lookup-caches

In-memory key/value stores for lookups, deduplication, and cross-reference.

| Command | Args / options | Mode | Notes | |---|---|---|---| | lookup-caches list | | read | | | lookup-caches get <id> | | read | | | lookup-caches create | stdin JSON | full | | | lookup-caches update <id> | stdin JSON | full | | | lookup-caches set <id> <k>=<v>... | | operate/full | | | lookup-caches delete <id> | -y | full | | | lookup-caches put-data <id> | stdin JSON or -f, --file <path>: {"data":[{"key":"k","value":"v"}]} | operate | Upserts entries. Auto-batches when > 1000. Runtime write, not a resource change. | | lookup-caches get-data <id> | stdin JSON or -f, --file <path> (optional): {"keys":[...]} or {"startsWith":"abc"} | read | | | lookup-caches delete-data <id> | stdin JSON or -f, --file <path>: {"keys":["k1","k2"]}; -y | operate | | | lookup-caches purge-data <id> | -y | operate | Wipes all cache data (not the cache resource). |

file-definitions

File format definitions (CSV, EDI, fixed-width, etc.).

Standard verbs only.

edi-profiles

EDI document profiles for trading partners.

Standard verbs only.

iclients

OAuth2 iClients (app registrations shared across connections).

set is credential-safe; update is a full replace. set applies only the whitelisted oauth2.failPath via PATCH; any other field errors rather than falling back to a GET + modify + PUT that would wipe masked secrets. update uses the same masked-credential guard as connections update — pass --force to submit a payload containing masked placeholders. Global iClients (Google, Slack, etc., managed by Celigo) are read-only and embedded in connector definitions.

| Command | Args / options | Mode | Notes | |---|---|---|---| | iclients list | | read | | | iclients get <id> | | read | | | iclients create | stdin JSON | full | | | iclients update <id> | stdin JSON; --force | full | Refuses masked placeholders unless --force. | | iclients set <id> <k>=<v>... | | operate/full | PATCHes the whitelisted oauth2.failPath; other fields error to protect masked secrets. | | iclients delete <id> | -y | full | |

apis

Custom HTTP endpoints exposed by the account.

| Command | Args / options | Mode | Notes | |---|---|---|---| | apis list | | read | | | apis get <id> | | read | | | apis create | stdin JSON | full | | | apis update <id> | stdin JSON | full | | | apis set <id> <k>=<v>... | | operate/full | | | apis delete <id> | -y | full | | | apis logs <id> | | read | Request logs. | | apis log-detail <id> <key> | | read | Full request/response for a log entry. | | apis clone <id> | --api-version <ver> (required); --name, --description, --environment <envId> | full | Builder-mode only. Refuses script-mode APIs. | | apis add-processor <id> <exportOrImportId> | --router, --branch, -y | full | Auto-detects export vs import. | | apis remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | apis set-group <apiGroupingId> <apiIds...> | | full | Assign APIs to an API group. | | apis unset-group <apiIds...> | | full | Remove APIs from their group (leaves them ungrouped). | | apis test-run <id> | | operate | | | apis test-run-step-results <id> <runId> <exportOrImportId> | | read | Auto-decodes base64. | | apis test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | apis debug-requests <id> <exportOrImportId> | --since <minutes> | read | | | apis debug-request-detail <id> <exportOrImportId> <key> | | read | |

tags

Resource tags.

Standard verbs only. create stdin: {"tag": "My Tag"}.

tools

Celigo AI Tools — reusable building blocks callable from flows, APIs, AI agents, MCP servers, and other tools.

| Command | Args / options | Mode | Notes | |---|---|---|---| | tools list | | read | | | tools get <id> | | read | | | tools create | stdin JSON | full | | | tools update <id> | stdin JSON | full | | | tools set <id> <k>=<v>... | | operate/full | | | tools delete <id> | -y | full | | | tools add-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | tools remove-processor <id> <exportOrImportId> | --router, --branch, -y | full | | | tools test-run <id> | | operate | | | tools test-run-step-results <id> <runId> <exportOrImportId> | | read | Auto-decodes base64. | | tools test-run-step-logs <id> <runId> <exportOrImportId> | | read | | | tools debug-requests <id> <exportOrImportId> | --since <minutes> | read | | | tools debug-request-detail <id> <exportOrImportId> <key> | | read | |

mcp-servers

MCP endpoints that expose Celigo tools and builder-mode APIs to external AI clients.

Standard verbs only.

ai-agents

LLM-powered import steps (adaptorType: AiAgentImport). The ai-agents command filters and auto-tags the imports endpoint — create forces adaptorType = AiAgentImport. Per-ID ops (get, update, set, delete, invoke, clone) verify the target's adaptorType first and refuse non-agent imports.

| Command | Args / options | Mode | Notes | |---|---|---|---| | ai-agents list | | read | Filters imports by adaptorType = AiAgentImport. | | ai-agents get <id> | | read | Refuses non-agent imports. | | ai-agents create | stdin JSON | full | adaptorType auto-set. | | ai-agents update <id> | stdin JSON | full | | | ai-agents set <id> <k>=<v>... | | operate/full | | | ai-agents delete <id> | -y | full | | | ai-agents invoke [id] | stdin JSON | operate | With id: invoke a saved agent. Without id: pipe an agent doc to preview (POST /imports/preview). | | ai-agents enable-debug <id> | --duration <minutes> | operate | | | ai-agents disable-debug <id> | | operate | | | ai-agents clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | ai-agents replace-connection <id> <newConnId> | | full | Replace BYOK connection. |

guardrails

AI safety checks (adaptorType: GuardrailImport) — PII detection, content moderation, custom AI evaluation. Same command surface as ai-agents (including the per-ID adaptorType guard).

| Command | Args / options | Mode | Notes | |---|---|---|---| | guardrails list | | read | Filters imports by adaptorType = GuardrailImport. | | guardrails get <id> | | read | | | guardrails create | stdin JSON | full | adaptorType auto-set. | | guardrails update <id> | stdin JSON | full | | | guardrails set <id> <k>=<v>... | | operate/full | | | guardrails delete <id> | -y | full | | | guardrails invoke [id] | stdin JSON | operate | With id: invoke a saved guardrail. Without id: pipe a guardrail doc to preview (POST /imports/preview). | | guardrails enable-debug <id> | --duration <minutes> | operate | | | guardrails disable-debug <id> | | operate | | | guardrails clone <id> | --name <name> (optional); stdin JSON (optional, cross-env): {"connectionMap":{...}} | full | --name defaults to "Clone - <source name>" (matches the UI). | | guardrails replace-connection <id> <newConnId> | | full | |

on-premise-agents

On-premise agents (OPA) — gateway processes that bridge private networks to integrator.io. (Not to be confused with ai-agents, which are LLM-powered imports.)

| Command | Args / options | Mode | Notes | |---|---|---|---| | on-premise-agents list | | read | | | on-premise-agents get <id> | | read | | | on-premise-agents create | stdin JSON | full | | | on-premise-agents update <id> | stdin JSON | full | | | on-premise-agents set <id> <k>=<v>... | | operate/full | | | on-premise-agents delete <id> | -y | full | | | on-premise-agents token <id> | | read | Show the access token. | | on-premise-agents rotate-token <id> | | operate | Rotate the access token (returns the new one; old invalidated immediately). | | on-premise-agents installer-url <id> | --os <os> | read | Signed installer download URL. |

B2B

edi-transactions

Query EDI transaction logs from the B2B Manager dashboard.

| Command | Args / options | Mode | Notes | |---|---|---|---| | edi-transactions list | --file-type <X12\|EDIFACT> (default X12), --direction <Inbound\|Outbound>, --document-type, --document-number, --integration <id>, --start-date (default 30 days ago), --end-date, --sandbox, --limit <n> (default 100) | read | Returns X12 or EDIFACT documents with envelope details, functional acknowledgement status, and control numbers. |

See also edi-profiles and file-definitions.

Discovery and metadata

http-connectors

Read-only catalog of 550+ Celigo-managed HTTP connector definitions (endpoints, resources, global iClient refs).

| Command | Args / options | Mode | Notes | |---|---|---|---| | http-connectors list | | read | | | http-connectors get <id> | --full | read | --full includes all endpoints, resources, supportedBy fields, and global iClient refs. |

tp-connectors

Read-only catalog of 590+ trading partner connector definitions (NetSuite, SAP, Salesforce, etc.).

| Command | Args / options | Mode | Notes | |---|---|---|---| | tp-connectors list | | read | | | tp-connectors get <id> | | read | |

templates

Marketplace integration templates (340+).

| Command | Args / options | Mode | Notes | |---|---|---|---| | templates list | | read | Your own template resources (GET v1/templates). For the public marketplace, use marketplace. | | templates marketplace | --type <Template\|Connector>, --include-connectors | read | Browse published marketplace templates, sorted by installs. Connectors are excluded by default; --type narrows to one docType, --include-connectors keeps both. Filter by name with --jq. | | templates preview [id] | --zip <path>, --summary, --model <type> | read | Blueprint of a template by id, or --zip to preview a local bundle. --summary shows object-type counts; --model filters (Flow, Export, Import, Script, Connection, Integration). | | templates install [id] | --zip <path>, -f <path> | full | Install a template (creating an integration) by id, or --zip from a local bundle. Pipe {"connectionMap":{…}} via stdin for templates with connections. |

metadata

Query connection metadata. Auto-detects NetSuite, Salesforce, or RDBMS from the connection.

| Command | Args / options | Mode | Notes | |---|---|---|---| | metadata types <connectionId> | --refresh | read | Record types + saved searches (NS), sObject types (SF), tables (RDBMS). | | metadata fields <connectionId> <entityType> | --refresh | read | Fields for a record type / sObject / table. |

Operations

jobs

Flow run jobs.

| Command | Args / options | Mode | Notes | |---|---|---|---| | jobs get <id> | | read | Run jobs (flow/retry/bulk_retry) auto-expand to the full family with child jobs inlined; export/import step jobs return just the record. | | jobs list | --flow, --integration, --export, --import, --type, --status, --created-gte, --created-lte, --started-gte, --started-lte, --limit | read | Historical job query across statuses. At least one filter is recommended — unfiltered responses can be very large. | | jobs current | --sandbox, --integration, --flow, --status | read | Currently running jobs. | | jobs cancel <id> | -y | operate | | | jobs diagnostics <id> | | read | | | jobs download-files <id> | --file-id <id>, -o <path> | read | No flags: list signed download URLs. --file-id narrows to one file (e.g. s3Key from EDI transactions); -o fetches its bytes to a path. | | jobs purge-files <id> | -y | operate | Delete stored files (not the job). | | jobs errors <id> | | read | Open errors for a job, resolved from its flow + steps and scoped by flow-job id. | | jobs resolved-errors <id> | | read | Resolved errors for a job (same resolution as jobs errors). | | jobs run-stats | --sandbox, --integration, --flow, --status | read | Flow run statistics. |

notifications

Notification subscriptions. Not standard CRUD — subscribe/unsubscribe by batch PUT.

| Command | Args / options | Mode | Notes | |---|---|---|---| | notifications list | | read | All subscriptions for the current user. | | notifications subscribe | --user <email>, --flow <id>, --connection <id>, --integration <id> | operate | Subscribe to one or more resources (flags repeatable). | | notifications unsubscribe | --user <email>, --flow <id>, --connection <id>, --integration <id> | operate | |

Admin

users

Account users.

No create command — use invite instead.

| Command | Args / options | Mode | Notes | |---|---|---|---| | users list | | read | | | users get <id> | | read | | | users update <id> | stdin JSON | full | Full PUT replace. | | users set <id> <k>=<v>... | | operate/full | | | users delete <id> | -y | full | Remove a user from the account. | | users invite | --email <emails...> (required, repeatable); --access-level <administrator\|manage\|monitor> or --integration <id>=<monitor\|manage> (repeatable); --mcp-server <id>=<scope[,scope]> (repeatable); --force-mfa, --force-sso, --allow-edit-retry-data | full | Batch-invites via POST /v1/invite/multiple; access settings apply to every email. Use --access-level for account-wide access, or --integration for per-integration. --allow-edit-retry-data only applies with monitor. |

audit

Audit trail.

| Command | Args / options | Mode | Notes | |---|---|---|---| | audit list | --resource-type, --resource-id, --user-id, --source, --action, --start-date, --end-date, --limit | read | Recent audit events. | | audit download | --resource-type + --resource-id (comma-separated accepted), --user-id, --source, --action, --start-date, --end-date | read | Signed URL to download audit CSV (max 20k rows). --resource-type must be paired with --resource-id — the server rejects type-only filters. Omit both to download the full account log. |

subscriptions

License and usage.

| Command | Args / options | Mode | Notes | |---|---|---|---| | subscriptions licenses | | read | License information. | | subscriptions usage | | read | Current usage metrics. | | subscriptions entitlement-usage | | read | Usage by license entitlement. | | subscriptions historical-usage | | read | Historical monthly usage breakdown. | | subscriptions api-usage | | read | API call detail. |

account

Account-wide operations.

| Command | Args / options | Mode | Notes | |---|---|---|---| | account snapshot | | read | Fetches all resources and builds a local index. | | account search <query> | --type <type>, --limit <n> (default 20), --no-refresh | read | Searches the local index. Auto-refreshes if stale (>15m, or CELIGO_INDEX_STALE_MINUTES); pass --no-refresh to skip. | | account dependencies <type> <id> | --direction <uses\|used-by\|both>, --no-refresh | read | Dependency graph. Auto-refreshes stale index. | | account lint | --no-refresh | read | Runs anomaly-detection rules. Auto-refreshes stale index. | | account stats | --no-refresh | read | Resource counts. Auto-refreshes stale index. |

Token identity (whoami) lives under profile management: celigo profile whoami resolves the active token to its user (GET /v1/tokenInfo).

OPA vs AI agents

Two different things share the word "agent" in the Celigo platform:

• On-premise agents (OPA) — gateway processes that bridge private networks to integrator.io. Manage with on-premise-agents.
• AI agents — LLM-powered import steps (adaptorType: AiAgentImport). Manage with ai-agents.