managing-users

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Managing Users

用户管理

A user (internally called an "ashare") represents a person's access grant to a Celigo account, defining what they can see and do. Concerns when managing users:

Access strategy -- choosing between account-wide access (administrator, manage, monitor) and per-integration access for least-privilege control
Integration-level permissions -- granting manage or monitor access to specific integrations, optionally combined with account-wide monitor as a baseline
Security enforcement -- requiring MFA or SSO per user to meet compliance requirements
Feature flags -- controlling access to APIM features and whether monitor-level users can edit retry data
Lifecycle -- inviting, disabling, and removing users as team composition changes

Users are an account administration concern, not a flow or integration resource.

用户（内部称为"ashare"）代表对Celigo账户的个人访问授权，定义了用户可查看和执行的操作。管理用户时需关注以下事项：

访问策略——在账户级访问（administrator、manage、monitor）和集成级访问中选择，实现最小权限控制
集成级权限——为特定集成授予manage或monitor访问权限，可选择性搭配账户级monitor权限作为基础权限
安全强制——为每个用户要求启用MFA或SSO，满足合规要求
功能开关——控制用户对APIM功能的访问权限，以及monitor级用户是否可编辑重试数据
生命周期——随着团队人员变动，执行邀请、禁用和移除用户操作

用户属于账户管理范畴，不属于流程或集成资源。

Access Strategies

访问策略

There are four strategies for granting access. Choose based on the principle of least privilege.

共有四种访问授权策略，需基于最小权限原则选择。

Administrator

Administrator（管理员）

Full account administration. Can edit all resources, manage users, and change account settings. Cannot transfer ownership or manage owner permissions.

拥有完整的账户管理权限。可编辑所有资源、管理用户、修改账户设置。无法转移账户所有权或管理所有者权限。

Manage (Account-Wide)

Manage（账户级）

Can edit all integrations and resources. Cannot view or edit account settings, invite users, or manage other users.

可编辑所有集成和资源。无法查看或编辑账户设置、邀请用户或管理其他用户。

Monitor (Account-Wide)

Monitor（账户级）

Read-only plus operational access. Can view all integrations, run flows, and troubleshoot errors (retry/resolve). Cannot modify configurations, enable/disable flows, or view connections and API tokens. Optionally grant

allowToEditRetryData

so monitor users can edit retry payloads.

拥有只读权限及操作权限。可查看所有集成、运行流程、排查错误（重试/解决）。无法修改配置、启用/禁用流程，或查看连接信息和API令牌。可选择性授予

allowToEditRetryData

权限，让monitor级用户编辑重试负载。

Integration-Only (Custom)

Integration-Only（自定义）

No account-wide

accessLevel

. Access is granted per-integration via

integrationAccessLevel[]

, each entry specifying an integration ID and either

monitor

manage

. The user sees only the integrations they are granted.

A common hybrid pattern: set

accessLevel: monitor

for baseline read-only access across all integrations, then use

integrationAccessLevel

to grant

manage

for specific integrations the user owns.

无账户级

accessLevel

权限。通过

integrationAccessLevel[]

为每个集成单独授予权限，每个条目需指定集成ID及

monitor

或

manage

级别。用户仅能看到被授予权限的集成。

常见混合模式：设置

accessLevel: monitor

作为所有集成的基础只读权限，再通过

integrationAccessLevel

为用户负责的特定集成授予

manage

权限。

Effective Permissions

有效权限

A user's effective permissions are the union of both fields. On any integration granted by both, the higher level wins (

manage

over

monitor

). Account-wide

accessLevel

also covers every integration created later, whereas

integrationAccessLevel[]

applies only to the integrations explicitly listed and must be extended by hand as new integrations are added. In the UI these composed shapes surface as Monitor all (account-wide

monitor

), Manage all (account-wide

manage

), and Custom (per-integration only).

用户的有效权限是账户级权限与集成级权限的并集。若同一集成同时被两种权限覆盖，级别更高的权限生效（

manage

优先级高于

monitor

）。账户级

accessLevel

权限同样适用于后续创建的所有集成，而

integrationAccessLevel[]

仅适用于明确列出的集成，新增集成时需手动扩展权限。在UI中，这些组合权限分别显示为全量监控（账户级

monitor

）、全量管理（账户级

manage

）和自定义（仅集成级权限）。

Manage vs Monitor: Exact Allowances

Manage与Monitor权限明细

The same two levels apply at both the account-wide and per-integration scopes. On the integrations each covers:

Manage -- create, view, modify, and delete the integration's resources (connections, flows, exports, imports, APIs, Tools, scripts, lookup caches) and troubleshoot errors (retry, resolve, edit retry data, view error history). Cannot view or edit account-wide settings or API tokens (those stay with administrators and the owner).
Monitor -- view resources (read-only on configuration), run flows on demand, and retry/resolve errored records. By default cannot edit the retry-data payload being retried (grant
```
allowToEditRetryData
```
to allow it), cannot modify resource definitions, cannot enable/disable flows, and cannot change settings.

这两个权限级别同时适用于账户级和集成级范围。针对各自覆盖的集成：

Manage——可创建、查看、修改和删除集成资源（连接、流程、导出、导入、API、工具、脚本、查找缓存），并排查错误（重试、解决、编辑重试数据、查看错误历史）。无法查看或编辑账户级设置及API令牌（这些权限仅管理员和所有者拥有）。
Monitor——可查看资源（配置只读）、按需运行流程、重试/解决错误记录。默认无法编辑重试时的负载数据（需授予
```
allowToEditRetryData
```
权限），无法修改资源定义、启用/禁用流程或更改设置。

Quick Reference

快速参考

Access Strategy Decision Matrix

访问策略决策矩阵

User needs to...	Strategy	`accessLevel`	`integrationAccessLevel`
Administer the account, manage users	Administrator	`administrator`	omit
Edit all integrations, no account admin	Manage	`manage`	omit
View all, run/retry flows, no edits	Monitor	`monitor`	omit
View all + manage specific integrations	Monitor + selective manage	`monitor`	`[{_integrationId, accessLevel: "manage"}]`
Access only specific integrations	Integration-only	omit	`[{_integrationId, accessLevel}]`

用户需求	策略	`accessLevel`	`integrationAccessLevel`
管理账户、管理用户	Administrator	`administrator`	省略
编辑所有集成，无账户管理权限	Manage	`manage`	省略
查看所有内容、运行/重试流程，无编辑权限	Monitor	`monitor`	省略
查看所有内容 + 管理特定集成	Monitor + 选择性管理	`monitor`	`[{_integrationId, accessLevel: "manage"}]`
仅访问特定集成	Integration-only	省略	`[{_integrationId, accessLevel}]`

Minimum Required Fields

必填字段

Inviting a user requires at minimum:

```
email
```
-- the user's email address (the only required field)
One of:
```
accessLevel
```
or
```
integrationAccessLevel
```
(technically optional; omitting both creates a user with no access)

邀请用户至少需要以下字段：

```
email
```
——用户邮箱地址（唯一必填字段）
以下二者之一：
```
accessLevel
```
或
```
integrationAccessLevel
```
（技术上为可选；若同时省略，将创建无任何访问权限的用户）

Schema Index

索引Schema

All schemas are in references/schemas/:

Invite fields: invite-request.yml --
```
POST /v1/invite
```
body
Update fields: request.yml --
```
PUT /v1/ashares/{id}
```
body (accessLevel, integrationAccessLevel, MFA/SSO, feature flags)
Response shape: response.yml -- includes
```
accepted
```
,
```
dismissed
```
,
```
lastSignIn
```
,
```
sharedWithUser
```
embedded object

所有Schema均位于references/schemas/：

邀请字段：invite-request.yml——
```
POST /v1/invite
```
请求体
更新字段：request.yml——
```
PUT /v1/ashares/{id}
```
请求体（包含accessLevel、integrationAccessLevel、MFA/SSO、功能开关）
响应格式：response.yml——包含
```
accepted
```
、
```
dismissed
```
、
```
lastSignIn
```
、
```
sharedWithUser
```
嵌套对象

Related Skills

How to Manage Users

用户管理操作步骤

1. Audit current users

1. 审计当前用户

Before inviting or changing permissions, understand the current state:

bash

undefined

在邀请用户或修改权限前，先了解当前用户状态：

bash

undefined

List all users in the account

列出账户内所有用户

celigo users list

Get details for a specific user

获取特定用户详情

celigo users get <id>


Review `accessLevel`, `integrationAccessLevel`, `accepted` (pending invitations), and `disabled` status.

celigo users get <id>


查看`accessLevel`、`integrationAccessLevel`、`accepted`（待接受邀请）及`disabled`状态。

2. Decide the access strategy

2. 确定访问策略

Use the Access Strategy Decision Matrix to determine the right level. Key considerations:

Start with the least privilege needed. Integration-only access is safest for users who only work with specific integrations.
Monitor + selective manage is the most common hybrid -- the user sees everything but can only edit their integrations.
Administrator should be rare. Only for users who need to manage account settings and other users.

使用访问策略决策矩阵选择合适的权限级别。核心考量：

从所需最小权限开始。仅需处理特定集成的用户，使用Integration-only权限最安全。
Monitor + 选择性管理是最常见的混合模式——用户可查看所有内容，但仅能编辑负责的集成。
Administrator权限应慎用。仅授予需要管理账户设置和其他用户的人员。

3. Invite a new user

3. 邀请新用户

Use the

invite

command (there is no

users create

-- invitations are the only way to add users):

bash

undefined

使用

invite

命令（无

users create

命令——邀请是添加用户的唯一方式）：

bash

undefined

Account-wide access

账户级访问权限

celigo users invite --email user@example.com --access-level monitor

Integration-only access

仅集成级访问权限

celigo users invite --email user@example.com --integration <intId1>=manage --integration <intId2>=monitor

Monitor baseline + manage for specific integrations

Monitor基础权限 + 特定集成的manage权限

celigo users invite --email user@example.com --access-level monitor --integration <intId>=manage

With security enforcement

强制安全设置

celigo users invite --email user@example.com --access-level manage --force-mfa celigo users invite --email user@example.com --access-level manage --force-sso

undefined

celigo users invite --email user@example.com --access-level manage --force-mfa celigo users invite --email user@example.com --access-level manage --force-sso

undefined

4. Update permissions for an existing user

4. 更新现有用户权限

Use

set

for simple field changes or

update

for full replacement:

bash

undefined

简单字段修改使用

set

命令，全量替换使用

update

命令：

bash

undefined

Change access level

修改访问级别

celigo users set <id> accessLevel=manage

Enable MFA requirement

强制启用MFA

celigo users set <id> accountMFARequired=true

Grant APIM access

授予APIM访问权限

celigo users set <id> allowAccessToAPIM=true

Allow monitor user to edit retry data

允许monitor级用户编辑重试数据

celigo users set <id> allowToEditRetryData=true

Full update (GET + modify + PUT for complex changes like integrationAccessLevel)

全量更新（复杂修改如integrationAccessLevel需先GET、修改再PUT）

celigo users get <id> > user.json

Edit user.json to add/modify integrationAccessLevel array

编辑user.json添加/修改integrationAccessLevel数组

celigo users update <id> < user.json

undefined

celigo users update <id> < user.json

undefined

5. Disable or remove a user

5. 禁用或移除用户

bash

undefined

bash

undefined

Disable a user (preserves record, blocks access)

禁用用户（保留记录，阻止访问）

celigo users set <id> disabled=true

Re-enable a disabled user

重新启用已禁用用户

celigo users set <id> disabled=false

Permanently remove a user from the account

从账户中永久移除用户

celigo users delete <id>


Disabling is preferred over deleting when you may need to restore access later.

celigo users delete <id>


若后续可能需要恢复访问，优先选择禁用而非删除。

Celigo Support Access

Celigo支持人员访问权限

Separate from inviting people, an account can let Celigo's own support staff sign in to troubleshoot. This appears on the Users page as a single built-in Celigo Support row (

support_access@celigo.com

), disabled by default, that an administrator enables like a toggle.

It is a distinct resource from a user: under the hood it is a support share, not an ashare, and there is exactly one per account (no per-person records) at a fixed, id-less endpoint. It is never invited or listed alongside the other users; instead an administrator operates the single grant directly:

Enable -- turn it on or change its scope/expiry. This is an upsert -- calling it again overwrites the current grant.
Disable -- revoke it (no id needed).
Describe -- report whether it is enabled and, if so, its scope and expiry.

Its access model is identical to a user: compose

accessLevel

and

integrationAccessLevel

with the same shapes (account-wide, integration-only/Custom, or account-wide

monitor

+ selective

manage

), and

allowToEditRetryData

behaves the same way.

The one real difference is that expiry is mandatory. Support access carries a

disableAfter

timestamp and auto-revokes when it passes; the Celigo UI recommends roughly 5 days. There is no default, so a duration must be set explicitly, and it can be revoked early at any time.

Two account/user controls are easy to confuse with enabling support access itself:

allowAllToInviteSupport
-- an account-level setting controlling whether non-administrators may enable support access at all.
Celigo Support invite permission -- a per-user permission that lets a specific non-admin enable support access for the integrations they can already reach. Holding it does not grant support access; it only lets that user turn it on.

除邀请普通用户外，账户可允许Celigo官方支持人员登录排查问题。在用户页面中显示为内置的Celigo Support行（邮箱为

support_access@celigo.com

），默认禁用，管理员可通过开关启用。

这是与普通用户不同的独立资源：底层为support share而非ashare，每个账户仅存在一个（无个人记录），对应固定的无ID端点。它不会被邀请或与其他用户一同列出，管理员直接对该单一授权进行操作：

启用——开启权限或修改范围/有效期。此操作会覆盖当前授权（重复调用即更新）。
禁用——撤销权限（无需ID）。
查看状态——查询是否启用，若启用则显示其范围和有效期。

其访问模型与普通用户完全一致：可组合

accessLevel

和

integrationAccessLevel

（账户级、仅集成级/自定义、账户级

monitor

+选择性

manage

），

allowToEditRetryData

权限的作用也相同。

唯一区别是必须设置有效期。支持访问权限包含

disableAfter

时间戳，到期后自动撤销；Celigo UI建议设置约5天的有效期。无默认值，需明确设置时长，且可随时提前撤销。

以下两个账户/用户设置易与启用支持权限混淆：

allowAllToInviteSupport
——账户级设置，控制非管理员是否可启用支持访问权限。
Celigo支持邀请权限——用户级权限，允许特定非管理员为其已拥有访问权限的集成启用支持访问。拥有此权限不代表获得支持访问权限，仅允许用户开启该权限。

CLI Commands

CLI命令

bash

undefined

bash

undefined

CRUD (no "create" -- use "invite" instead)

CRUD操作（无"create"命令——使用"invite"替代）

celigo users list celigo users get <id> celigo users update <id> < user.json celigo users set <id> key=value [key2=value2 ...] celigo users delete <id>

Invite

邀请用户

celigo users invite --email <email> [--access-level <level>] [--integration <id>=<level> ...] [--force-mfa] [--force-sso] [--allow-edit-retry-data]

Account context

账户上下文

celigo profile whoami # Resolve the active token to its user (returns v1/tokenInfo)


<!-- TIER:3 -->

celigo profile whoami # 将当前令牌解析为对应用户（返回v1/tokenInfo）


<!-- TIER:3 -->

Gotchas

注意事项

There is no
users create
command. Use
```
celigo users invite
```
-- the API endpoint is
```
POST /v1/invite
```
, not
```
POST /v1/ashares
```
. The invite sends an email; the user appears with
```
accepted: false
```
until they accept.
PUT erases omitted fields. Always GET first, modify, then PUT. The
```
set
```
command handles this automatically for simple field changes. For
```
integrationAccessLevel
```
array changes, use the GET-modify-PUT pattern with
```
update
```
.
Omitting both
accessLevel
and
integrationAccessLevel
creates a useless invite. The user will be in the account but have no access to anything. Always specify at least one.

integrationAccessLevel
is ignored when
accessLevel
is
manage
or
administrator
. These levels already grant full access to all integrations. Only use

integrationAccessLevel

with

accessLevel: monitor

or with no

accessLevel

Pending invitations consume a user slot. Unaccepted invitations (
```
accepted: false
```
) count toward the account's user limit. Delete stale invitations to free slots.
disabled: true
blocks access but keeps the record. The user cannot sign in or use the API. Use this instead of delete when you may need to restore access. Setting
```
disabled: false
```
re-enables the user.
MFA and SSO are per-user, per-account settings.
```
accountMFARequired
```
and
```
accountSSORequired
```
on the user record control enforcement for that user in this specific account. SSO requires the account to have SSO configured first.
The internal API resource is
ashares
, not
users
. The CLI maps
```
celigo users
```
to
```
/v1/ashares
```
. If scripting against the API directly, use the
```
ashares
```
endpoint.
Celigo Support access is not a normal user. It never appears in
```
celigo users list
```
and cannot be invited or fetched by id -- it is a single per-account support grant that auto-revokes at its mandatory
```
disableAfter
```
expiry. See Celigo Support Access.

无
users create
命令。请使用
```
celigo users invite
```
——API端点为
```
POST /v1/invite
```
而非
```
POST /v1/ashares
```
。邀请会发送邮件，用户接受前状态为
```
accepted: false
```
。
PUT请求会清除未指定字段。请先执行GET获取数据，修改后再执行PUT。
```
set
```
命令会自动处理简单字段修改。若修改
```
integrationAccessLevel
```
数组，需使用GET-修改-PUT模式配合
```
update
```
命令。
同时省略
accessLevel
和
integrationAccessLevel
会创建无效邀请。用户会加入账户但无任何访问权限。请务必至少指定其中一项。
当
accessLevel
为
manage
或
administrator
时，
integrationAccessLevel
会被忽略。这两个级别已授予所有集成的完整权限。仅当
```
accessLevel: monitor
```
或无
```
accessLevel
```
时，才使用
```
integrationAccessLevel
```
。
待接受邀请会占用用户名额。未接受的邀请（
```
accepted: false
```
）会计入账户用户上限。请删除过期邀请释放名额。
disabled: true
会阻止访问但保留记录。用户无法登录或使用API。若后续可能恢复访问，请使用此方式而非删除。设置
```
disabled: false
```
可重新启用用户。
MFA和SSO是按用户、按账户设置。用户记录中的
```
accountMFARequired
```
和
```
accountSSORequired
```
控制该用户在当前账户的强制启用状态。启用SSO需先在账户中配置SSO。
内部API资源为
ashares
而非
users
。CLI将
```
celigo users
```
映射到
```
/v1/ashares
```
。若直接编写API脚本，请使用
```
ashares
```
端点。
Celigo支持访问权限不属于普通用户。它不会出现在
```
celigo users list
```
中，无法被邀请或通过ID获取——它是每个账户唯一的支持授权，会在强制设置的
```
disableAfter
```
到期时自动撤销。详情见Celigo支持人员访问权限。

Common Errors

常见错误

Error	Likely Cause	Fix
`409 Conflict` on invite	User already has access to the account	Use `users list` to find the existing user record; update permissions with `set` or `update`
`403 Forbidden` on invite or update	Current token does not have administrator access	Use a token from an administrator or owner account
`404 Not Found` on user get/update	Wrong user ID, or user was deleted	Verify ID with `users list`
`422 Validation Error` on invite	Missing email, invalid access level, or malformed `integrationAccessLevel`	Check `email` is present and `accessLevel` is one of: `monitor` , `manage` , `administrator`
User cannot see integrations	`integrationAccessLevel` entries reference wrong integration IDs	Verify integration IDs with `celigo integrations list` ; update the user's access
User invited but cannot sign in	Invitation not accepted, or `disabled: true`	Check `accepted` field; resend invite or set `disabled=false`

错误	可能原因	解决方法
邀请时出现 `409 Conflict`	用户已拥有该账户访问权限	使用 `users list` 查找现有用户记录；通过 `set` 或 `update` 修改权限
邀请或更新时出现 `403 Forbidden`	当前令牌无管理员权限	使用管理员或所有者账户的令牌
获取/更新用户时出现 `404 Not Found`	用户ID错误，或用户已被删除	使用 `users list` 验证ID
邀请时出现 `422 Validation Error`	缺少邮箱、访问级别无效或 `integrationAccessLevel` 格式错误	检查 `email` 是否存在， `accessLevel` 是否为以下值之一： `monitor` 、 `manage` 、 `administrator`
用户无法查看集成	`integrationAccessLevel` 条目引用了错误的集成ID	使用 `celigo integrations list` 验证集成ID；更新用户访问权限
用户已被邀请但无法登录	邀请未被接受，或用户状态为 `disabled: true`	检查 `accepted` 字段；重新发送邀请或设置 `disabled=false`

managing-users

Original

Translation

Managing Users

用户管理

Access Strategies

访问策略

Administrator

Administrator（管理员）

Manage (Account-Wide)

Manage（账户级）

Monitor (Account-Wide)

Monitor（账户级）

Integration-Only (Custom)

Integration-Only（自定义）

Effective Permissions

有效权限

Manage vs Monitor: Exact Allowances

Manage与Monitor权限明细

Quick Reference

快速参考

Access Strategy Decision Matrix

访问策略决策矩阵

Minimum Required Fields

必填字段

Schema Index

索引Schema

Related Skills

相关技能

How to Manage Users

用户管理操作步骤

1. Audit current users

1. 审计当前用户

List all users in the account

列出账户内所有用户

Get details for a specific user

获取特定用户详情

2. Decide the access strategy

2. 确定访问策略

3. Invite a new user

3. 邀请新用户

Account-wide access

账户级访问权限

Integration-only access

仅集成级访问权限

Monitor baseline + manage for specific integrations

Monitor基础权限 + 特定集成的manage权限

With security enforcement

强制安全设置

4. Update permissions for an existing user

4. 更新现有用户权限

Change access level

修改访问级别

Enable MFA requirement

强制启用MFA

Grant APIM access

授予APIM访问权限

Allow monitor user to edit retry data

允许monitor级用户编辑重试数据

Full update (GET + modify + PUT for complex changes like integrationAccessLevel)

全量更新（复杂修改如integrationAccessLevel需先GET、修改再PUT）

Edit user.json to add/modify integrationAccessLevel array

编辑user.json添加/修改integrationAccessLevel数组

5. Disable or remove a user

5. 禁用或移除用户

Disable a user (preserves record, blocks access)

禁用用户（保留记录，阻止访问）

Re-enable a disabled user

重新启用已禁用用户

Permanently remove a user from the account

从账户中永久移除用户

Celigo Support Access

Celigo支持人员访问权限

CLI Commands

CLI命令

CRUD (no "create" -- use "invite" instead)

CRUD操作（无"create"命令——使用"invite"替代）

Invite

邀请用户

Account context