| App | Optional if Integration ID is set, the app slug of the target's integration (for example okta). An app alone resolves to its single active integration; if the app has none or more than one active integration the row is rejected and you must give the Integration ID. |
| Integration ID | Optional if App is set, the integration id of the target (for example okta/01H965ZRNQHAS2B8GKJA85X75C). When both are given they must agree. The target is looked up inside this integration. |
| Employee ID | Optional if Employee Email is set, the BalkanID employee id |
| Employee Email | Optional if Employee ID is set, the work email of the employee in the BalkanID tenant |
| Target ID | Optional, the BalkanID id of the identity, credential or agent |
| Target Source ID | Optional, the id of the identity, credential or agent in its application |
| Target Username | Optional, identities only, the username of the identity |
| Target Email | Optional, identities only, the email of the identity |
| Target Type | Optional, identity (default), credential or agent. A credential or agent row must not set Target Username or Target Email. |
| Relation Type | Optional, owner (default), accessible_by, remove_owner, remove_accessible_by, or unmapped (identities only). Use unmapped to explicitly remove an existing mapping and prevent integration syncs from re-establishing it automatically. Removals only remove mappings that were made manually, never mappings set by an integration. |
| Source System | Optional, employee_relations_csv (default) for uploads. integrations is reserved for integration extractors: rows with this Source System are skipped in a manual upload (reported as one aggregated warning) and do not fail the upload. |
| Metadata Version | Optional, must be given together with Metadata |
| Metadata | Optional, JSON, must be given together with Metadata Version |
| Timestamp | Optional, unix timestamp in seconds |