Release 2.16.2

docs/technical/schema.md

@@ -214,8 +214,9 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 
 ### `i_api_source_groups`
 
-- `id`, `name`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `enabled`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - Unique group name; authentication applies to every child request. `auth_method = 'none'` supports public endpoints. Token caches are keyed by group and authentication configuration.
+- `enabled` is the source-wide refresh gate, added by migration 2.16.2 with a default of `1`. Disabling a group leaves child enabled flags unchanged. Refresh lookups combine group/request flags, and queued work checks effective enabled state before making an outbound request.
 
 ### `i_api_sources`
 

docs/user/guide-data-sources.md

@@ -27,12 +27,14 @@ When an RSS feed fails, open the latest-items preview and check the reported pul
 
 An API source groups one or more named requests under shared authentication. Use **Add request** to create separate cards for endpoints such as event information and donors. Each request has its own URL, method, items path, enabled state, refresh interval, latest response, and **Test Connection** / **Refresh now** actions. Save the source to persist added, edited, or removed requests. A request used by a slide cannot be removed.
 
+Use **Disable** in the Connection card to pause the entire API source. This stops scheduled and manual refreshes without changing individual request switches or discarding unsaved form edits. **Enable** resumes only requests whose own switches are enabled. Existing response snapshots are retained, and authentication/connection tests remain available for troubleshooting. The API source list shows the overall enabled status.
+
 Each request can use either GET or POST:
 
 - **GET:** retrieve data directly from the API URL.
 - **POST:** send a JSON request body with the request.
 
-Use **Items path** when the records needed by a slide are nested inside the response. Enter a dot-separated path such as `items` or `results.data` to identify the array that should be treated as the source items.
+Use **Items path** when the records needed by a slide are nested inside the response. Enter a dot-separated path such as `items` or `results.data` to select an array or a single object. An object is treated as item 1. For a campaign returned as `{ "data": { ... } }`, use `data` and placeholders relative to it, such as `amount_raised.value`. Leave the path blank to retain the response root and existing automatic array detection. Missing paths or paths selecting scalar values return no items.
 
 API authentication supports: