The whole platform, typed, in your code.
Everything the product does is open to your own code, with the types already written for you. The SDK is built from the same description the API is built from, so when one changes the other changes with it. Your editor tells you where, before anything runs.

Your editor knows what an operation costs
The governance facts are in the type, not in a wiki page somebody forgot to update. Before you write the call, you can see which role it needs, whether it can be undone, whether it is recorded, and what it touches. That is the difference between a policy and a guardrail. A developer who does not know an operation is irreversible finds out in code review, or in production. Here they find out while typing.
One description, and everything comes from it
The API is described once, in a file a machine can read, and that description carries those governance facts for every single operation. The SDK, the reference documentation, and the access diagram you can open on any operation are all built from that one file. There is no second copy to drift.
Written for the language you build in
TypeScript ships in the box: a friendly layer for each thing in the product, and a plain layer underneath for anything else. It carries the same governed tools an AI agent uses, and asks the same reason of you as of it. Python, Go, Rust, and a build for mobile are generated from your organization's own live API and delivered as downloads. They describe the platform you are actually running, not the one we shipped last quarter.
Safe in a browser or phone
A build meant for a browser or a phone never carries a real key. It holds one that opens nothing on its own. That key can be traded, together with a person signed in at that moment, for a short-lived pass. The pass belongs to that one person, not to the whole organization. Never a shared key, never a borrowed login. The same rule that governs AI agents governs your front end.
The API itself
These rules hold at the API itself, not only in the interface above it.
- Irreversible operations never run on a machine sign-in. Most are proposed for a named person to decide; the rest have no release path at all and only a signed-in person can run them. That is the rule the rest of the platform runs on, enforced at the lowest level rather than promised at the top.
- Every call is signed in as exactly one organization, worked out on the server. A caller never gets to say which organization it is for.
- Writing anything needs the right role.
- Several operations offer a dry run that tells you what would happen without doing it.
- Calls worth retrying take a key that stops the same request running twice.
- Every call that changes something lands on the record, with the AI agent that made it and the person it acts for.
Given to clients, not published
The SDK is ours, and it is given to clients as part of an engagement: a numbered download tied to your own sign-in. It is a client SDK, licensed for your use of the platform. It is not a public library you can pull off the internet.
The SDK comes with an engagement. Ask us for access.
Also in Studio
- StudioAgent runsGive an AI agent a job, then read back every step of it.Read the page
- StudioAgent securityA name, a limit, and somebody who can stop it.Read the page
- StudioAgent identityA person lets an AI agent in, and can stop it again.Read the page
- StudioWhat an AI agent may doIt never reaches further than its owner.Read the page
- StudioAgent sign-insA sign-in expires sooner the more it can do.Read the page
- StudioApproved modelsWhich models may run, who approved each one, and what it left behind.Read the page
- StudioScans and approved packagesApproved packages at the exact version, watched after that.Read the page
- StudioCommand lineThe terminal your engineers already use, on your rules.Read the page
- StudioMCP serverConnect any AI agent, and the rules come with it.Read the page
