@ampsec/platform-client 4.0.0 → 4.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampsec/platform-client",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "",
   "main": "build/src/index.js",
   "scripts": {
@@ -40,6 +40,7 @@
     "typescript": "^5.0.4"
   },
   "files": [
-    "/build/src"
+    "/build/src",
+    "/src"
   ]
 }

package/src/FilterCriteria.ts

@@ -0,0 +1,18 @@
+export type FilterCriteria = {
+  /** Number of records to return. */
+  limit?: number;
+  /** Number of records to skip before capturing results. */
+  offset?: number;
+  /** Tenant ID */
+  tid?: number;
+  /** Connector ID */
+  cid?: number;
+  /** Organization name. Defaults to `*` which matches all organizations. */
+  organization?: '*' | 'EXTERNAL' | string;
+  /** Department name. Defaults to `*` which matches all departments. */
+  department?: '*' | string;
+  /** User ID */
+  uid?: number;
+  /** Asset ID */
+  aid?: number;
+};

package/src/dto/agents.dto.ts

@@ -0,0 +1,15 @@
+import {AgentStatus} from './enums/agent.status';
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type AgentUpsertDto = BaseUpsertDto & {
+  /** Agent first name */
+  firstName: string;
+  /** Agent last name */
+  lastName: string;
+  /** Status of the Agent, e.g. ACTIVE */
+  status: AgentStatus;
+  /** External Id */
+  email: string;
+};
+
+export type AgentDto = BaseDto & AgentUpsertDto;

package/src/dto/assets.dto.ts

@@ -0,0 +1,10 @@
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './base.dto';
+
+export type AssetUpsertDto = ChangeAwareUpsertDto & {
+  /** External Id */
+  sn: string;
+  /** User Id of the asset owner */
+  uid?: number | undefined;
+};
+
+export type AssetDto = ChangeAwareDto & AssetUpsertDto;

package/src/dto/base.dto.ts

@@ -0,0 +1,25 @@
+export type BaseUpsertDto = {
+  /** Unique Row Identifier. Populated for entity updates. */
+  id?: number;
+};
+
+export type BaseDto = {
+  /** Unique Row Identifier */
+  id: number;
+  /** Record creation date in database. */
+  createdAt: string;
+  /** Last record update date in database. */
+  updatedAt: string;
+  /** Record deletion date in database. Only present on soft deleted, i.e. `null => active` */
+  deletedAt: string | null;
+};
+
+export type ChangeAwareUpsertDto = BaseUpsertDto & {
+  /** MD5 hash of a subset of properties to detect field level changes. */
+  etag: string;
+};
+
+export type ChangeAwareDto = BaseDto & {
+  /** MD5 hash of a subset of properties to deted field level changes. */
+  etag: string;
+};

package/src/dto/connectors.dto.ts

@@ -0,0 +1,13 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+import {ConnectorStatus} from './enums/connector.status';
+
+export type ConnectorUpsertDto = BaseUpsertDto & {
+  /** Human readable name of the connector */
+  displayValue: string;
+  /** Status of the connector, e.g. ACTIVE */
+  status: ConnectorStatus;
+  /** Provider Id */
+  pid?: number | null;
+};
+
+export type ConnectorDto = BaseDto & ConnectorUpsertDto;

package/src/dto/enums/agent.status.ts

@@ -0,0 +1,6 @@
+/* eslint-disable no-unused-vars */
+export enum AgentStatus {
+  ACTIVE = 'ACTIVE',
+  INVITED = 'INVITED',
+  SUSPENDED = 'SUSPENDED',
+}

package/src/dto/enums/connector.status.ts

@@ -0,0 +1,7 @@
+/* eslint-disable no-unused-vars */
+export enum ConnectorStatus {
+  ACTIVE = 'ACTIVE',
+  DELETED = 'DELETED',
+  FAILED = 'FAILED',
+  DISABLED = 'DISABLED',
+}

package/src/dto/enums/finding.severity.ts

@@ -0,0 +1,7 @@
+/* eslint-disable no-unused-vars */
+export enum FindingSeverity {
+  LOW = 'LOW',
+  MEDIUM = 'MEDIUM',
+  HIGH = 'HIGH',
+  CRITICAL = 'CRITICAL',
+}

package/src/dto/enums/finding.status.ts

@@ -0,0 +1,5 @@
+/* eslint-disable no-unused-vars */
+export enum FindingStatus {
+  OPEN = 'OPEN',
+  CLOSED = 'CLOSED',
+}

package/src/dto/enums/index.ts

@@ -0,0 +1,4 @@
+export * from './agent.status';
+export * from './connector.status';
+export * from './finding.severity';
+export * from './finding.status';

package/src/dto/extKeyMap.dto.ts

@@ -0,0 +1,6 @@
+export type ExtKeyMap = {
+  [propName: string]: {
+    id: number;
+    etag: string;
+  };
+};

package/src/dto/findings.dto.ts

@@ -0,0 +1,26 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+import {FindingSeverity} from './enums/finding.severity';
+import {FindingStatus} from './enums/finding.status';
+
+export type FindingUpsertDto = BaseUpsertDto & {
+  /** Date the finding was closed */
+  closedAt?: string;
+  /** Type of finding */
+  kind: string;
+  /** Status of the finding, e.g. OPEN */
+  status: FindingStatus;
+  /** Severity of the finding, e.g. CRITICAL, HIGH, etc... */
+  severity: FindingSeverity;
+  /** Number of times the user has been engaged to resolve the finding */
+  numberOfEngagements: number;
+  /** Human readable name of the finding */
+  displayValue: string;
+  /** Description of the finding */
+  description?: string;
+  /** Id of the user to which the finding applies */
+  uid?: number | undefined;
+  /** Id of the SaasComponent related to the given finding */
+  scid: number;
+};
+
+export type FindingDto = BaseDto & FindingUpsertDto;

package/src/dto/index.ts

@@ -0,0 +1,19 @@
+export * from './agents.dto';
+export * from './assets.dto';
+export * from './base.dto';
+export * from './connectors.dto';
+export * from './enums';
+export * from './extKeyMap.dto';
+export * from './findings.dto';
+export * from './message.dto';
+export * from './metrics.dto';
+export * from './page.dto';
+export * from './platform';
+export * from './providers.dto';
+export * from './reportResults.dto';
+export * from './riskContributors.dto';
+export * from './saasAssets.dto';
+export * from './saasComponents.dto';
+export * from './saasUsers.dto';
+export * from './tenants.dto';
+export * from './users.dto';

package/src/dto/message.dto.ts

@@ -0,0 +1,3 @@
+export type Message = {
+  message: string;
+};

package/src/dto/metrics.dto.ts

@@ -0,0 +1,10 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type MetricUpsertDto = BaseUpsertDto & {
+  uid: number;
+  score: number;
+  scoreDelta: number;
+  rank: number;
+};
+
+export type MetricDto = BaseDto & MetricUpsertDto;

package/src/dto/page.dto.ts

@@ -0,0 +1,14 @@
+export type Page<T> = {
+  kind: string;
+  data: T[];
+  error: string | null;
+  hints: {
+    limit?: number;
+    offset?: number;
+    hasMore?: boolean;
+    next?: string;
+    count?: number;
+    links?: {[keyName: string]: string};
+    [propName: string]: number | string | boolean | null | {[keyName: string]: string} | undefined;
+  };
+};

package/src/dto/platform/index.ts

@@ -0,0 +1,13 @@
+export * from './platform.agents.dto';
+export * from './platform.assets.dto';
+export * from './platform.connectors.dto';
+export * from './platform.findings.dto';
+export * from './platform.metrics.dto';
+export * from './platform.providers.dto';
+export * from './platform.reportResults.dto';
+export * from './platform.saasAssets.dto';
+export * from './platform.saasComponents.dto';
+export * from './platform.saasUsers.dto';
+export * from './platform.tenants.dto';
+export * from './platform.users.dto';
+export * from './tenant.based.dto';

package/src/dto/platform/multi.tenant.based.dto.ts

@@ -0,0 +1,11 @@
+import {BaseDto, BaseUpsertDto} from '../base.dto';
+
+export type UpsertMultiTenantBased = BaseUpsertDto & {
+  /** Tenant Ids for multi-tenant entities */
+  tids?: number[];
+};
+
+export type MultiTenantBased = BaseDto & {
+  /** Tenant Ids for multi-tenant entities */
+  tids: number[];
+};

package/src/dto/platform/platform.agents.dto.ts

@@ -0,0 +1,6 @@
+import {AgentDto, AgentUpsertDto} from '../agents.dto';
+import {MultiTenantBased, UpsertMultiTenantBased} from './multi.tenant.based.dto';
+
+export type PlatformAgentUpsertDto = AgentUpsertDto & UpsertMultiTenantBased;
+
+export type PlatformAgentDto = AgentDto & MultiTenantBased;

package/src/dto/platform/platform.assets.dto.ts

@@ -0,0 +1,6 @@
+import {AssetDto, AssetUpsertDto} from '../assets.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformAssetUpsertDto = AssetUpsertDto & UpsertTenantBased;
+
+export type PlatformAssetDto = AssetDto & TenantBased;

package/src/dto/platform/platform.connectors.dto.ts

@@ -0,0 +1,6 @@
+import {ConnectorDto, ConnectorUpsertDto} from '../connectors.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformConnectorUpsertDto = ConnectorUpsertDto & UpsertTenantBased;
+
+export type PlatformConnectorDto = ConnectorDto & TenantBased;

package/src/dto/platform/platform.findings.dto.ts

@@ -0,0 +1,6 @@
+import {FindingDto, FindingUpsertDto} from '../findings.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformFindingUpsertDto = FindingUpsertDto & UpsertTenantBased;
+
+export type PlatformFindingDto = FindingDto & TenantBased;

package/src/dto/platform/platform.metrics.dto.ts

@@ -0,0 +1,6 @@
+import {MetricDto, MetricUpsertDto} from '../metrics.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformMetricUpsertDto = MetricUpsertDto & UpsertTenantBased;
+
+export type PlatformMetricDto = MetricDto & TenantBased;

package/src/dto/platform/platform.providers.dto.ts

@@ -0,0 +1,5 @@
+import {ProviderDto, ProviderUpsertDto} from '../providers.dto';
+
+export type PlatformProviderUpsertDto = ProviderUpsertDto;
+
+export type PlatformProviderDto = ProviderDto;

package/src/dto/platform/platform.reportResults.dto.ts

@@ -0,0 +1,6 @@
+import {ReportResultDto, ReportResultUpsertDto} from '../reportResults.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformReportResultUpsertDto = ReportResultUpsertDto & UpsertTenantBased;
+
+export type PlatformReportResultDto = ReportResultDto & TenantBased;

package/src/dto/platform/platform.saasAssets.dto.ts

@@ -0,0 +1,5 @@
+import {SaasAssetDto, SaasAssetUpsertDto} from '../saasAssets.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformSaasAssetUpsertDto = SaasAssetUpsertDto & UpsertTenantBased;
+export type PlatformSaasAssetDto = SaasAssetDto & TenantBased;

package/src/dto/platform/platform.saasComponents.dto.ts

@@ -0,0 +1,6 @@
+import {SaasComponentDto, SaasComponentUpsertDto} from '../saasComponents.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformSaasComponentUpsertDto = SaasComponentUpsertDto & UpsertTenantBased;
+
+export type PlatformSaasComponentDto = SaasComponentDto & TenantBased;

package/src/dto/platform/platform.saasUsers.dto.ts

@@ -0,0 +1,6 @@
+import {SaasUserUpsertDto} from '../saasUsers.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformSaasUserUpsertDto = SaasUserUpsertDto & UpsertTenantBased;
+
+export type PlatformSaasUserDto = SaasUserUpsertDto & TenantBased;

package/src/dto/platform/platform.tenants.dto.ts

@@ -0,0 +1,5 @@
+import {TenantDto, TenantUpsertDto} from '../tenants.dto';
+
+export type PlatformTenantUpsertDto = TenantUpsertDto;
+
+export type PlatformTenantDto = TenantDto;

package/src/dto/platform/platform.users.dto.ts

@@ -0,0 +1,6 @@
+import {UserDto, UserUpsertDto} from '../users.dto';
+import {TenantBased, UpsertTenantBased} from './tenant.based.dto';
+
+export type PlatformUserUpsertDto = UserUpsertDto & UpsertTenantBased;
+
+export type PlatformUserDto = UserDto & TenantBased;

package/src/dto/platform/tenant.based.dto.ts

@@ -0,0 +1,11 @@
+import {BaseDto, BaseUpsertDto} from '../base.dto';
+
+export type UpsertTenantBased = BaseUpsertDto & {
+  /** Tenant Id */
+  tid?: number;
+};
+
+export type TenantBased = BaseDto & {
+  /** Tenant Id */
+  tid: number;
+};

package/src/dto/providers.dto.ts

@@ -0,0 +1,8 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type ProviderUpsertDto = BaseUpsertDto & {
+  /** Human readable name of the provider */
+  displayValue: string;
+};
+
+export type ProviderDto = BaseDto & ProviderUpsertDto;

package/src/dto/reportResults.dto.ts

@@ -0,0 +1,12 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type ReportResultUpsertDto = BaseUpsertDto & {
+  /** External Id */
+  extKey: string;
+  /** Timestamp the report result was generated in ISO8601 format */
+  ts: string;
+  /** The results generated for the given report */
+  results: unknown;
+};
+
+export type ReportResultDto = BaseDto & ReportResultUpsertDto;

package/src/dto/riskContributors.dto.ts

@@ -0,0 +1,10 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type RiskContributorUpsertDto = BaseUpsertDto & {
+  /** Short descriptor of the risk contributor, e.g. V, P, etc... */
+  displayValue: string;
+  /** Description of the risk contributor */
+  description: string;
+};
+
+export type RiskContributorDto = BaseDto & RiskContributorUpsertDto;

package/src/dto/saasAssets.dto.ts

@@ -0,0 +1,16 @@
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './base.dto';
+
+export type SaasAssetUpsertDto = ChangeAwareUpsertDto & {
+  /** External Id */
+  sn: string;
+  /** Connector Id */
+  cid: number;
+  /** Asset Id */
+  aid: number;
+  /** User Id */
+  uid?: number | undefined;
+  /** Information specific to this asset */
+  meta: unknown;
+};
+
+export type SaasAssetDto = ChangeAwareDto & SaasAssetUpsertDto;

package/src/dto/saasComponents.dto.ts

@@ -0,0 +1,18 @@
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './base.dto';
+
+export type SaasComponentUpsertDto = ChangeAwareUpsertDto & {
+  /** Asset Id */
+  aid?: number | undefined;
+  /** Connector Id */
+  cid: number;
+  /**  */
+  kind: string;
+  /** Context specific information related to the Saas Component */
+  meta: unknown;
+  /** User Id of the affected user */
+  uid?: number | undefined;
+  /** External Id */
+  extKey: string;
+};
+
+export type SaasComponentDto = ChangeAwareDto & SaasComponentUpsertDto;

package/src/dto/saasUsers.dto.ts

@@ -0,0 +1,14 @@
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './base.dto';
+
+export type SaasUserUpsertDto = ChangeAwareUpsertDto & {
+  /** User Id */
+  uid: number;
+  /** Connector Id */
+  cid: number;
+  /** External Id */
+  email: string;
+  /** Additional information specific to this Saas User */
+  meta: unknown;
+};
+
+export type SaasUserDto = ChangeAwareDto & SaasUserUpsertDto;

package/src/dto/tenants.dto.ts

@@ -0,0 +1,8 @@
+import {BaseDto, BaseUpsertDto} from './base.dto';
+
+export type TenantUpsertDto = BaseUpsertDto & {
+  /** Human readable name of the tenant */
+  displayValue: string;
+};
+
+export type TenantDto = BaseDto & TenantUpsertDto;

package/src/dto/users.dto.ts

@@ -0,0 +1,28 @@
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './base.dto';
+import {MetricDto} from './metrics.dto';
+import {RiskContributorDto} from './riskContributors.dto';
+
+export type UserUpsertDto = ChangeAwareUpsertDto & {
+  /** Tenant ID */
+  tid: number;
+  /** External ID: list of emails, allows or merging users across email aliases */
+  emails: string[];
+  /** User first name */
+  firstName: string;
+  /** User last name */
+  lastName: string;
+  /** Department to which the user is assigned */
+  department?: string;
+  /** User title */
+  title?: string;
+  /** Human readable name of the user's tenant, e.g. tenant.displayName */
+  organization?: string;
+  /** Employment start date used for calculating tenure */
+  startDate?: string;
+  /** Risk Contributors associated with the user */
+  riskContributors: RiskContributorDto[];
+  /** Metrics associated with the user */
+  metrics: MetricDto[];
+};
+
+export type UserDto = ChangeAwareDto & UserUpsertDto;

package/src/etag.ts

@@ -0,0 +1,17 @@
+import md5 from 'blueimp-md5';
+import {ChangeAwareDto, ChangeAwareUpsertDto} from './';
+
+export function calculateEtag(model: unknown): string {
+  const hashObject: {etag?: string} = {...(model as object)};
+  delete hashObject.etag;
+  return md5(JSON.stringify(hashObject));
+}
+
+export function withEtag(model: ChangeAwareDto | ChangeAwareUpsertDto) {
+  model.etag = calculateEtag(model);
+}
+
+export function createWithEtag<T extends {etag: string}>(model: T): T {
+  model.etag = calculateEtag(model);
+  return model;
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './dto';
+export * from './etag';
+export * from './services';
+export * from './FilterCriteria';

package/src/services/AmpApi.ts

@@ -0,0 +1,66 @@
+import {
+  AgentDto,
+  AgentUpsertDto,
+  AssetDto,
+  ConnectorDto,
+  ConnectorUpsertDto,
+  FindingDto,
+  ProviderDto,
+  ReportResultDto,
+  SaasAssetDto,
+  SaasComponentDto,
+  SaasUserDto,
+  TenantDto,
+  TenantUpsertDto,
+  UserDto,
+} from '../dto';
+import {AmpEntityService, AmpEntityServiceImpl} from './entity.service';
+import {AmpDataService, AmpDataServiceImpl} from './data.service';
+import {AmpRestClientOptions, RestClient, getAmpRestClient} from './rest';
+
+export type AmpApiOptions = AmpRestClientOptions;
+
+/**
+ * AMP API
+ * This client is a wrapper around the AMP REST API meant to be used by
+ * agents, i.e. Amplifier Security's customers. If you are trying to implement
+ * a plugin leverage the AmpSdk instead (see {@link AmpSdkServices} ).
+ *
+ * This client provides READ_ONLY access to most of the AMP API. You will
+ * have write access to the following resources:
+ * - Agents: {@link AmpApi.agents}
+ * - Connectors: {@link AmpApi.connectors}
+ * - Tenants: {@link AmpApi.tenants}
+ */
+export class AmpApi {
+  readonly agents: AmpEntityService<AgentUpsertDto, AgentDto>;
+  readonly asset: AmpDataService<AssetDto>;
+  readonly connectors: AmpEntityService<ConnectorUpsertDto, ConnectorDto>;
+  readonly findings: AmpDataService<FindingDto>;
+  readonly providers: AmpDataService<ProviderDto>;
+  readonly reports: AmpDataService<ReportResultDto>;
+  readonly saasAssets: AmpDataService<SaasAssetDto>;
+  readonly saasComponents: AmpDataService<SaasComponentDto>;
+  readonly saasUsers: AmpDataService<SaasUserDto>;
+  readonly tenants: AmpEntityService<TenantUpsertDto, TenantDto>;
+  readonly users: AmpDataService<UserDto>;
+
+  constructor(rest: RestClient) {
+    this.agents = new AmpEntityServiceImpl<AgentUpsertDto, AgentDto>(rest, 'agents');
+    this.asset = new AmpDataServiceImpl<AssetDto>(rest, 'assets');
+    this.connectors = new AmpEntityServiceImpl<ConnectorUpsertDto, ConnectorDto>(rest, 'connectors');
+    this.findings = new AmpDataServiceImpl<FindingDto>(rest, 'findings');
+    this.providers = new AmpDataServiceImpl<ProviderDto>(rest, 'providers');
+    this.reports = new AmpDataServiceImpl<ReportResultDto>(rest, 'report_results');
+    this.saasAssets = new AmpDataServiceImpl<SaasAssetDto>(rest, 'saas_assets');
+    this.saasComponents = new AmpDataServiceImpl<SaasComponentDto>(rest, 'saas_components');
+    this.saasUsers = new AmpDataServiceImpl<SaasUserDto>(rest, 'saas_users');
+    this.tenants = new AmpEntityServiceImpl<TenantUpsertDto, TenantDto>(rest, 'agents');
+    this.users = new AmpDataServiceImpl<UserDto>(rest, 'users');
+  }
+
+  static instance(options: AmpApiOptions): AmpApi {
+    const rest = getAmpRestClient(options);
+    return new AmpApi(rest);
+  }
+}

package/src/services/AmpSdk.ts

@@ -0,0 +1,72 @@
+import {
+  ConnectorDto,
+  ConnectorUpsertDto,
+  PlatformAgentDto,
+  PlatformAgentUpsertDto,
+  PlatformAssetDto,
+  PlatformAssetUpsertDto,
+  PlatformFindingDto,
+  PlatformFindingUpsertDto,
+  PlatformReportResultDto,
+  PlatformReportResultUpsertDto,
+  PlatformSaasAssetDto,
+  PlatformSaasAssetUpsertDto,
+  PlatformSaasComponentDto,
+  PlatformSaasComponentUpsertDto,
+  PlatformSaasUserDto,
+  PlatformSaasUserUpsertDto,
+  PlatformUserDto,
+  PlatformUserUpsertDto,
+  ProviderDto,
+  TenantDto,
+  TenantUpsertDto,
+} from '../dto';
+import {AmpEntityService, AmpEntityServiceImpl, AmpGlobalEntityService, AmpGlobalEntityServiceImpl, AmpSaaSEntityService, AmpSaaSEntityServiceImpl} from './entity.service';
+import {AmpDataService, AmpDataServiceImpl, TARGET_API_AGENT, TARGET_API_PLATFORM} from './data.service';
+import {AmpRestClientOptions, RestClient, getAmpRestClient} from './rest';
+
+export type AmpSdkOptions = AmpRestClientOptions;
+
+/**
+ * AMP API
+ * This client is a wrapper around the AMP REST API meant to be used by
+ * service accounts, i.e. plugins and platform extensions. If you are
+ * trying to implement a simple web client you should leverage the AmpApi
+ * instead (see {@link AmpApi} ).
+ *
+ * This client provides CRUD access to most of the AMP API. You
+ * have READ_ONLY access to the following resources:
+ * - providers: {@link AmpSdkServices.providers}
+ */
+export class AmpSdkServices {
+  readonly agents: AmpEntityService<PlatformAgentUpsertDto, PlatformAgentDto>;
+  readonly asset: AmpGlobalEntityService<PlatformAssetUpsertDto, PlatformAssetDto>;
+  readonly connectors: AmpEntityService<ConnectorUpsertDto, ConnectorDto>;
+  readonly findings: AmpSaaSEntityService<PlatformFindingUpsertDto, PlatformFindingDto>;
+  readonly providers: AmpDataService<ProviderDto>;
+  readonly reports: AmpSaaSEntityService<PlatformReportResultUpsertDto, PlatformReportResultDto>;
+  readonly saasAssets: AmpSaaSEntityService<PlatformSaasAssetUpsertDto, PlatformSaasAssetDto>;
+  readonly saasComponents: AmpSaaSEntityService<PlatformSaasComponentUpsertDto, PlatformSaasComponentDto>;
+  readonly saasUsers: AmpSaaSEntityService<PlatformSaasUserUpsertDto, PlatformSaasUserDto>;
+  readonly tenants: AmpEntityService<TenantUpsertDto, TenantDto>;
+  readonly users: AmpGlobalEntityService<PlatformUserUpsertDto, PlatformUserDto>;
+
+  constructor(rest: RestClient) {
+    this.agents = new AmpEntityServiceImpl<PlatformAgentUpsertDto, PlatformAgentDto>(rest, 'agents', TARGET_API_PLATFORM);
+    this.asset = new AmpGlobalEntityServiceImpl<PlatformAssetUpsertDto, PlatformAssetDto>(rest, 'assets', TARGET_API_PLATFORM);
+    this.connectors = new AmpEntityServiceImpl<ConnectorUpsertDto, ConnectorDto>(rest, 'connectors', TARGET_API_PLATFORM);
+    this.findings = new AmpSaaSEntityServiceImpl<PlatformFindingUpsertDto, PlatformFindingDto>(rest, 'findings', TARGET_API_PLATFORM);
+    this.providers = new AmpDataServiceImpl<ProviderDto>(rest, 'providers', TARGET_API_AGENT);
+    this.reports = new AmpSaaSEntityServiceImpl<PlatformReportResultUpsertDto, PlatformReportResultDto>(rest, 'report_results', TARGET_API_PLATFORM);
+    this.saasAssets = new AmpSaaSEntityServiceImpl<PlatformSaasAssetUpsertDto, PlatformSaasAssetDto>(rest, 'saas_assets', TARGET_API_PLATFORM);
+    this.saasComponents = new AmpSaaSEntityServiceImpl<PlatformSaasComponentUpsertDto, PlatformSaasComponentDto>(rest, 'saas_components', TARGET_API_PLATFORM);
+    this.saasUsers = new AmpSaaSEntityServiceImpl<PlatformSaasUserUpsertDto, PlatformSaasUserDto>(rest, 'saas_users', TARGET_API_PLATFORM);
+    this.tenants = new AmpEntityServiceImpl<TenantUpsertDto, TenantDto>(rest, 'tenants', TARGET_API_PLATFORM);
+    this.users = new AmpGlobalEntityServiceImpl<PlatformUserUpsertDto, PlatformUserDto>(rest, 'users', TARGET_API_PLATFORM);
+  }
+
+  static instance(options: AmpSdkOptions): AmpSdkServices {
+    const rest = getAmpRestClient(options);
+    return new AmpSdkServices(rest);
+  }
+}

package/src/services/data.service.ts

@@ -0,0 +1,69 @@
+import {BaseDto, Page} from '../dto';
+import {FilterCriteria} from '../FilterCriteria';
+import {RestClient, RestRequest} from './rest';
+
+export interface AmpDataService<ReadT extends BaseDto> {
+  list(_filter: FilterCriteria): Promise<Page<ReadT>>;
+  getById(_id: number): Promise<Page<ReadT>>;
+}
+
+export interface ErrorHandler<T> {
+  (_error: unknown): T;
+}
+
+export type TargetApi = 'api' | 'platform';
+export const TARGET_API_PLATFORM: TargetApi = 'platform';
+export const TARGET_API_AGENT: TargetApi = 'api';
+
+export class AmpDataServiceImpl<ReadT extends BaseDto> implements AmpDataService<ReadT> {
+  protected readonly rest: RestClient;
+  protected readonly kind: string;
+  protected readonly targetApi: string;
+
+  constructor(rest: RestClient, kind: string, targetApi: TargetApi = 'api') {
+    this.rest = rest;
+    this.kind = kind;
+    this.targetApi = targetApi;
+  }
+
+  protected async call<T>(req: RestRequest, errorHandler: ErrorHandler<T>): Promise<T> {
+    try {
+      const res = await this.rest.call(req);
+      return res.data as T;
+    } catch (error: unknown) {
+      if (error instanceof Error) {
+        console.error(error.message);
+      }
+      return errorHandler(error);
+    }
+  }
+
+  protected async getPage(req: RestRequest): Promise<Page<ReadT>> {
+    return this.call(req, (error: unknown) => {
+      if (error instanceof Error) {
+        console.error(error.message);
+      }
+      return {
+        data: [],
+        kind: this.kind.toUpperCase(),
+        error: (error as {message: string}).message,
+        hints: {},
+      };
+    });
+  }
+
+  list(filter: FilterCriteria): Promise<Page<ReadT>> {
+    return this.getPage({
+      url: `/${this.targetApi}/v1/${this.kind}`,
+      method: 'GET',
+      params: filter,
+    });
+  }
+
+  getById(id: number): Promise<Page<ReadT>> {
+    return this.getPage({
+      url: `/${this.targetApi}/v1/${this.kind}/${id}`,
+      method: 'GET',
+    });
+  }
+}

package/src/services/entity.service.ts

@@ -0,0 +1,104 @@
+import {BaseDto, BaseUpsertDto, ExtKeyMap, Page} from '../dto';
+import {AmpDataService, AmpDataServiceImpl, ErrorHandler, TARGET_API_AGENT, TargetApi} from './data.service';
+import {RestClient, RestRequest} from './rest';
+
+export interface AmpEntityService<WriteT extends BaseUpsertDto, ReadT extends BaseDto> extends AmpDataService<ReadT> {
+  create(_model: WriteT): Promise<Page<ReadT>>;
+  update(_model: WriteT): Promise<Page<ReadT>>;
+  delete(_id: number): Promise<Page<ReadT>>;
+}
+export interface AmpGlobalEntityService<WriteT extends BaseUpsertDto, ReadT extends BaseDto> extends AmpDataService<ReadT> {
+  create(_model: WriteT): Promise<Page<ReadT>>;
+  update(_model: WriteT): Promise<Page<ReadT>>;
+  delete(_id: number): Promise<Page<ReadT>>;
+  getLookupIds(_tid: number): Promise<ExtKeyMap>;
+}
+export interface AmpSaaSEntityService<WriteT extends BaseUpsertDto, ReadT extends BaseDto> extends AmpDataService<ReadT> {
+  create(_model: WriteT): Promise<Page<ReadT>>;
+  update(_model: WriteT): Promise<Page<ReadT>>;
+  delete(_id: number): Promise<Page<ReadT>>;
+  getLookupIds(_cid: number): Promise<ExtKeyMap>;
+}
+
+export class AmpEntityServiceImpl<WriteT extends BaseUpsertDto, ReadT extends BaseDto> extends AmpDataServiceImpl<ReadT> implements AmpEntityService<WriteT, ReadT> {
+  constructor(rest: RestClient, kind: string, targetApi: TargetApi = TARGET_API_AGENT) {
+    super(rest, kind, targetApi);
+  }
+
+  create(model: WriteT): Promise<Page<ReadT>> {
+    return this.getPage({
+      url: `/${this.targetApi}/v1/${this.kind}`,
+      method: 'POST',
+      data: model,
+    });
+  }
+
+  update(model: WriteT): Promise<Page<ReadT>> {
+    return this.getPage({
+      url: `/${this.targetApi}/v1/${this.kind}/${model.id}`,
+      method: 'PUT',
+      data: model,
+    });
+  }
+
+  async delete(id: number): Promise<Page<ReadT>> {
+    const res = await this.getById(id);
+    if (res.data.length === 1) {
+      const req: RestRequest = {
+        url: `/${this.targetApi}/v1/${this.kind}/${id}`,
+        method: 'DELETE',
+      };
+      const {error} = await this.call(req, (error: unknown) => {
+        if (error instanceof Error) {
+          console.error(error.message);
+        }
+        return {success: false, error};
+      });
+      if (error) {
+        throw new Error(`Failed to delete ${this.kind} with id="${id}"`);
+      }
+    }
+    return res;
+  }
+}
+
+const extIdMapErrorHandler: ErrorHandler<ExtKeyMap> = (error: unknown) => {
+  if (error instanceof Error) {
+    console.error(error.message);
+  }
+  return {};
+};
+
+export class AmpGlobalEntityServiceImpl<WriteT extends BaseUpsertDto, ReadT extends BaseDto>
+  extends AmpEntityServiceImpl<WriteT, ReadT>
+  implements AmpGlobalEntityService<WriteT, ReadT>
+{
+  constructor(rest: RestClient, kind: string, targetApi: TargetApi = TARGET_API_AGENT) {
+    super(rest, kind, targetApi);
+  }
+  getLookupIds(tid: number): Promise<ExtKeyMap> {
+    const req: RestRequest = {
+      url: `/${this.targetApi}/v1/${this.kind}/ext_key_map`,
+      method: 'GET',
+      params: {tid},
+    };
+    return this.call(req, extIdMapErrorHandler);
+  }
+}
+
+export class AmpSaaSEntityServiceImpl<WriteT extends BaseUpsertDto, ReadT extends BaseDto>
+  extends AmpEntityServiceImpl<WriteT, ReadT>
+  implements AmpSaaSEntityService<WriteT, ReadT>
+{
+  constructor(rest: RestClient, kind: string, targetApi: TargetApi = TARGET_API_AGENT) {
+    super(rest, kind, targetApi);
+  }
+  getLookupIds(cid: number): Promise<ExtKeyMap> {
+    const req: RestRequest = {
+      url: `/${this.targetApi}/v1/${this.kind}/ext_key_map`,
+      method: 'GET',
+      params: {cid},
+    };
+    return this.call(req, extIdMapErrorHandler);
+  }
+}

package/src/services/index.ts

@@ -0,0 +1,5 @@
+export * from './AmpApi';
+export * from './AmpSdk';
+export * from './data.service';
+export * from './entity.service';
+export * from './rest';

package/src/services/rest/RestClient.ts

@@ -0,0 +1,103 @@
+import _ from 'lodash';
+import axios, {Axios, AxiosError, AxiosStatic} from 'axios';
+import {RestRequest} from './RestRequest';
+import {RestResponse} from './RestResponse';
+import {RestClientRetryStrategy, noopRestRetryStrategy} from './retry.rest';
+import {HeadersMap, convertHeaders} from './utils';
+import {RestClientRateLimitStrategy, StaticRestClientRateLimitStrategy, noopRestClientRateLimitStrategy} from './rateLimit.rest';
+
+export type AmpRestClientOptions = {
+  baseUrl: string;
+  token: string;
+  timeout?: number;
+  retryStrategy?: RestClientRetryStrategy;
+  rateLimitStrategy?: RestClientRateLimitStrategy;
+  verbose?: boolean;
+  client?: AxiosStatic;
+};
+
+export type RestClientOptions = {
+  baseUrl?: string;
+  headers?: HeadersMap;
+  timeout?: number;
+  retryStrategy?: RestClientRetryStrategy;
+  rateLimitStrategy?: RestClientRateLimitStrategy;
+  verbose?: boolean;
+  client?: AxiosStatic;
+};
+
+/**
+ * RestClient is a generic interface for making REST calls.
+ */
+export interface RestClient {
+  call(_request: RestRequest): Promise<RestResponse>;
+}
+
+/**
+ * DefaultRestClient is a default implementation of RestClient.
+ * It defaults to useing axios to make REST calls and adds reasonble defaults
+ * for retry logic, error handling, headers, and timeouts.
+ *
+ * These strategies can be useful when scraping 3rd party APIs.
+ */
+export class DefaultRestClient {
+  protected readonly ampAxios: Axios;
+  protected readonly retryStrategy: RestClientRetryStrategy;
+  protected readonly rateLimitStrategy: RestClientRateLimitStrategy;
+  protected readonly verbose: boolean;
+  constructor(options: RestClientOptions = {}) {
+    // TODO: rest client
+    const client = options.client ?? axios;
+    this.ampAxios = client.create({
+      baseURL: options.baseUrl,
+      timeout: options.timeout,
+    });
+    Object.keys(options.headers ?? {}).forEach(key => {
+      this.ampAxios.defaults.headers.common[key] = options.headers?.[key];
+    });
+    this.verbose = options.verbose ?? false;
+    this.ampAxios.defaults.headers.common['Accepts'] = 'application/json';
+    this.ampAxios.defaults.headers.post['Content-Type'] = 'application/json';
+    this.ampAxios.defaults.headers.put['Content-Type'] = 'application/json';
+    this.retryStrategy = options.retryStrategy ?? noopRestRetryStrategy;
+    this.rateLimitStrategy = options.rateLimitStrategy ?? noopRestClientRateLimitStrategy;
+  }
+  async call(request: RestRequest): Promise<RestResponse> {
+    const req = _.merge(request);
+    try {
+      await this.rateLimitStrategy.reserve(req);
+      if (this.verbose) console.log('Request', req);
+      const res = await this.ampAxios.request(req);
+      return {
+        status: res.status,
+        headers: convertHeaders(res),
+        data: res.data,
+        error: null,
+      };
+    } catch (err: unknown) {
+      if (err instanceof AxiosError) {
+        const axiosError = err as AxiosError;
+        return {
+          status: axiosError.response?.status ?? 500,
+          headers: axiosError.response ? convertHeaders(axiosError.response) : {},
+          data: null,
+          error: err,
+        };
+      }
+      throw err;
+    }
+  }
+}
+
+export const getAmpRestClient = (options: AmpRestClientOptions): RestClient => {
+  const ampClient = new DefaultRestClient({
+    baseUrl: options.baseUrl,
+    headers: {
+      Authorization: `Bearer ${options.token}`,
+    },
+    rateLimitStrategy: new StaticRestClientRateLimitStrategy(50),
+    verbose: options.verbose ?? false,
+    client: options.client,
+  });
+  return ampClient;
+};

package/src/services/rest/RestRequest.ts

@@ -0,0 +1,9 @@
+import {HeadersMap, QueryMap} from './utils';
+
+export type RestRequest = {
+  url: string;
+  headers?: HeadersMap;
+  params?: QueryMap;
+  data?: unknown;
+  method?: 'GET' | 'POST' | 'PUT' | 'DELETE';
+};

package/src/services/rest/RestResponse.ts

@@ -0,0 +1,8 @@
+import {HeadersMap} from './utils';
+
+export type RestResponse = {
+  status: number;
+  headers: HeadersMap;
+  data: unknown;
+  error: unknown;
+};

package/src/services/rest/index.ts

@@ -0,0 +1,5 @@
+export * from './RestClient';
+export * from './RestRequest';
+export * from './RestResponse';
+export * from './rateLimit.rest';
+export * from './retry.rest';

package/src/services/rest/rateLimit.rest.ts

@@ -0,0 +1,31 @@
+import {RestRequest} from './RestRequest';
+
+export interface RestClientRateLimitStrategy {
+  reserve(_req: RestRequest): Promise<void>;
+}
+
+export const noopRestClientRateLimitStrategy: RestClientRateLimitStrategy = {
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  reserve(_req: RestRequest): Promise<void> {
+    return Promise.resolve();
+  },
+};
+
+const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));
+
+export class StaticRestClientRateLimitStrategy implements RestClientRateLimitStrategy {
+  private readonly delay: number;
+  private lastRequest: number;
+
+  constructor(delay: number) {
+    this.delay = delay;
+    this.lastRequest = 0;
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async reserve(_req: RestRequest): Promise<void> {
+    while (Date.now() - this.lastRequest < this.delay) {
+      await sleep(this.delay);
+    }
+    this.lastRequest = Date.now();
+  }
+}

package/src/services/rest/retry.rest.ts

@@ -0,0 +1,21 @@
+import {AxiosError} from 'axios';
+import {convertHeaders} from './utils';
+import {RestRequest} from './RestRequest';
+import {RestResponse} from './RestResponse';
+
+export interface RestClientRetryStrategy {
+  onError(_req: RestRequest, _err: AxiosError): Promise<RestResponse>;
+}
+
+export const noopRestRetryStrategy: RestClientRetryStrategy = {
+  onError(req: RestRequest, err: AxiosError): Promise<RestResponse> {
+    const axiosError = err as AxiosError;
+    const res: RestResponse = {
+      status: axiosError.response?.status ?? 500,
+      headers: axiosError.response ? convertHeaders(axiosError.response) : {},
+      data: null,
+      error: err,
+    };
+    return Promise.resolve(res);
+  },
+};

package/src/services/rest/utils.ts

@@ -0,0 +1,13 @@
+import {AxiosResponse} from 'axios';
+
+export type StringMap<T> = {[key: string]: T};
+export type HeadersMap = StringMap<string>;
+export type QueryMap = StringMap<unknown>;
+
+export function convertHeaders(res: AxiosResponse): HeadersMap {
+  const headers: HeadersMap = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    headers[key] = value as string;
+  }
+  return headers;
+}