@augstash/sdk 0.2.0 → 0.3.0

package/dist/generated/src/apis/CdpApi.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import type { CdpVendorResponse, ConnectCdpRequest, CursorPageCdpInboundEventResponse, UpdateCdpSettingsRequest } from '../models/index';
+export interface ConnectIntegrationsCdpRequest {
+    vendor: string;
+    connectCdpRequest: ConnectCdpRequest;
+    xIdempotencyKey?: string;
+}
+export interface EventsIntegrationsRequest {
+    vendor: string;
+    eventName?: string;
+    cursor?: string;
+    limit?: number;
+}
+export interface UpdateSettingsIntegrationsCdpRequest {
+    vendor: string;
+    updateCdpSettingsRequest: UpdateCdpSettingsRequest;
+    xIdempotencyKey?: string;
+}
+/**
+ * CdpApi - interface
+ *
+ * @export
+ * @interface CdpApiInterface
+ */
+export interface CdpApiInterface {
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * @summary Connect Segment or RudderStack for this workspace
+     * @param {string} vendor
+     * @param {ConnectCdpRequest} connectCdpRequest
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof CdpApiInterface
+     */
+    connectIntegrationsCdpRaw(requestParameters: ConnectIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CdpVendorResponse>>;
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Connect Segment or RudderStack for this workspace
+     */
+    connectIntegrationsCdp(requestParameters: ConnectIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CdpVendorResponse>;
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * @summary What this CDP has delivered, newest first
+     * @param {string} vendor
+     * @param {string} [eventName]
+     * @param {string} [cursor]
+     * @param {number} [limit]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof CdpApiInterface
+     */
+    eventsIntegrationsRaw(requestParameters: EventsIntegrationsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CursorPageCdpInboundEventResponse>>;
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * What this CDP has delivered, newest first
+     */
+    eventsIntegrations(requestParameters: EventsIntegrationsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CursorPageCdpInboundEventResponse>;
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * @summary Change what this CDP does in each direction
+     * @param {string} vendor
+     * @param {UpdateCdpSettingsRequest} updateCdpSettingsRequest
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof CdpApiInterface
+     */
+    updateSettingsIntegrationsCdpRaw(requestParameters: UpdateSettingsIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CdpVendorResponse>>;
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Change what this CDP does in each direction
+     */
+    updateSettingsIntegrationsCdp(requestParameters: UpdateSettingsIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CdpVendorResponse>;
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * @summary List both customer data platforms and this workspace\'s settings for them
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof CdpApiInterface
+     */
+    vendorsIntegrationsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<CdpVendorResponse>>>;
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List both customer data platforms and this workspace\'s settings for them
+     */
+    vendorsIntegrations(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<CdpVendorResponse>>;
+}
+/**
+ *
+ */
+export declare class CdpApi extends runtime.BaseAPI implements CdpApiInterface {
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Connect Segment or RudderStack for this workspace
+     */
+    connectIntegrationsCdpRaw(requestParameters: ConnectIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CdpVendorResponse>>;
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Connect Segment or RudderStack for this workspace
+     */
+    connectIntegrationsCdp(requestParameters: ConnectIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CdpVendorResponse>;
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * What this CDP has delivered, newest first
+     */
+    eventsIntegrationsRaw(requestParameters: EventsIntegrationsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CursorPageCdpInboundEventResponse>>;
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * What this CDP has delivered, newest first
+     */
+    eventsIntegrations(requestParameters: EventsIntegrationsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CursorPageCdpInboundEventResponse>;
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Change what this CDP does in each direction
+     */
+    updateSettingsIntegrationsCdpRaw(requestParameters: UpdateSettingsIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CdpVendorResponse>>;
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Change what this CDP does in each direction
+     */
+    updateSettingsIntegrationsCdp(requestParameters: UpdateSettingsIntegrationsCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CdpVendorResponse>;
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List both customer data platforms and this workspace\'s settings for them
+     */
+    vendorsIntegrationsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<CdpVendorResponse>>>;
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List both customer data platforms and this workspace\'s settings for them
+     */
+    vendorsIntegrations(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<CdpVendorResponse>>;
+}

package/dist/generated/src/apis/CdpApi.js

@@ -0,0 +1,230 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdpApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const index_1 = require("../models/index");
+/**
+ *
+ */
+class CdpApi extends runtime.BaseAPI {
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Connect Segment or RudderStack for this workspace
+     */
+    async connectIntegrationsCdpRaw(requestParameters, initOverrides) {
+        if (requestParameters['vendor'] == null) {
+            throw new runtime.RequiredError('vendor', 'Required parameter "vendor" was null or undefined when calling connectIntegrationsCdp().');
+        }
+        if (requestParameters['connectCdpRequest'] == null) {
+            throw new runtime.RequiredError('connectCdpRequest', 'Required parameter "connectCdpRequest" was null or undefined when calling connectIntegrationsCdp().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/cdp/{vendor}`;
+        urlPath = urlPath.replace(`{${"vendor"}}`, encodeURIComponent(String(requestParameters['vendor'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.ConnectCdpRequestToJSON)(requestParameters['connectCdpRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CdpVendorResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Both take credentials.writeKey, copied from your source\'s settings. RudderStack additionally requires credentials.dataPlaneUrl, an absolute https:// address: it is the hostname events are sent to and there is no default, so a connection without one is refused before anything is stored. Both accept an optional credentials.sharedSecret; set the same value on the vendor\'s webhook destination and inbound deliveries are signature-verified as well as routed by the secret URL. NO VENDOR CALL IS MADE: neither platform exposes anything that validates a write key without writing a synthetic event into your own analytics stream, so the check is a local shape check and a mistyped key is discovered by the first forward, which marks the connection DEGRADED. Returns inboundUrl ONCE — paste it into the vendor\'s Webhooks destination. It is never returned again and reconnecting rotates it. Credentials are encrypted at rest and are never returned by any endpoint. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Connect Segment or RudderStack for this workspace
+     */
+    async connectIntegrationsCdp(requestParameters, initOverrides) {
+        const response = await this.connectIntegrationsCdpRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * What this CDP has delivered, newest first
+     */
+    async eventsIntegrationsRaw(requestParameters, initOverrides) {
+        if (requestParameters['vendor'] == null) {
+            throw new runtime.RequiredError('vendor', 'Required parameter "vendor" was null or undefined when calling eventsIntegrations().');
+        }
+        const queryParameters = {};
+        if (requestParameters['eventName'] != null) {
+            queryParameters['eventName'] = requestParameters['eventName'];
+        }
+        if (requestParameters['cursor'] != null) {
+            queryParameters['cursor'] = requestParameters['cursor'];
+        }
+        if (requestParameters['limit'] != null) {
+            queryParameters['limit'] = requestParameters['limit'];
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/cdp/{vendor}/events`;
+        urlPath = urlPath.replace(`{${"vendor"}}`, encodeURIComponent(String(requestParameters['vendor'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CursorPageCdpInboundEventResponseFromJSON)(jsonValue));
+    }
+    /**
+     * The answer to \'my event fired in Segment, why did nothing happen here\'. Every authenticated delivery is recorded with what it did: CONTACT_UPSERTED, CONTACT_NOT_CREATED (an identify for somebody you do not hold, with identifyCreatesContacts off), TRACK_ANNOUNCED, TRACK_UNRESOLVED (the commonest by far — a CDP tracks anonymous visitors), IGNORED (a page/screen/group/alias call, or a duplicate) or UNPARSEABLE. Cursor-paginated on the CDP\'s own timestamp, default 25 and max 100. The identity the CDP named is deliberately NOT returned — it is encrypted at rest as PII; contactId answers the same question better. Reads < 300ms. Requires API-key scope: integrations:read.
+     * What this CDP has delivered, newest first
+     */
+    async eventsIntegrations(requestParameters, initOverrides) {
+        const response = await this.eventsIntegrationsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Change what this CDP does in each direction
+     */
+    async updateSettingsIntegrationsCdpRaw(requestParameters, initOverrides) {
+        if (requestParameters['vendor'] == null) {
+            throw new runtime.RequiredError('vendor', 'Required parameter "vendor" was null or undefined when calling updateSettingsIntegrationsCdp().');
+        }
+        if (requestParameters['updateCdpSettingsRequest'] == null) {
+            throw new runtime.RequiredError('updateCdpSettingsRequest', 'Required parameter "updateCdpSettingsRequest" was null or undefined when calling updateSettingsIntegrationsCdp().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/cdp/{vendor}/settings`;
+        urlPath = urlPath.replace(`{${"vendor"}}`, encodeURIComponent(String(requestParameters['vendor'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.UpdateCdpSettingsRequestToJSON)(requestParameters['updateCdpSettingsRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CdpVendorResponseFromJSON)(jsonValue));
+    }
+    /**
+     * identifyCreatesContacts governs whether an inbound identify for somebody this workspace does not hold may create a contact; it defaults FALSE on connect, because a CDP holds every visitor your site has ever seen. Contacts created this way carry no consent on any channel — they can be segmented and reported on, and cannot be messaged. forwardEnabled and forwardedEvents govern the outbound half: send a list to narrow forwardedEvents, [\"*\"] alone to reset it to every subscribable type (the default a connection starts with), or an empty list to forward nothing. Any omitted or null field keeps its current value — forwardedEvents included, which is why the reset is an explicit value rather than null. Writes < 500ms. Requires API-key scope: integrations:write.
+     * Change what this CDP does in each direction
+     */
+    async updateSettingsIntegrationsCdp(requestParameters, initOverrides) {
+        const response = await this.updateSettingsIntegrationsCdpRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List both customer data platforms and this workspace\'s settings for them
+     */
+    async vendorsIntegrationsRaw(initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/cdp/vendors`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(index_1.CdpVendorResponseFromJSON));
+    }
+    /**
+     * Status comes from the shared connection substrate, so a vendor\'s status here always matches GET /api/v1/integrations/{vendor}. lastErrorCode is the last forwarding failure and is the health signal for these vendors: neither publishes anything a probe could read, so a connection\'s health is what the last real forward did. forwardedEvents null means every subscribable type; an empty list means none. inboundUrl is always null here — it is returned by connect only. Never returns a credential. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List both customer data platforms and this workspace\'s settings for them
+     */
+    async vendorsIntegrations(initOverrides) {
+        const response = await this.vendorsIntegrationsRaw(initOverrides);
+        return await response.value();
+    }
+}
+exports.CdpApi = CdpApi;

package/dist/generated/src/apis/CdpWebhookApi.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+export interface ReceiveWebhooksCdpRequest {
+    vendor: string;
+    token: string;
+    xIdempotencyKey?: string;
+    body?: string;
+}
+/**
+ * CdpWebhookApi - interface
+ *
+ * @export
+ * @interface CdpWebhookApiInterface
+ */
+export interface CdpWebhookApiInterface {
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * @summary Customer data platform webhook (Segment, RudderStack)
+     * @param {string} vendor
+     * @param {string} token
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {string} [body]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof CdpWebhookApiInterface
+     */
+    receiveWebhooksCdpRaw(requestParameters: ReceiveWebhooksCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * Customer data platform webhook (Segment, RudderStack)
+     */
+    receiveWebhooksCdp(requestParameters: ReceiveWebhooksCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}
+/**
+ *
+ */
+export declare class CdpWebhookApi extends runtime.BaseAPI implements CdpWebhookApiInterface {
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * Customer data platform webhook (Segment, RudderStack)
+     */
+    receiveWebhooksCdpRaw(requestParameters: ReceiveWebhooksCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * Customer data platform webhook (Segment, RudderStack)
+     */
+    receiveWebhooksCdp(requestParameters: ReceiveWebhooksCdpRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}

package/dist/generated/src/apis/CdpWebhookApi.js

@@ -0,0 +1,102 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CdpWebhookApi = void 0;
+const runtime = __importStar(require("../runtime"));
+/**
+ *
+ */
+class CdpWebhookApi extends runtime.BaseAPI {
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * Customer data platform webhook (Segment, RudderStack)
+     */
+    async receiveWebhooksCdpRaw(requestParameters, initOverrides) {
+        if (requestParameters['vendor'] == null) {
+            throw new runtime.RequiredError('vendor', 'Required parameter "vendor" was null or undefined when calling receiveWebhooksCdp().');
+        }
+        if (requestParameters['token'] == null) {
+            throw new runtime.RequiredError('token', 'Required parameter "token" was null or undefined when calling receiveWebhooksCdp().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/webhooks/cdp/{vendor}/{token}`;
+        urlPath = urlPath.replace(`{${"vendor"}}`, encodeURIComponent(String(requestParameters['vendor'])));
+        urlPath = urlPath.replace(`{${"token"}}`, encodeURIComponent(String(requestParameters['token'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: requestParameters['body'],
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Where a Segment-spec identify or track arrives. Point your vendor\'s generic Webhooks destination at the URL returned once by POST /api/v1/integrations/cdp/{vendor}. Authenticated by the unguessable path token plus, when you configured a shared secret, an HMAC-SHA1 signature over the raw body on X-Signature — never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and people this workspace does not hold: a CDP disables a destination that answers non-2xx. Idempotent — a replayed delivery is recognised by its own messageId and changes nothing. An identify fills in or (only if you turned that on) creates a contact; a track enrols a matched contact into automations waiting on CDP_EVENT. Nothing here can grant messaging consent on any channel. page, screen, group and alias calls are accepted and ignored. Webhook ingest < 1s.
+     * Customer data platform webhook (Segment, RudderStack)
+     */
+    async receiveWebhooksCdp(requestParameters, initOverrides) {
+        await this.receiveWebhooksCdpRaw(requestParameters, initOverrides);
+    }
+}
+exports.CdpWebhookApi = CdpWebhookApi;