
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@codat/platform
Advanced tools
<!-- Start Codat Library Description --> Manage the building blocks of Codat, including companies, connections, and more. <!-- End Codat Library Description -->
Manage the building blocks of Codat, including companies, connections, and more.
Platform API: Platform API
An API for the common components of all of Codat's products.
These end points cover creating and managing your companies, data connections, and integrations.
Read about the building blocks of Codat... | See our OpenAPI spec
| Endpoints | Description |
|---|---|
| Companies | Create and manage your SMB users' companies. |
| Connections | Create new and manage existing data connections for a company. |
| Connection management | Configure connection management UI and retrieve access tokens for authentication. |
| Webhooks | Create and manage webhooks that listen to Codat's events. |
| Integrations | Get a list of integrations supported by Codat and their logos. |
| Refresh data | Initiate data refreshes, view pull status and history. |
| Settings | Manage company profile configuration, sync settings, and API keys. |
| Push data | Initiate and monitor Create, Update, and Delete operations. |
| Supplemental data | Configure and pull additional data you can include in Codat's standard data types. |
| Custom data type | Configure and pull additional data types that are not included in Codat's standardized data model. |
The SDK can be installed with either npm, pnpm, bun or yarn package managers.
npm add @codat/platform
pnpm add @codat/platform
bun add @codat/platform
yarn add @codat/platform zod
# Note that Yarn does not install peer dependencies automatically. You will need
# to install zod as shown above.
This SDK is also an installable MCP server where the various SDK methods are exposed as tools that can be invoked by AI applications.
Node.js v20 or greater is required to run the MCP server from npm.
Add the following server definition to your claude_desktop_config.json file:
{
"mcpServers": {
"CodatPlatform": {
"command": "npx",
"args": [
"-y", "--package", "@codat/platform",
"--",
"mcp", "start",
"--auth-header", "..."
]
}
}
}
Create a .cursor/mcp.json file in your project root with the following content:
{
"mcpServers": {
"CodatPlatform": {
"command": "npx",
"args": [
"-y", "--package", "@codat/platform",
"--",
"mcp", "start",
"--auth-header", "..."
]
}
}
}
You can also run MCP servers as a standalone binary with no additional dependencies. You must pull these binaries from available Github releases:
curl -L -o mcp-server \
https://github.com/{org}/{repo}/releases/download/{tag}/mcp-server-bun-darwin-arm64 && \
chmod +x mcp-server
If the repo is a private repo you must add your Github PAT to download a release -H "Authorization: Bearer {GITHUB_PAT}".
{
"mcpServers": {
"Todos": {
"command": "./DOWNLOAD/PATH/mcp-server",
"args": [
"start"
]
}
}
}
For a full list of server arguments, run:
npx -y --package @codat/platform -- mcp start --help
import { CodatPlatform } from "@codat/platform";
const codatPlatform = new CodatPlatform();
async function run() {
await codatPlatform.companyCreated({
id: "ba29118f-5406-4e59-b05c-ba307ca38d01",
eventType: "company.created",
generatedDate: "2024-08-08T17:10:34.015Z",
payload: {
id: "0498e921-9b53-4396-a412-4f2f5983b0a2",
name: "Bank of Dave",
description: "Requested a loan for refurb.",
redirect:
"https://link.codat.io/company/0498e921-9b53-4396-a412-4f2f5983b0a2",
lastSync: "2022-01-01T12:00:00.000Z",
created: "2022-01-01T12:00:00.000Z",
tags: {
"customerRegion": "us",
"uid": "335a086e-8563-4b03-94e3-39544225ecb6",
},
},
});
}
run();
All the methods listed above are available as standalone functions. These functions are ideal for use in applications running in the browser, serverless runtimes or other environments where application bundle size is a primary concern. When using a bundler to build your application, all unused functionality will be either excluded from the final bundle or tree-shaken away.
To read more about standalone functions, check FUNCTIONS.md.
companiesAddProduct - Add productcompaniesCreate - Create companycompaniesDelete - Delete a companycompaniesGet - Get companycompaniesGetAccessToken - Get company access tokencompaniesList - List companiescompaniesRefreshProductData - Refresh product datacompaniesRemoveProduct - Remove productcompaniesReplace - Replace companycompaniesUpdate - Update companyconnectionsCreate - Create connectionconnectionsDelete - Delete connectionconnectionsGet - Get connectionconnectionsList - List connectionsconnectionsUnlink - Unlink connectionconnectionsUpdateAuthorization - Update authorizationcustomDataTypeConfigure - Configure custom data typecustomDataTypeGetConfiguration - Get custom data configurationcustomDataTypeList - List custom data type recordscustomDataTypeRefresh - Refresh custom data typeintegrationsGet - Get integrationintegrationsGetBranding - Get brandingintegrationsList - List integrationspushDataGetModelOptions - Get push optionspushDataGetOperation - Get push operationpushDataListOperations - List push operationsreadDataGetValidationResults - Get validation resultsrefreshDataAll - Refresh all datarefreshDataByDataType - Refresh data typerefreshDataGet - Get data statusrefreshDataGetPullOperation - Get pull operationrefreshDataListPullOperations - List pull operationssettingsCreateApiKey - Create API keysettingsDeleteApiKey - Delete API keysettingsGet - Get CORS settingssettingsGetProfile - Get profilesettingsGetSyncSettings - Get sync settingssettingsListApiKeys - List API keyssettingsSet - Set CORS settingssettingsUpdateProfile - Update profilesettingsUpdateSyncSettings - Update all sync settingssupplementalDataConfigure - ConfiguresupplementalDataGetConfiguration - Get configurationwebhooksCreateConsumer - Create webhook consumerwebhooksDeleteConsumer - Delete webhook consumerwebhooksListConsumers - List webhook consumersconnectionManagementGetcompaniesGetAccessToken instead.corsGetsettingsGet instead.corsSetsettingsSet instead.Some of the endpoints in this SDK support retries. If you use the SDK without any configuration, it will fall back to the default retry strategy provided by the API. However, the default retry strategy can be overridden on a per-operation basis, or across the entire SDK.
To change the default retry strategy for a single API call, simply provide a retryConfig object to the call:
import { CodatPlatform } from "@codat/platform";
const codatPlatform = new CodatPlatform({
authHeader: "Basic BASE_64_ENCODED(API_KEY)",
});
async function run() {
const result = await codatPlatform.companies.list({
query: "id=e3334455-1aed-4e71-ab43-6bccf12092ee",
orderBy: "-modifiedDate",
tags: "region=uk && team=invoice-finance",
}, {
retries: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
});
console.log(result);
}
run();
If you'd like to override the default retry strategy for all operations that support retries, you can provide a retryConfig at SDK initialization:
import { CodatPlatform } from "@codat/platform";
const codatPlatform = new CodatPlatform({
retryConfig: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
authHeader: "Basic BASE_64_ENCODED(API_KEY)",
});
async function run() {
const result = await codatPlatform.companies.list({
query: "id=e3334455-1aed-4e71-ab43-6bccf12092ee",
orderBy: "-modifiedDate",
tags: "region=uk && team=invoice-finance",
});
console.log(result);
}
run();
This table shows properties which are common on error classes. For full details see error classes.
| Property | Type | Description |
|---|---|---|
error.name | string | Error class name eg SDKError |
error.message | string | Error message |
error.statusCode | number | HTTP status code eg 404 |
error.contentType | string | HTTP content type eg application/json |
error.body | string | HTTP body. Can be empty string if no body is returned. |
error.rawResponse | Response | Raw HTTP response. Access to headers and more. |
error.data$ | Optional. Some errors may contain structured data. See Error Classes. |
import { CodatPlatform } from "@codat/platform";
import * as errors from "@codat/platform/sdk/models/errors";
const codatPlatform = new CodatPlatform({
authHeader: "Basic BASE_64_ENCODED(API_KEY)",
});
async function run() {
try {
const result = await codatPlatform.companies.list({
query: "id=e3334455-1aed-4e71-ab43-6bccf12092ee",
orderBy: "-modifiedDate",
tags: "region=uk && team=invoice-finance",
});
console.log(result);
} catch (error) {
// Depending on the method different errors may be thrown
if (error instanceof errors.ErrorMessage) {
console.log(error.message);
console.log(error.data$.statusCode); // number
console.log(error.data$.service); // string
console.log(error.data$.error); // string
console.log(error.data$.correlationId); // string
console.log(error.data$.validation); // shared.ErrorValidation
}
// Fallback error class, if no other more specific error class is matched
if (error instanceof errors.SDKError) {
console.log(error.message);
console.log(error.statusCode);
console.log(error.body);
console.log(error.rawResponse.headers);
}
}
}
run();
ErrorMessage: Your query parameter was not correctly formed.SDKError: The fallback error class, if no other more specific error class is matched.SDKValidationError: Type mismatch between the data returned from the server and the structure expected by the SDK. This can also be thrown for invalid method arguments. See error.rawValue for the raw value and error.pretty() for a nicely formatted multi-line string.ConnectionError: HTTP client was unable to make a request to a server.RequestTimeoutError: HTTP request timed out due to an AbortSignal signal.RequestAbortedError: HTTP request was aborted by the client.InvalidRequestError: Any input used to create a request is invalid.UnexpectedClientError: Unrecognised or unexpected error.The default server can be overridden globally by passing a URL to the serverURL: string optional parameter when initializing the SDK client instance. For example:
import { CodatPlatform } from "@codat/platform";
const codatPlatform = new CodatPlatform({
serverURL: "https://api.codat.io",
authHeader: "Basic BASE_64_ENCODED(API_KEY)",
});
async function run() {
const result = await codatPlatform.companies.list({
query: "id=e3334455-1aed-4e71-ab43-6bccf12092ee",
orderBy: "-modifiedDate",
tags: "region=uk && team=invoice-finance",
});
console.log(result);
}
run();
The TypeScript SDK makes API calls using an HTTPClient that wraps the native
Fetch API. This
client is a thin wrapper around fetch and provides the ability to attach hooks
around the request lifecycle that can be used to modify the request or handle
errors and response.
The HTTPClient constructor takes an optional fetcher argument that can be
used to integrate a third-party HTTP client or when writing tests to mock out
the HTTP client and feed in fixtures.
The following example shows how to use the "beforeRequest" hook to to add a
custom header and a timeout to requests and how to use the "requestError" hook
to log errors:
import { CodatPlatform } from "@codat/platform";
import { HTTPClient } from "@codat/platform/lib/http";
const httpClient = new HTTPClient({
// fetcher takes a function that has the same signature as native `fetch`.
fetcher: (request) => {
return fetch(request);
}
});
httpClient.addHook("beforeRequest", (request) => {
const nextRequest = new Request(request, {
signal: request.signal || AbortSignal.timeout(5000)
});
nextRequest.headers.set("x-custom-header", "custom value");
return nextRequest;
});
httpClient.addHook("requestError", (error, request) => {
console.group("Request Error");
console.log("Reason:", `${error}`);
console.log("Endpoint:", `${request.method} ${request.url}`);
console.groupEnd();
});
const sdk = new CodatPlatform({ httpClient });
This SDK supports the following security scheme globally:
| Name | Type | Scheme |
|---|---|---|
authHeader | apiKey | API key |
To authenticate with the API the authHeader parameter must be set when initializing the SDK client instance. For example:
import { CodatPlatform } from "@codat/platform";
const codatPlatform = new CodatPlatform({
authHeader: "Basic BASE_64_ENCODED(API_KEY)",
});
async function run() {
const result = await codatPlatform.companies.list({
query: "id=e3334455-1aed-4e71-ab43-6bccf12092ee",
orderBy: "-modifiedDate",
tags: "region=uk && team=invoice-finance",
});
console.log(result);
}
run();
For supported JavaScript runtimes, please consult RUNTIMES.md.
You can setup your SDK to emit debug logs for SDK requests and responses.
You can pass a logger that matches console's interface as an SDK option.
[!WARNING] Beware that debug logging will reveal secrets, like API tokens in headers, in log messages printed to a console or files. It's recommended to use this feature only during local development and not in production.
import { CodatPlatform } from "@codat/platform";
const sdk = new CodatPlatform({ debugLogger: console });
If you encounter any challenges while utilizing our SDKs, please don't hesitate to reach out for assistance. You can raise any issues by contacting your dedicated Codat representative or reaching out to our support team. We're here to help ensure a smooth experience for you.
FAQs
<!-- Start Codat Library Description --> Manage the building blocks of Codat, including companies, connections, and more. <!-- End Codat Library Description -->
The npm package @codat/platform receives a total of 735 weekly downloads. As such, @codat/platform popularity was classified as not popular.
We found that @codat/platform demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.