Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@vercel/sdk
Advanced tools
Develop. Preview. Ship.
The @vercel/sdk
is a type-safe Typescript SDK that gives you full control over the entire Vercel platform through the Vercel REST API.
The SDK can be installed with either npm, pnpm, bun or yarn package managers.
npm add @vercel/sdk
pnpm add @vercel/sdk
bun add @vercel/sdk
yarn add @vercel/sdk zod
# Note that Yarn does not install peer dependencies automatically. You will need
# to install zod as shown above.
[!NOTE] This package is published as an ES Module (ESM) only. For applications using CommonJS, use
await import("@vercel/sdk")
to import and use this package.
For supported JavaScript runtimes, please consult RUNTIMES.md.
You need to pass a valid access token to be able to use any resource or operation. Refer to Creating an Access Token to learn how to create one. Make sure that you create a token with the correct Vercel scope. If you face permission (403) errors when you are already sending a token, it can be one of the following problems:
This SDK supports the following security scheme globally:
Name | Type | Scheme |
---|---|---|
bearerToken | http | HTTP Bearer |
To authenticate with the API the bearerToken
parameter must be set when initializing the SDK client instance. For example:
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.accessGroups.readAccessGroup({
idOrName: "<value>",
});
// Handle the result
console.log(result);
}
run();
List deployments under the authenticated user or team.
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.deployments.getDeployments({
app: "docs",
from: 1612948664566,
limit: 10,
projectId: "QmXGTs7mvAMMC7WW5ebrM33qKG32QK3h4vmQMjmY",
target: "production",
to: 1612948664566,
users: "kr1PsOIzqEL5Xg6M4VZcZosf,K4amb7K9dAt5R2vBJWF32bmY",
since: 1540095775941,
until: 1540095775951,
state: "BUILDING,READY",
});
// Handle the result
console.log(result);
}
run();
Update the fields of a project using either its name or id.
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.projects.updateProject({
idOrName: "prj_12HKQaOmR5t5Uy6vdcQsNIiZgHGB",
requestBody: {
name: "a-project-name",
},
});
// Handle the result
console.log(result);
}
run();
id
All the methods listed above are available as standalone functions. These functions are ideal for use in applications running in the browser, serverless runtimes or other environments where application bundle size is a primary concern. When using a bundler to build your application, all unused functionality will be either excluded from the final bundle or tree-shaken away.
To read more about standalone functions, check FUNCTIONS.md.
accessGroupsCreateAccessGroup
- Creates an access groupaccessGroupsDeleteAccessGroup
- Deletes an access groupaccessGroupsListAccessGroupMembers
- List members of an access groupaccessGroupsListAccessGroupProjects
- List projects of an access groupaccessGroupsListAccessGroups
- List access groups for a team, project or memberaccessGroupsReadAccessGroup
- Reads an access groupaccessGroupsUpdateAccessGroup
- Update an access groupaliasesAssignAlias
- Assign an AliasaliasesDeleteAlias
- Delete an AliasaliasesGetAlias
- Get an AliasaliasesListAliases
- List aliasesaliasesListDeploymentAliases
- List Deployment AliasesartifactsArtifactExists
- Check if a cache artifact existsartifactsArtifactQuery
- Query information about an artifactartifactsDownloadArtifact
- Download a cache artifactartifactsRecordEvents
- Record an artifacts cache usage eventartifactsStatus
- Get status of Remote Caching for this principalartifactsUploadArtifact
- Upload a cache artifactauthenticationCreateAuthToken
- Create an Auth TokenauthenticationDeleteAuthToken
- Delete an authentication tokenauthenticationGetAuthToken
- Get Auth Token MetadataauthenticationListAuthTokens
- List Auth TokenscertsGetCertById
- Get cert by idcertsIssueCert
- Issue a new certcertsRemoveCert
- Remove certcertsUploadCert
- Upload a certchecksCreateCheck
- Creates a new CheckchecksGetAllChecks
- Retrieve a list of all checkschecksGetCheck
- Get a single checkchecksRerequestCheck
- Rerequest a checkchecksUpdateCheck
- Update a checkdeploymentsCancelDeployment
- Cancel a deploymentdeploymentsCreateDeployment
- Create a new deploymentdeploymentsDeleteDeployment
- Delete a DeploymentdeploymentsGetDeployment
- Get a deployment by ID or URLdeploymentsGetDeploymentEvents
- Get deployment eventsdeploymentsGetDeploymentFileContents
- Get Deployment File ContentsdeploymentsGetDeployments
- List deploymentsdeploymentsListDeploymentFiles
- List Deployment FilesdeploymentsUploadFile
- Upload Deployment FilesdnsCreateRecord
- Create a DNS recorddnsGetRecords
- List existing DNS recordsdnsRemoveRecord
- Delete a DNS recorddnsUpdateRecord
- Update an existing DNS recorddomainsBuyDomain
- Purchase a domaindomainsCheckDomainPrice
- Check the price for a domaindomainsCheckDomainStatus
- Check a Domain AvailabilitydomainsCreateOrTransferDomain
- Register or transfer-in a new DomaindomainsDeleteDomain
- Remove a domain by namedomainsGetDomain
- Get Information for a Single DomaindomainsGetDomainConfig
- Get a Domain's configurationdomainsGetDomains
- List all the domainsdomainsGetDomainTransfer
- Get domain transfer info.domainsPatchDomain
- Update or move apex domainedgeConfigCreateEdgeConfig
- Create an Edge ConfigedgeConfigCreateEdgeConfigToken
- Create an Edge Config tokenedgeConfigDeleteEdgeConfig
- Delete an Edge ConfigedgeConfigDeleteEdgeConfigSchema
- Delete an Edge Config's schemaedgeConfigDeleteEdgeConfigTokens
- Delete one or more Edge Config tokensedgeConfigGetEdgeConfig
- Get an Edge ConfigedgeConfigGetEdgeConfigBackup
- Get Edge Config backupedgeConfigGetEdgeConfigBackups
- Get Edge Config backupsedgeConfigGetEdgeConfigItem
- Get an Edge Config itemedgeConfigGetEdgeConfigItems
- Get Edge Config itemsedgeConfigGetEdgeConfigs
- Get Edge ConfigsedgeConfigGetEdgeConfigSchema
- Get Edge Config schemaedgeConfigGetEdgeConfigToken
- Get Edge Config token meta dataedgeConfigGetEdgeConfigTokens
- Get all tokens of an Edge ConfigedgeConfigPatchEdgeConfigSchema
- Update Edge Config schemaedgeConfigUpdateEdgeConfig
- Update an Edge ConfigintegrationsDeleteConfiguration
- Delete an integration configurationintegrationsGetConfiguration
- Retrieve an integration configurationintegrationsGetConfigurations
- Get configurations for the authenticated user or teamintegrationsGitNamespaces
- List git namespaces by providerintegrationsSearchRepo
- List git repositories linked to namespace by providerlogDrainsCreateConfigurableLogDrain
- Creates a Configurable Log DrainlogDrainsCreateLogDrain
- Creates a new Integration Log DrainlogDrainsDeleteConfigurableLogDrain
- Deletes a Configurable Log DrainlogDrainsDeleteIntegrationLogDrain
- Deletes the Integration log drain with the provided id
logDrainsGetAllLogDrains
- Retrieves a list of all the Log DrainslogDrainsGetConfigurableLogDrain
- Retrieves a Configurable Log DrainlogDrainsGetIntegrationLogDrains
- Retrieves a list of Integration log drainsprojectMembersAddProjectMember
- Adds a new member to a project.projectMembersGetProjectMembers
- List project membersprojectMembersRemoveProjectMember
- Remove a Project MemberprojectsAddProjectDomain
- Add a domain to a projectprojectsCreateProject
- Create a new projectprojectsCreateProjectEnv
- Create one or more environment variablesprojectsDeleteProject
- Delete a ProjectprojectsEditProjectEnv
- Edit an environment variableprojectsFilterProjectEnvs
- Retrieve the environment variables of a project by id or nameprojectsGetProjectDomain
- Get a project domainprojectsGetProjectEnv
- Retrieve the decrypted value of an environment variable of a project by idprojectsGetProjects
- Retrieve a list of projectsprojectsListPromoteAliases
- Gets a list of aliases with status for the current promoteprojectsPauseProject
- Pause a projectprojectsRemoveProjectDomain
- Remove a domain from a projectprojectsRemoveProjectEnv
- Remove an environment variableprojectsRequestPromote
- Points all production domains for a project to the given deployprojectsUnpauseProject
- Unpause a projectprojectsUpdateProject
- Update an existing projectprojectsUpdateProjectDataCache
- Update the data cache featureprojectsUpdateProjectDomain
- Update a project domainprojectsUpdateProjectProtectionBypass
- Update Protection Bypass for AutomationprojectsVerifyProjectDomain
- Verify project domainsecurityGetFirewallConfig
- Read Firewall ConfigurationsecurityPutFirewallConfig
- Put Firewall ConfigurationsecurityUpdateAttackChallengeMode
- Update Attack Challenge modesecurityUpdateFirewallConfig
- Update Firewall ConfigurationteamsCreateTeam
- Create a TeamteamsDeleteTeam
- Delete a TeamteamsDeleteTeamInviteCode
- Delete a Team invite codeteamsGetTeam
- Get a TeamteamsGetTeamAccessRequest
- Get access request statusteamsGetTeamMembers
- List team membersteamsGetTeams
- List all teamsteamsInviteUserToTeam
- Invite a userteamsJoinTeam
- Join a teamteamsPatchTeam
- Update a TeamteamsRemoveTeamMember
- Remove a Team MemberteamsRequestAccessToTeam
- Request access to a teamteamsUpdateTeamMember
- Update a Team MemberuserGetAuthUser
- Get the UseruserListUserEvents
- List User EventsuserRequestDelete
- Delete User AccountwebhooksCreateWebhook
- Creates a webhookwebhooksDeleteWebhook
- Deletes a webhookwebhooksGetWebhook
- Get a webhookwebhooksGetWebhooks
- Get a list of webhooksCertain SDK methods accept files as part of a multi-part request. It is possible and typically recommended to upload files as a stream rather than reading the entire contents into memory. This avoids excessive memory consumption and potentially crashing with out-of-memory errors when working with very large files. The following example demonstrates how to attach a file stream to a request.
[!TIP]
Depending on your JavaScript runtime, there are convenient utilities that return a handle to a file without reading the entire contents into memory:
- Node.js v20+: Since v20, Node.js comes with a native
openAsBlob
function innode:fs
.- Bun: The native
Bun.file
function produces a file handle that can be used for streaming file uploads.- Browsers: All supported browsers return an instance to a
File
when reading the value from an<input type="file">
element.- Node.js v18: A file stream can be created using the
fileFrom
helper fromfetch-blob/from.js
.
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.artifacts.uploadArtifact({
contentLength: 4036.54,
xArtifactDuration: 400,
xArtifactClientCi: "VERCEL",
xArtifactClientInteractive: 0,
xArtifactTag: "Tc0BmHvJYMIYJ62/zx87YqO0Flxk+5Ovip25NY825CQ=",
hash: "12HKQaOmR5t5Uy6vdcQsNIiZgHGB",
});
// Handle the result
console.log(result);
}
run();
Some of the endpoints in this SDK support retries. If you use the SDK without any configuration, it will fall back to the default retry strategy provided by the API. However, the default retry strategy can be overridden on a per-operation basis, or across the entire SDK.
To change the default retry strategy for a single API call, simply provide a retryConfig object to the call:
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.accessGroups.readAccessGroup({
idOrName: "<value>",
}, {
retries: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
});
// Handle the result
console.log(result);
}
run();
If you'd like to override the default retry strategy for all operations that support retries, you can provide a retryConfig at SDK initialization:
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
retryConfig: {
strategy: "backoff",
backoff: {
initialInterval: 1,
maxInterval: 50,
exponent: 1.1,
maxElapsedTime: 100,
},
retryConnectionErrors: false,
},
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.accessGroups.readAccessGroup({
idOrName: "<value>",
});
// Handle the result
console.log(result);
}
run();
All SDK methods return a response object or throw an error. By default, an API error will throw a errors.SDKError
.
If a HTTP request fails, an operation my also throw an error from the models/errors/httpclienterrors.ts
module:
HTTP Client Error | Description |
---|---|
RequestAbortedError | HTTP request was aborted by the client |
RequestTimeoutError | HTTP request timed out due to an AbortSignal signal |
ConnectionError | HTTP client was unable to make a request to a server |
InvalidRequestError | Any input used to create a request is invalid |
UnexpectedClientError | Unrecognised or unexpected error |
In addition, when custom error responses are specified for an operation, the SDK may throw their associated Error type. You can refer to respective Errors tables in SDK docs for more details on possible error types for each operation. For example, the readAccessGroup
method may throw the following errors:
Error Type | Status Code | Content Type |
---|---|---|
errors.SDKError | 4XX, 5XX | */* |
import { Vercel } from "@vercel/sdk";
import { SDKValidationError } from "@vercel/sdk/models/errors/sdkvalidationerror.js";
const vercel = new Vercel({
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
let result;
try {
result = await vercel.accessGroups.readAccessGroup({
idOrName: "<value>",
});
// Handle the result
console.log(result);
} catch (err) {
switch (true) {
case (err instanceof SDKValidationError): {
// Validation errors can be pretty-printed
console.error(err.pretty());
// Raw value may also be inspected
console.error(err.rawValue);
return;
}
default: {
throw err;
}
}
}
}
run();
Validation errors can also occur when either method arguments or data returned from the server do not match the expected format. The SDKValidationError
that is thrown as a result will capture the raw value that failed validation in an attribute called rawValue
. Additionally, a pretty()
method is available on this error that can be used to log a nicely formatted string since validation errors can list many issues and the plain error string may be difficult read when debugging.
The default server can also be overridden globally by passing a URL to the serverURL: string
optional parameter when initializing the SDK client instance. For example:
import { Vercel } from "@vercel/sdk";
const vercel = new Vercel({
serverURL: "https://api.vercel.com",
bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});
async function run() {
const result = await vercel.accessGroups.readAccessGroup({
idOrName: "<value>",
});
// Handle the result
console.log(result);
}
run();
The TypeScript SDK makes API calls using an HTTPClient
that wraps the native
Fetch API. This
client is a thin wrapper around fetch
and provides the ability to attach hooks
around the request lifecycle that can be used to modify the request or handle
errors and response.
The HTTPClient
constructor takes an optional fetcher
argument that can be
used to integrate a third-party HTTP client or when writing tests to mock out
the HTTP client and feed in fixtures.
The following example shows how to use the "beforeRequest"
hook to to add a
custom header and a timeout to requests and how to use the "requestError"
hook
to log errors:
import { Vercel } from "@vercel/sdk";
import { HTTPClient } from "@vercel/sdk/lib/http";
const httpClient = new HTTPClient({
// fetcher takes a function that has the same signature as native `fetch`.
fetcher: (request) => {
return fetch(request);
}
});
httpClient.addHook("beforeRequest", (request) => {
const nextRequest = new Request(request, {
signal: request.signal || AbortSignal.timeout(5000)
});
nextRequest.headers.set("x-custom-header", "custom value");
return nextRequest;
});
httpClient.addHook("requestError", (error, request) => {
console.group("Request Error");
console.log("Reason:", `${error}`);
console.log("Endpoint:", `${request.method} ${request.url}`);
console.groupEnd();
});
const sdk = new Vercel({ httpClient });
You can setup your SDK to emit debug logs for SDK requests and responses.
You can pass a logger that matches console
's interface as an SDK option.
[!WARNING] Beware that debug logging will reveal secrets, like API tokens in headers, in log messages printed to a console or files. It's recommended to use this feature only during local development and not in production.
import { Vercel } from "@vercel/sdk";
const sdk = new Vercel({ debugLogger: console });
This SDK is in beta, and there may be breaking changes between versions without a major version update. Therefore, we recommend pinning usage to a specific package version. This way, you can install the same version each time without breaking changes unless you are intentionally looking for the latest version.
While we value open-source contributions to this SDK, this library is generated programmatically. Any manual changes added to internal files will be overwritten on the next generation. We look forward to hearing your feedback. Feel free to open a PR or an issue with a proof of concept and we'll do our best to include it in a future release.
FAQs
Vercel Develop. Preview. Ship.
We found that @vercel/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.