TypeScript SDK | MOSS Partner API
moss-partner-sdk · npm v0.2.0 · Node 18+

TypeScript SDK

The official MOSS Partner SDK for TypeScript and Node.js. Full programmatic access to the Partner API: create customers, promote them to production, manage webhooks, and download compliance reports. Fully typed, with snake_case fields matching the REST API exactly.

Install

bash
npm install moss-partner-sdk

Quickstart

Initialize the client with your prt_ partner key, then create a customer. The customer token is returned once. Store it securely.

typescript
import { MossPartner } from 'moss-partner-sdk';

const moss = new MossPartner({ apiKey: 'prt_your_key' });

// Create a sandbox customer
const customer = await moss.customers.create({
  external_id: 'acme_123',
  name: 'Acme Corp',
  tier: 'platform',
});
console.log(customer.customer_id);
console.log(customer.credentials?.customer_token?.token);

Working with customers

List, fetch, and update customers with methods that mirror the REST resource.

typescript
// List customers, optionally filtered by status
const { customers } = await moss.customers.list({ status: 'sandbox_active' });
for (const c of customers) console.log(c.name, c.status);

// Fetch one customer
const customer = await moss.customers.get('cust-uuid');

// Update limits
await moss.customers.update('cust-uuid', { limits: { agents: 50 } });

Promote to production

Check readiness, then promote with a signed attestation and billing details. The attestation record is signed with ML-DSA-44 and is immutable.

typescript
const readiness = await moss.customers.promotionReadiness('cust-uuid');
if (!readiness.ready) console.log('Blockers:', readiness.blockers);

const result = await moss.customers.promote('cust-uuid', {
  attestation: {
    kyc_completed: true,
    kyc_provider: 'Onfido',
    terms_accepted: true,
    compliance_reviewed: true,
  },
  billing: { tier: 'platform', billing_email: 'billing@acme.com' },
});
console.log(result.credentials.production_token.token); // returned once

Invite users & sessions

Invite a customer admin to the Customer Portal, or mint a short-lived session token to embed the MOSS dashboard in your own product.

typescript
await moss.customers.invite('cust-uuid', { email: 'admin@acme.com', role: 'admin' });

const session = await moss.customers.createSession('cust-uuid');
console.log(session.token, session.expires_at);

Verify webhook signatures

MOSS signs "{timestamp}.{body}" with HMAC-SHA256 using your shared secret. The SDK ships a constant-time verifier.

typescript
// In your webhook handler (e.g. Express):
const isValid = moss.webhooks.verifySignature(
  rawBody,                             // string or Buffer
  req.headers['x-moss-signature'],     // "sha256="
  req.headers['x-moss-timestamp'],
  'your-shared-secret',
);
if (!isValid) return res.status(401).send('invalid signature');

Idempotency

Pass an idempotency key as the second argument on create, promote, suspend, reactivate, and session calls for replay-safe writes.

typescript
const customer = await moss.customers.create(
  { external_id: 'acme_123', name: 'Acme Corp' },
  'acme_creation_2026_08_20',
);

Errors

API errors reject with a typed error carrying the machine-readable error code, a human message, and a request_id for support. See the error reference for the full list of codes.