Integrations
Provider SDKs
Typed provider APIs through Alter, with connection authorization, policy, approvals and audit
Use a provider SDK to call a connected service without maintaining its request URLs or API specification yourself. An ordinary application can use these clients; an agent is optional. Each provider with a typed package has an SDK guide (install it, connect an account, make the first call) and an API reference of every operation under its entry in the Integrations sidebar.
| Provider | SDK guide |
|---|---|
| Deel | Deel SDK |
| Google Workspace SDK | |
| QuickBooks | QuickBooks SDK |
| Ramp | Ramp SDK |
| Rippling | Rippling SDK |
Find an operation
Section titled “Find an operation”Each provider has an SDK guide, an API reference grouped by resource or namespace, and OpenAPI downloads. Operation pages show both SDK methods, complete input and response fields, nested models, required provider scopes where documented, policy identity and source limitations. Search includes operation names, fields and models.
The provider package contains only that provider’s types and response validators. TypeScript installs the core @alter-ai/sdk alongside the provider package; Python provider distributions install alter-sdk as a dependency. Core carries the shared execution and approval runtime.
Calls keep Alter’s existing controls
Section titled “Calls keep Alter’s existing controls”Bind the provider client to a customer’s grant. The backend authorizes that connection before constructing the provider request; credentials determine its destination and tenant. Existing key permissions, grant restrictions, scope narrowing, policy rules, quotas, revocation and audit attribution still apply. OAuth and managed-secret connections use the same controls where the provider supports that credential type.
Operation arguments use the native path, query, headers and body containers shown in the reference. The provider package pins an immutable contract version. It does not silently upgrade the contract, follow pagination or automatically replay a write. Provider subscriptions, scopes and product entitlements still determine access.
Results and approvals
Section titled “Results and approvals”A method returns an IntegrationCall. Await call.wait() to obtain its IntegrationResult, either immediately or after a required approval. Waiting does not approve the request. Use bodyJson() / body_json() for successful JSON, or bodyBytes() / body_bytes() for binary responses. Exact decimals and large integers may decode as strings to preserve precision.
Persist call.approvalId / call.approval_id when a call is pending. After a process restart, recreate the provider client and call resume(savedId), then wait(). The backend supplies the original operation and contract identity; a different provider or contract version is a typed error. See the approval and resume guide.
Managed input/contract failures raise ManagedOperationError. Provider failures retain their raw response and JSON decoding raises ProviderAPIError. See the TypeScript errors and Python errors references. Inspect and reconcile uncertain write outcomes before deciding to submit another request.
Sensitive input
Section titled “Sensitive input”Sensitive bank, identity and secret values cannot be frozen into approvals or displayed on approval cards. Use provider-held references or an immediately authorized operation where supported. Provider guides describe their specific retention exclusions. Metadata audit remains available.
Versioned specifications
Section titled “Versioned specifications”Every operation page names its pinned contract version and links to the original provider source. OpenAPI downloads describe the native provider API; the operation page describes the corresponding Alter SDK call and its governed behavior. Published contracts stay immutable so installed clients and pending approvals retain their original meaning.
Generic API requests remain available for custom requests and dynamic tools. Managed calls transfer request construction and schema maintenance to Alter while preserving the same authorization and policy model.