Corrigo Enterprise SDK: get started

Use an ordinary App, or an Agent when the workload needs agent identity. Alter builds provider requests from a reviewed contract and applies the same connection authorization, policy, approvals, and audit records as raw requests.

Install

npm install @alter-ai/sdk @alter-ai/corrigo
# Python (installs core automatically)
pip install alter-sdk-corrigo

The provider package includes only Corrigo Enterprise request types and pins its contract version. Corrigo’s document describes no response bodies, so responses are untyped: read them with bodyJson() / body_json().

Connect and call

Store Corrigo Enterprise integration credentials with the company’s name and API host, and retain the grant ID. Alter mints the token, sends the CompanyName header and routes each call to the key’s host; none of them belongs in operation input.

import { App } from "@alter-ai/sdk";
import { CorrigoIntegration } from "@alter-ai/corrigo";
const app = new App({ apiKey: process.env.ALTER_API_KEY! });
try {
  const client = new CorrigoIntegration(app, { grantId: process.env.CORRIGO_GRANT_ID! });
  const result = await (await client.company.getApiUrl({ path: { company: "Example Company" } })).wait();
  console.log(result.bodyJson());
} finally {
  await app.close();
}

from alter_sdk import App
from alter_sdk_corrigo import CorrigoIntegration

async def first_call(api_key: str, grant_id: str):
    async with App(api_key=api_key) as app:
        client = CorrigoIntegration(app, {"grant_id": grant_id})
        call = await client.company.get_api_url({"path": {"company": "Example Company"}})
        result = await call.wait()
        return result.body_json()

Complete versioned contract

Contract 2026-10-31 contains every operation in Corrigo Enterprise’s official OpenAPI document. The API reference links every operation to its complete input fields, TypeScript and Python examples, and policy identity. Browse by resource under this provider’s API reference in the Integrations sidebar, or download the pinned OpenAPI specification. The Developer Portal provider view and alter integrations operations corrigo --version 2026-10-31 also expose the schemas.

Generated calls pin the Alter contract version. Corrigo Enterprise’s own product, role, scope and subscription requirements still apply. There is no silent version fallback and no automatic write retry or pagination.

alter integrations execute corrigo corrigo.company_get_api_url \
  --version 2026-10-31 --grant "$CORRIGO_GRANT_ID" --input '{"path":{"company":"Example Company"}}' --wait

Arguments use native path, query, headers, and body containers. Array query parameters are sent the way the provider’s document declares them: one delimited value where it declares explode: false (or a pipe- or space-delimited style), repeated keys otherwise. SDK methods preserve provider field names, decimal lexemes and large integers as strings when necessary. HTTP 204 returns null / None from the typed decoder. Binary responses use bodyBytes() / body_bytes(); the CLI can save them with --output-file.

Approvals

A policy rule can require approval for any operation. The call returns a pending approval; wait() resolves once the approver decides, and resume(approvalId) picks a pending approval up after a restart. Approval cards show the operation, its contract version and the request input the sensitivity review marked safe to display.

Resources and model fields

An entity’s writes are on a resource of its own (client.workOrder.update(...), client.invoice.create(...)), commands are on commands, routines on routines, host discovery on company, and the generic routes on entities, query and batch. Keys are sent as written, in the camelCase the contract shows.

A request body is typed one level deep: an operation’s own model and its fields. A field holding another Corrigo model is an open object, or null, that Corrigo validates.

Documents are uploaded as base64 inside a record (entity.body on a Blob, entity.blob.body on a Document). There is no multipart upload. A serialized input is limited to 5 MiB.

Policy and sensitive data

Each operation keeps the policy identity the Corrigo catalog already published, such as cmd.WoCreateCommand or base.Invoice.update, so a rule written for a raw request also governs the SDK method. The families are explained in Corrigo Enterprise.

• payment covers invoices, payments, costs, prices, taxes, pay rates and time cards.
• send covers anything that reaches a person: dispatching, recalling, messaging, creating a work order and making a document public.
• admin covers users, roles, permission links, rules, templates and company configuration.
• batch.*, CompositeCommand, CreateCommand, UpdateCommand, DeleteCommand and RestoreCommand carry every family a request of their kind can reach.

Payload capture follows the application’s capture setting, on managed and raw proxied calls alike: credentials are removed, every field Alter’s reviewed inventory for the provider marks sensitive is masked in requests and responses, including fields it locates only by operation, and binary bodies, calls that can return a credential and calls carrying raw card data are never stored. Metadata audit is unchanged. A command whose CommandResult carries ErrorInfo is reported as a provider fault: ok is false, body_json() (bodyJson() in TypeScript) raises ProviderAPIError, and the body still reaches the caller through body_bytes() and body_text(). A composite command or a batch is a fault only when every command or item in it failed; a partly applied one returns its body as a success. Under an approval, passwords, tax identification numbers and document bytes are held encrypted and shown masked, in any casing and at any depth.

Routes that can set a user’s password are refused by default with credential_minting_refused: employee.update, commands.update, commands.composite, commands.entity_execute, batch.update and batch.cmd, and a raw request to the same routes. Every other entity’s writes are unaffected. An organization admin allows them with a credential_minting rule, outright or behind approval, and any field that rule lets through stays masked under an approval. Creating an employee (employee.create) is refused the same way only when the request sets a Password; without one it is an ordinary admin write.

Six catalog rows are not published as methods: the generic base.create, base.update, base.delete and cmd.execute routes, because each documented type has its own operation, and the base classes BaseWoActionCommand and WoBaseCheckInOutCommand. A raw request to one still classifies, with every family it could reach.

An operation whose connection has no API host fails with connection_origin_missing, and one whose host falls outside Corrigo’s API hosts fails with connection_origin_not_allowed; both are ManagedOperationError. Rotate the key with its API host to recover.

No call in this contract has run against a real Corrigo company; it comes from Corrigo’s published document.

Maintenance

The pinned official source, its hash, the generated methods and the policy mapping are checked together. Scheduled checks save upstream candidates and report additions, removals and schema changes; they never replace a published contract automatically. Existing contract versions remain available for installed SDKs and pending approvals.

Resume after a restart

Persist call.approvalId (TypeScript) or call.approval_id (Python), then construct a fresh provider client and call resume(savedId), followed by wait(). The stored approval selects the operation; this installed package verifies its provider and contract version before attaching the response validator. Mismatches raise ManagedOperationError, never silently decode using another contract. See persist-and-resume examples.

Rules for SDK functions

Policy operation fields also accept the published SDK function IDs listed by alter integrations operations corrigo. Use when.operation for a json_match or conditional require_approval rule, or match.operations for content_match (including redaction and step-up). Conditional approval can also use when.match.operations with parameter conditions. alter policy simulate --operation <function-id> tests that exact function.

Managed calls carry a server-verified function identity. Alter still evaluates policy against the actual method, URL and body after building the request from the authorized connection. Existing endpoint, method, host, catalog-operation and family rules continue to apply unchanged. A raw call can share an endpoint with several SDK functions and matches all of them; a function name never grants permission or bypasses existing restrictions.

For example, this rule requires approval for one function:

{
  "effect": "require_approval",
  "when": { "operation": "corrigo.cmd_sendworkordercommand" },
  "approval": { "approvers": ["reviewer@example.com"] }
}

Save it with alter policy rules create --app <app-id> --grant <grant-id> --type require_approval --body @rule.json, or select the function in the portal.