# SDK Reference {#sdk-reference}

Official clients are published as `cyphrex` on npm and as `cyphrex` on PyPI. There is no public SDK repository. Do not invent a GitHub package name or a scoped npm name such as `@cyphrex/sdk`.

The SDK is a thin wrapper around `POST /v1/check`. Constructor `apiUrl` defaults to `https://cyphrexapi-production.up.railway.app`. The SDK sends both auth headers and maps `actionType` / `action_type` to the HTTP field `action.type`.

### JavaScript / TypeScript

**Installation & setup**

```bash
npm install cyphrex
```

**Initialize**

```javascript
const { Cyphrex } = require('cyphrex');
const cyphrex = new Cyphrex({
  apiKey: process.env.CYPHREX_API_KEY,
  agentId: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
});
```

**Check an action**

```javascript
const result = await cyphrex.check({
  actionType: 'http_call',
  url: 'https://api.example.com/endpoint',
  payload: { method: 'POST', body: { ... } }
});
```

**Response format**

The HTTP API returns `{ "allowed": true }` or `{ "allowed": false, "reason": "...", "severity": "P2" }`. The SDK copies those fields. On some error statuses it also sets `violations` to an array of string codes (for example `unauthorized`). It does not return `violations` as objects, and it does not return `spend` from the API.

```javascript
{
  allowed: true | false,
  reason?: string,
  severity?: string
}
```

### Python

**Installation & setup**

```bash
pip install cyphrex
```

**Initialize**

```python
from cyphrex import Cyphrex

cyphrex = Cyphrex(
    api_key=os.environ["CYPHREX_API_KEY"],
    agent_id="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
)
```

**Check an action**

```python
result = cyphrex.check(
    action_type="http_call",
    url="https://api.example.com/endpoint",
    payload={"method": "POST", "body": {...}}
)
```

**Response format**

Same HTTP fields: `result["allowed"]`, `result.get("reason")`, `result.get("severity")`.