June 14, 2026
When Tamga v0.1.0 shipped, the Python and TypeScript SDKs were scaffolds: four methods (get_stats, get_events, get_findings_breakdown, reload_policy) wrapped in clean HTTP clients with auth handling and error types. The other 63 API endpoints — policy management, incidents, billing, webhooks, timeseries, SCIM provisioning — were REST-only. Customers had to handcraft HTTP calls.
A security proxy sits between your application and every LLM call. When something goes wrong — a policy blocks a legitimate request, a rate limit triggers, an incident fires — your ops team needs to query the API immediately. They shouldn't be reading OpenAPI specs at 3 AM.
The SDKs provide:
**Type safety.** TypeScript users get autocomplete on every method. `api.listIncidents({ severity: "critical" })` — the IDE knows the parameter shape, the return type, and the error variant before you compile.
**Error handling.** Both SDKs wrap HTTP errors into typed exception/error classes. `TamgaAuthError` vs `TamgaRateLimitError` vs `TamgaServerError` — your error handling code doesn't parse status codes.
**Streaming support.** The `openLiveEvents()` method returns an SSE stream iterator in Python and an EventSource-compatible wrapper in TypeScript. No raw fetch/httpx stream management.
The expansion was mechanical but thorough:
**Backward compatibility is non-negotiable.** All 4 original methods work unchanged. The barrel export in the TypeScript SDK preserves every existing import path.
**One method per endpoint.** No "god methods" with overloaded parameters. Each endpoint gets one method with one clear signature. The naming convention mirrors the API path: `GET /api/v1/incidents` → `listIncidents()`, `PATCH /api/v1/incidents/{id}` → `patchIncident(id, patch)`.
**SCIM support.** The 5 SCIM v2.0 endpoints (list, create, get, patch, delete users) are fully wrapped. Enterprise customers using Okta or Azure AD for provisioning can script user lifecycle management through the SDK.
The SDKs now track the full API surface. When new endpoints are added to the OpenAPI spec, SDK methods should be added in the same PR. The CI pipeline doesn't enforce this yet — that's the next sprint.
Both SDKs are published: `pip install tamga-client` and `npm install @tamga/client`.
