IntelliCompli SDK

TypeScript/JavaScript SDK for the IntelliCompli AML/CTF compliance API.

Installation

npm install @intellicompli/sdk
# or
pnpm add @intellicompli/sdk
# or
yarn add @intellicompli/sdk

Quick start

import { IntelliCompli } from '@intellicompli/sdk';

const client = new IntelliCompli({
  apiKey: 'sk_live_...',
});

// List customers
const customers = await client.customers.list();

// Create a customer
const customer = await client.customers.create({
  email: '[email protected]',
  firstName: 'John',
  lastName: 'Doe',
});

// Screen against sanctions
const result = await client.sanctions.screen({
  firstName: 'John',
  lastName: 'Doe',
  dateOfBirth: '1990-01-01',
});

Base URL

The only supported override is baseUrl. By default the client talks to https://api.intellicompli.com.au/v1; point it elsewhere (a local API server, a proxy) by passing baseUrl explicitly:

const client = new IntelliCompli({
  apiKey: 'sk_test_...',
  baseUrl: 'http://localhost:3001/api/v1',
});

There is no separate staging host — a test-mode key (sk_test_... / pk_test_...) talks to the same production API and marks requests as test mode.

Available resources

Each resource is a property on the client (client.<resource>.<method>()). Resource and method names below match the SDK exactly.

| Resource | Methods | |---|---| | customers | create, createBatch, updateBatch, retrieve, update, delete, list, upsert, linkOwnershipEntity, rederiveOwners, unlinkOwnershipEntity | | transactions | create, createBatch, retrieve, update, delete, list, importFile, downloadTemplate | | sanctions | screen, batchScreen | | pep | screen, batchScreen | | risk | assess | | kyc | startVerification, getStatus, uploadDocument, listDocuments, retrieveDocument, deleteDocument | | identityVerifications | retrieve, list, review | | kyb | create, retrieve, list, update, review, uploadDocument, listDocuments | | business | register | | beneficialOwners | create, retrieve, update, delete, list | | clientGroups | list, create, retrieve, update, addMember, removeMember, reviewExtraction, createDocumentUploadUrl, completeDocumentUpload | | alerts | retrieve, update, list, resolve, dismiss, acknowledge | | alertRules | list, create, retrieve, update, delete | | cases | create, retrieve, update, delete, list, createTask, updateTask, listTasks, deleteTask | | edd | list, retrieve, update, delete | | reviews | list, create, retrieve, update, createRemediationItem, updateRemediationItem | | ocdd | listSchedules | | reports | listCompliance, createCompliance, getCompliance, updateCompliance, generateTTR, generateSMR, listSMR, generateIFTI | | programs | list, create, retrieve, update, changeStatus, listVersions, retrieveVersion, delete, exportPdf | | programTemplates | list, retrieve | | analytics | getOverview | | auditLogs | list | | webhooks | create, retrieve, update, delete, list, listEvents | | training | create, retrieve, list, update, delete, uploadDocument, listDocuments, downloadDocument, deleteDocument | | trainingModules | list, retrieve | | trainingProgress | list, assign, update, submitQuiz, summary, sendReminder | | staff | list, create, retrieve, update, delete | | config | getRegions | | health | check | | address | autocomplete, details | | abnLookup | lookupByAbn, lookupByAcn | | apiKeys | rotate | | tenant | getSettings, updateSettings, getOnboardingStatus, getRiskConfig, updateRiskConfig, getStripeUsage | | stripe | getUsage | | integrations | per-provider sub-resources (see below) | | partner | account, practices, usage, invoices, webhooks, forPractice() — partner keys only, see below | | tenants | list, create, retrieve, update, delete — platform-operator only | | cron | runOcdd, checkDeadlines — platform-operator only |

integrations groups one sub-resource per connected provider (client.integrations.xero, .leap, .propertyme, .rex, .airwallex, .chainalysis, .frankieone, .monoova); OAuth providers expose connect, disconnect, status, sync, syncHistory, and Xero additionally exposes updateConfig. API-key providers (Airwallex, Chainalysis, FrankieOne, Monoova) expose connect(credentials) plus the same disconnect/status/sync/syncHistory set.

Partner keys

Practice-management software vendors integrate as partners rather than tenants. Partner credentials are prefixed pk_live_ / pk_test_ — distinct from a tenant's sk_live_ / sk_test_ key — and carry one of two scopes:

• partner:manage — operates on your own billing account: provisioning practices, viewing usage, managing billing. No extra header needed.
• practice:act — acts on behalf of one linked practice per request. Every request must also carry X-Practice-Id: prc_..., the id of the practice you're acting for.

const partnerClient = new IntelliCompli({ apiKey: 'pk_live_...' });

// partner:manage — your own account
await partnerClient.partner.account();
await partnerClient.partner.practices.create({ /* ... */ });
await partnerClient.partner.usage.list();
await partnerClient.partner.invoices.list();

// practice:act — scope a request to one practice
const practice = partnerClient.partner.forPractice('prc_abc123');
await practice.customers.list();
await practice.transactions.create({ /* ... */ });

forPractice() returns a scoped set of the same customers, transactions, kyc, identityVerifications, sanctions, pep, beneficialOwners, clientGroups, and webhooks resources used elsewhere in the SDK, with X-Practice-Id attached automatically. Only the routes the practice:act allowlist permits are reachable this way — alerts, cases, EDD, reports, audit logs, and billing are denied server-side regardless of scope, by design (this is the tipping-off boundary between a partner and their practices' compliance data). A practice can revoke practice:act access to their data at any time without affecting billing.

See https://www.intellicompli.com.au/guides/partner-api for the full request/response reference.

Errors

Every API error is a JSON body of the shape:

{
  "error": {
    "type": "invalid_request_error",
    "code": "validation_error",
    "message": "email is required",
    "param": "email",
    "requestId": "req_..."
  }
}

type is one of:

| Type | HTTP status | Meaning | |---|---|---| | authentication_error | 401 | Missing or invalid API key | | authorization_error | 403 | Key valid, but not permitted for this operation | | invalid_request_error | 400 | Malformed or invalid request (see param for the offending field) | | rate_limit_error | 429 | Too many requests | | not_found_error | 404 | Resource does not exist (or isn't visible to this key) | | api_error | 500 | Unexpected server error — safe to retry, include requestId when reporting it |

The SDK throws an error carrying these same fields on any non-2xx response; catch and inspect error.type/error.code to branch on specific failure cases rather than parsing message.

Type generation

This SDK's request/response types are generated from the API's OpenAPI specification, so they stay in sync with the server by construction.

Workflow

1. API routes register their Zod schemas in apps/api/src/lib/openapi/schemas/.
2. cd apps/api && pnpm generate-openapi regenerates apps/api/openapi.json from those schemas.
3. cd packages/sdk && pnpm generate regenerates src/generated/api-types.ts from the spec.
4. Resource classes in src/resources/ use the generated types.

Development

# Generate types from the OpenAPI spec
pnpm generate

# Build the SDK
pnpm build

# Watch mode for development
pnpm dev

Generated vs. hand-written code

Generated (src/generated/):

• api-types.ts — types produced from the OpenAPI spec
• adapters.ts — utilities for extracting types from the generated types
• index.ts — re-exports

Hand-written:

• src/resources/ — the 38 resource classes and their methods
• src/types/ — additional types not represented in the OpenAPI spec
• src/client.ts, src/utils/ — the IntelliCompli client and HTTP layer

The generated types intentionally exclude /v1/tenant/* and /v1/public/* paths (see scripts/generate-types.ts); the tenant resource's types are hand-written in src/resources/tenant.ts instead.

Type utilities

import type { ExtractResponse, ExtractRequestBody, ExtractListItem } from '@intellicompli/sdk';

type CustomerResponse = ExtractResponse<'/v1/customers', 'get'>;
type CreateCustomerBody = ExtractRequestBody<'/v1/customers', 'post'>;
type Customer = ExtractListItem<'/v1/customers', 'get'>;

Contributing

When adding a new endpoint:

1. Register it in the appropriate schema file under apps/api/src/lib/openapi/schemas/.
2. Regenerate the OpenAPI spec: cd apps/api && pnpm generate-openapi.
3. Regenerate SDK types: cd packages/sdk && pnpm generate.
4. Add or update the method on the matching resource class in src/resources/.
5. Export any new types from src/index.ts.
6. Run pnpm build to confirm everything compiles.

CI integration

pnpm check-sdk-types

Fails if the generated types are out of sync with the OpenAPI spec — part of pnpm validate:all. Note it only covers the generated src/generated/ types; the hand-written interfaces in src/resources/*.ts are not checked automatically, so keep them in sync with their route's actual response shape by hand.

License

MIT