SeismicOrchestrationClient

The primary export of seismic-orchestration. One class covers auth, users, orgs, KYB, API keys, quotes, customers, and accounts.

Construction

Three environment factories cover the common path. All three accept the same optional config (everything except baseUrl).

import { SeismicOrchestrationClient } from "seismic-orchestration";
 
const sandbox = SeismicOrchestrationClient.sandbox({ apiKey: process.env.SEISMIC_ORCHESTRATION_API_KEY });
const prod    = SeismicOrchestrationClient.production({ apiKey: process.env.SEISMIC_ORCHESTRATION_API_KEY });
const fromEnv = SeismicOrchestrationClient.fromEnv();  // reads SEISMIC_ORCHESTRATION_ENV

For private deployments or tests, use the raw constructor:

import { SeismicOrchestrationClient } from "seismic-orchestration";
 
const api = new SeismicOrchestrationClient({
  baseUrl: "https://orchestration.internal.example",
  apiKey: "seismic_prod_…",
});

Authenticating

The client supports both auth modes from the API auth model:

• API key: pass apiKey: "seismic_prod_…" (or a getter). Sent as Api-Key: <key>. Recommended for server-to-server.
• Access token (dashboard): leave apiKey unset. Configure a tokenStore and call api.auth.login(...). Tokens persist via the store. Refresh-on-401 is automatic.

Setting both is harmless on the client (API key wins, Authorization is never sent), but the server explicitly returns 400 BothCredsProvided for any request that arrives with both, so don't try to send them yourself.

fromEnv() details

SeismicOrchestrationClient.fromEnv() reads process.env.SEISMIC_ORCHESTRATION_ENV. It must be exactly "production" or "sandbox". Anything else throws immediately, loud and early:

Error: SEISMIC_ORCHESTRATION_ENV must be "production" or "sandbox"; got "staging"

This is intentional. A silently-defaulted client is the kind of thing that prints real invoices on sandbox creds, or vice versa.

Config

import type { SeismicOrchestrationClientConfig } from "seismic-orchestration";

Advanced overrides (replace the tokenStore-derived wiring entirely): getAccessToken, getRefreshToken, onTokensRefreshed, all () => … callbacks. Skip unless you're doing something exotic (httpOnly cookies, cross-process coordination).

Refresh-on-401

request ─► 401 on protected path?
              │ yes
              ▼
           is refresh in flight?
              │
     no ──────┼──► start /auth/refresh
              │         │
              │         ├─► success → persist pair, retry original
              │         └─► failure → clear tokenStore, onRefreshFailed
     yes ─────┴──► await the in-flight refresh, then retry

Login / signup / refresh / logout paths are excluded from this: refreshing against them either loops or is meaningless.

Orgs

API keys

Auth

login, mfa.verify, and refresh persist the returned pair to the configured tokenStore automatically, with no tokens.save(res) boilerplate. logout() uses the refresh token from the store if you don't pass one, then clears local state.

Quotes

Customers

Accounts (org-wide read)

Liquidations

Deposits

Catalog

Health

Errors

Every method rejects with ApiError on non-2xx responses:

import { SeismicOrchestrationClient, ApiError } from "seismic-orchestration";
 
const api = SeismicOrchestrationClient.sandbox();
 
try {
  await api.auth.login("alice@example.com", "wrong");
} catch (err) {
  if (err instanceof ApiError) {
    console.log(err.status);  // 401
    console.log(err.message); // "invalid credentials"
  }
}

For the status-code landscape, see API → Errors.