Docs

JavaScript SDK reference

Every method of @sovaria/sdk, with the HTTP route it calls.

Updated Oct 13, 2026

Every method of @sovaria/sdk 0.3.0, generated from the SDK source. Create a client with the two values from the console Connect panel; each method returns a promise and throws SovariaError (with statusCode and detail) on failure.

npm install @sovaria/sdk

import { createClient } from '@sovaria/sdk'

const sovaria = createClient('https://<project-ref>.sovaria.in', '<anon-key>')

sovaria.auth

Sign users up and in (password, magic link, email code, OTP, social providers), sessions, MFA and email verification.

MethodWhat it doesHTTP
auth.signUp(email: string, password: string, name = '')Create an app user and sign them in. When the project requires email confirmation, the result has email_verification_required: true and no session until the user confirms. /—
auth.signIn(email: string, password: string)Sign an app user in with email and password (same as projectLogin). /—
auth.register(email: string, password: string, name: string)Create an app user with email and password (in the client’s project) and sign them in.POST /api/v1/auth/register
auth.login(email: string, password: string)Sign an app user in with email and password; stores the session on the client.—
auth.consoleLogin(email: string, password: string)Sign in to the Sovaria console account (team members, scripts). Not for app users.POST /api/v1/auth/console/login
auth.loginConsole(email: string, password: string)Alias of consoleLogin.—
auth.projectLogin(email: string, password: string)Same as login, always on the project (app-user) lane.POST /api/v1/auth/project/login
auth.loginProduct(email: string, password: string)Alias of projectLogin.—
auth.refresh(refreshToken: string)Exchange a refresh token for a new session (the SDK does this automatically).POST /api/v1/auth/refresh
auth.logout(refreshToken?: string)Revoke the session on the server and clear it locally; the client falls back to the anon key.POST /api/v1/auth/logout
auth.me()The signed-in user’s profile.GET /api/v1/auth/me
auth.verifyMfa(code: string, method: 'totp' / 'phone' = 'totp')Complete sign-in with a 6-digit authenticator (or phone) code after an MFA challenge.POST /api/v1/auth/mfa/verify
auth.sendMagicLink(email: string, opts: { orgId?: string; projectId?: string; redirectTo?: string } = {})Email a one-time sign-in link (and code) to the user.POST /api/v1/auth/magic-link/send
auth.resetPasswordForEmail(email: string, opts: { orgId?: string; projectId?: string; redirectTo?: string } = {})Email a password-reset link. Says nothing about whether the address exists.POST /api/v1/auth/password-reset/send
auth.confirmPasswordReset(token: string, newPassword: string)Set a new password with the token from the reset email.POST /api/v1/auth/password-reset/confirm
auth.handleEmailLink(url?: string)On your redirect page: reads the link in the URL (sign-in, verification, reset, provider) and finishes it.POST /api/v1/auth/email-change/confirm
auth.signInWithProvider(providerId: string, opts: { redirectTo?: string; projectId?: string } = {})Start Google / GitHub / SSO sign-in with PKCE and redirect the browser.GET /api/v1/auth/sso/{…}/authorize
auth.exchangeCodeForSession(code: string, codeVerifier?: string)Turn the code from a provider redirect into a session.POST /api/v1/auth/sso/exchange
auth.listProviders(projectId?: string)Enabled sign-in providers, for building your sign-in screen.GET /api/v1/auth/sso/providers
auth.getPublicConfig(projectId?: string)Public sign-in settings: sign-up open, providers, password rules, MFA, passkeys, captcha.GET /api/v1/auth/public-config{…}
auth.verifyMagicLink(token: string)Exchange a magic-link token for a session.POST /api/v1/auth/magic-link/verify
auth.verifyEmailCode(email: string, code: string, opts: { orgId?: string; projectId?: string } = {})Sign in with the 6-digit code from the sign-in email.POST /api/v1/auth/magic-link/verify-code
auth.sendOtp(phone: string, opts: { orgId?: string; projectId?: string; envId?: string } = {})Send a one-time code by email or SMS.POST /api/v1/auth/otp/send
auth.verifyOtp(phone: string, code: string, opts: { orgId?: string; projectId?: string; envId?: string; password?: string } = {})Verify a one-time code and sign in.POST /api/v1/auth/otp/verify
auth.oauthHandoff(token: string, password?: string)Exchange an OAuth handoff token for a session (console OAuth callback). Passwordless: session KEK is not derived unless password is supplied. /POST /api/v1/auth/oauth/handoff
auth.listConsoleProductUsers()Console-operator listing of product users across accessible projects. Path: GET /api/v1/auth/product-users (console lane). /GET /api/v1/auth/product-users
auth.sendVerificationEmail()Re-send the email-address confirmation link.POST /api/v1/auth/verify-email/send
auth.confirmVerificationEmail(token: string)Confirm an email address with the token from the email.POST /api/v1/auth/verify-email/confirm
auth.listUsers()Admin: list app users (service role key or project admin).—
auth.deleteUser(userId: string)Admin: delete an app user.—
auth.banUser(userId: string)Admin: block an app user from signing in.—

sovaria.graph

Organizations, projects, members and invites.

MethodWhat it doesHTTP
graph.createNode(nodeType: string, name: string, metadata: JsonObject = {})—POST /api/v1/org
graph.createEdge(sourceId: string, targetId: string, relationType: string, role?: string)—POST /api/v1/edge
graph.addMember(orgId: string, userId: string, role = 'MEMBER')—POST /api/v1/org/{…}/member
graph.getContext(userId: string, resourceId: string)——
graph.listNodes(nodeType?: string)—GET /api/v1/org
graph.getNode(nodeId: string)—GET /api/v1/org/{…}
graph.getChildren(parentId: string, relation = 'OWNS')—GET /api/v1/org/{…}/children
graph.updateOrg(orgId: string, body: JsonObject)—PUT /api/v1/org/{…}
graph.deleteOrg(orgId: string)—DELETE /api/v1/org/{…}
graph.setOrgPlan(orgId: string, body: JsonObject)—PUT /api/v1/org/{…}/plan
graph.listMembers(orgId: string)—GET /api/v1/org/{…}/members
graph.removeMember(orgId: string, userId: string)——
graph.updateMember(orgId: string, userId: string, body: JsonObject)——
graph.createInvite(orgId: string, body: JsonObject)—POST /api/v1/org/{…}/invites
graph.acceptInvite(body: JsonObject)—POST /api/v1/org/invites/accept
graph.getRoleMatrix()—GET /api/v1/roles/matrix
graph.setRoleMatrix(body: JsonObject)—PUT /api/v1/roles/matrix
graph.getRoleCatalog()—GET /api/v1/roles/catalog
graph.getProjectRef(projectId: string)—GET /api/v1/org/{…}/ref
graph.getProjectSettings()—GET /api/v1/project-settings
graph.setProjectSettings(body: JsonObject)—PUT /api/v1/project-settings

sovaria.data

SQL with bound parameters, documents, table management, migrations and transactions.

MethodWhat it doesHTTP
data.docPut(collection: string, documentId: string, data: JsonObject)Create or replace a JSON document at collection/id.—
data.docGet(collection: string, documentId: string, atTxid?: number)Read a document (optionally as it was at a transaction id).—
data.docDelete(collection: string, documentId: string)Delete a document.—
data.putDocumentE2ee(collection: string, documentId: string, plaintext: Uint8Array / string, password?: string)Encrypt client-side and write a Zero-Knowledge document envelope to Atlas-Doc. /—
data.getDocumentE2ee(collection: string, documentId: string, password?: string, atTxid?: number)Retrieve and decrypt a Zero-Knowledge document from Atlas-Doc. /—
data.docScan(args: { prefix?: string start_key?: string end_key?: string limit?: number })List documents in a collection (prefix, limit, cursor).POST /api/v1/data/query/scan
data.sql(sql: string, params?: JsonValue[] / number, txid = 0)Run SQL. Pass values as params ($1, $2…) — never build SQL from user input. Row-level security applies.POST /api/v1/sql/query
data.tableCreate(payload: JsonObject)Create a table from a column spec.POST /api/v1/data/rel/create
data.tableDrop(tableName: string)Drop a table.POST /api/v1/data/rel/drop
data.tableAddColumn(payload: JsonObject)Add a column.POST /api/v1/data/rel/column/add
data.tableDropColumn(tableName: string, columnName: string)Drop a column.POST /api/v1/data/rel/column/drop
data.tableAddForeignKey(payload: JsonObject)Add a foreign key.POST /api/v1/data/rel/foreign-key/add
data.tableDropForeignKey(payload: JsonObject)Drop a foreign key.POST /api/v1/data/rel/foreign-key/drop
data.tableMigrations(query?: { table_name?: string limit?: number offset?: number })The project’s migration history.GET /api/v1/data/rel/migrations
data.applyMigration(migration: { name: string; upSql: string; downSql?: string; version?: string })Apply a named migration atomically and record it (with optional down SQL).POST /api/v1/data/rel/migrations/apply
data.dryRunMigration(migration: { name: string; upSql: string; downSql?: string })Run a migration inside a transaction and roll it back, to check it.POST /api/v1/data/rel/migrations/dry-run
data.rollbackMigration(opts: { version?: string; force?: boolean } = {})Run the down SQL of the latest (or a given) migration.POST /api/v1/data/rel/migrations/rollback
data.beginTransaction()Start a multi-request transaction; returns a txid.POST /api/v1/data/rel/transaction/begin
data.commitTransaction(txid: number)Commit a transaction.POST /api/v1/data/rel/transaction/commit
data.rollbackTransaction(txid: number)Roll a transaction back.POST /api/v1/data/rel/transaction/rollback

sovaria.realtime

Channels, presence, history and WebSocket tickets.

MethodWhat it doesHTTP
realtime.subscribe(channel: string, clientId: string)Register a server-side subscription for a client id.POST /api/v1/rt/stream/subscribe
realtime.unsubscribe(channel: string, clientId: string)Remove a subscription.POST /api/v1/rt/stream/unsubscribe
realtime.presence(channel: string)Who is connected to a channel.GET /api/v1/rt/stream/presence/{…}
realtime.channels()Active channels.GET /api/v1/rt/stream/channels
realtime.replay(channel: string, after = 0, limit = 200)Messages after a sequence number (catch up after reconnecting).GET /api/v1/rt/stream/replay/{…}
realtime.publish(channel: string, payload: JsonObject, clock?: JsonObject, clockDelta?: JsonObject)Publish a message on a channel.POST /api/v1/rt/stream/publish/{…}
realtime.e2eeBootstrap(channel: string, ttlSeconds = 86400, forceNew = false)—POST /api/v1/rt/e2ee/keys/bootstrap
realtime.e2eeRotate(channel: string, ttlSeconds = 86400)—POST /api/v1/rt/e2ee/keys/rotate
realtime.e2eeRevoke(channel: string, keyId?: string, reason?: string)—POST /api/v1/rt/e2ee/keys/revoke
realtime.e2eeActiveKey(channel: string, clientPublicKey?: string)Pass your RSA-OAEP (SHA-256) public key — PEM or base64 SPKI — to get the key wrapped for you. /GET /api/v1/rt/e2ee/keys/active/{…}
realtime.e2eeGetKey(channel: string, keyId: string, clientPublicKey?: string)—GET /api/v1/rt/e2ee/keys/{…}
realtime.e2eeListKeys(channel: string)—GET /api/v1/rt/e2ee/keys/{…}
realtime.wsTicket(channel: string)One-time ticket for opening a WebSocket on a channel.—
realtime.wsUrl(channel: string, ticket?: string)WebSocket URL for a channel (with a ticket).—
realtime.wsUrlWithTicket(channel: string)Get a ticket and build the WebSocket URL in one call.—

sovaria.policy

Project access policies: list, create, test and evaluate.

MethodWhat it doesHTTP
policy.templates()Ready-made policy templates.GET /api/v1/policies/templates
policy.list()List project policies.GET /api/v1/policies/
policy.get(policyId: string)—GET /api/v1/policies/{…}
policy.create(payload: JsonObject)Create a policy.POST /api/v1/policies/
policy.update(policyId: string, payload: JsonObject)Update a policy (creates a new version).PUT /api/v1/policies/{…}
policy.delete(policyId: string)Delete a policy.DELETE /api/v1/policies/{…}
policy.evaluate(policyId: string, context: JsonObject)—POST /api/v1/policies/{…}/evaluate
policy.check(payload: { orgId: string projectId: string action: string resource: string context?: JsonObject })Ask whether an action on a resource is allowed.POST /api/v1/policies/check
policy.preflight(action: string, resource: string, context: JsonObject = {})check() for the client’s current project.—
policy.history(policyId: string)Versions of a policy.GET /api/v1/policies/{…}/history
policy.rollback(policyId: string, version: number)Restore an earlier version.POST /api/v1/policies/{…}/rollback
policy.simulate(splSource: string, context: JsonObject = {})Test SPL source against a request context without saving it.POST /api/v1/policies/simulate

sovaria.audit

Append to and read the tamper-evident audit log.

MethodWhat it doesHTTP
audit.append(payload: JsonObject)—POST /api/v1/audit/
audit.list(query?: { actor_id?: string event_type?: string source?: string resource_id?: string limit?: number offset?: number })—GET /api/v1/audit/
audit.verify()—GET /api/v1/audit/verify
audit.count()—GET /api/v1/audit/count

sovaria.simulate

Dry-run requests against your policies.

MethodWhat it doesHTTP
simulate.run(payload: JsonObject)—POST /api/v1/sim/run
simulate.plan(payload: JsonObject)—POST /api/v1/sim/plan
simulate.discover()—POST /api/v1/sim/discover
simulate.listRuns(query?: { limit?: number; offset?: number })—GET /api/v1/sim/runs
simulate.getRun(runId: string)—GET /api/v1/sim/runs/{…}
simulate.compareRuns(targetRunId: string, baselineRunId: string)——

sovaria.chrono

Version history (timelines and snapshots).

MethodWhat it doesHTTP
chrono.commit(payload: JsonObject)—POST /api/v1/chrono/commit
chrono.timelineSpawn(payload: JsonObject)—POST /api/v1/chrono/timelines/spawn
chrono.timelineList()—GET /api/v1/chrono/timelines
chrono.timelineDelete(name: string)—DELETE /api/v1/chrono/timelines/{…}
chrono.timelineJump(name: string, targetHex: string)—POST /api/v1/chrono/timelines/{…}/jump
chrono.timelineHistory(name: string, limit = 50, offset = 0)—GET /api/v1/chrono/timelines/{…}/history
chrono.topology(timeline = 'main', limit = 50)—GET /api/v1/chrono/timelines/topology
chrono.converge(payload: JsonObject)—POST /api/v1/chrono/timelines/converge
chrono.variance(payload: JsonObject)—POST /api/v1/chrono/variance
chrono.snapshotCreate(payload: JsonObject)—POST /api/v1/chrono/snapshots/create
chrono.snapshotList()—GET /api/v1/chrono/snapshots
chrono.snapshotRestore(snapshotId: number)—POST /api/v1/chrono/snapshots/{…}/restore

sovaria.functions

Call, deploy, version and inspect functions.

MethodWhat it doesHTTP
functions.list(options: { projectId: string; limit?: number; offset?: number })List functions.GET /api/v1/fn/functions
functions.plan(bundle: Blob, name: string, projectId?: string)Preview what a deploy would change.POST /api/v1/fn/plan
functions.deploy(bundle: Blob, name: string, projectId?: string)Deploy a bundle (zip Blob) as a new version.POST /api/v1/fn/deploy
functions.status(deployId: string, projectId?: string)—GET /api/v1/fn/{…}/status
functions.invoke(functionName: string, payload: JsonValue, options?: { projectId?: string; deployId?: string; executionProfile?: 'standard' / 'heavy' })Invoke a function by name with a payload (management API).POST /api/v1/fn/{…}/invoke
functions.call(functionName: string, payload: JsonValue = {})Call a deployed function with a JSON body (the usual way from apps).POST /functions/v1/{…}
functions.simulate(functionName: string, payload: JsonValue, options?: { projectId?: string; deployId?: string; executionProfile?: 'standard' / 'heavy' })—POST /api/v1/fn/{…}/simulate
functions.invokeAsync(functionName: string, payload: JsonValue, options?: { projectId?: string deployId?: string executionProfile?: 'standard' / 'heavy' simulation?: boolean })Queue an invocation and return immediately; poll with invocationStatus.POST /api/v1/fn/{…}/invoke/async
functions.invocationStatus(invocationId: string, projectId: string)Status and result of an async invocation.GET /api/v1/fn/invocations/{…}
functions.jobs(functionName: string, options: { projectId: string; status?: string; limit?: number; offset?: number })—GET /api/v1/fn/{…}/jobs
functions.versions(functionName: string, options: { projectId: string; limit?: number; offset?: number })Deployed versions.GET /api/v1/fn/{…}/versions
functions.history(functionName: string, options: { projectId: string mode?: 'invoke' / 'simulate' limit?: number offset?: number })Deploy history.—
functions.simulationDiff(functionName: string, options: { projectId: string leftInvocationId: string rightInvocationId: string })—GET /api/v1/fn/{…}/history/simulation-diff
functions.promote(functionName: string, options: { projectId: string version?: number deployId?: string reason?: string })Make a version live.POST /api/v1/fn/{…}/promote
functions.rollback(functionName: string, options: { projectId: string version?: number reason?: string })Go back to the previous version.POST /api/v1/fn/{…}/rollback
functions.request(method: string, path: string, options: RequestOptions = {})——
functions.get(name: string)Function settings.GET /api/v1/fn/functions/{…}
functions.getSource(name: string)Source of the deployed version.GET /api/v1/fn/functions/{…}/source
functions.update(name: string, body: JsonObject)Change settings (public, network allow-list, limits).PATCH /api/v1/fn/functions/{…}
functions.delete(name: string)Delete a function.DELETE /api/v1/fn/functions/{…}
functions.logs(name: string, query?: { limit?: number; offset?: number; status?: string })Recent invocation logs.GET /api/v1/fn/functions/{…}/logs
functions.getPolicy(name: string)—GET /api/v1/fn/functions/{…}/policy
functions.setPolicy(name: string, body: JsonObject)—PUT /api/v1/fn/functions/{…}/policy
functions.getBindings(name: string)—GET /api/v1/fn/functions/{…}/bindings
functions.setBindings(name: string, body: JsonObject)—PUT /api/v1/fn/functions/{…}/bindings
functions.githubRepositories(body: JsonObject)—POST /api/v1/fn/github/repositories
functions.githubImport(body: JsonObject)—POST /api/v1/fn/github/import
functions.githubCommit(body: JsonObject)—POST /api/v1/fn/github/commit

sovaria.storage

Buckets, uploads, downloads, public and signed URLs.

MethodWhat it doesHTTP
storage.request(method: string, path: string, options: RequestOptions = {})——
storage.putJson(path: string, payload: JsonObject)—POST /api/v1/store/{…}
storage.get(path: string, query?: Record<string, string / number / boolean / null / undefined>)—GET /api/v1/store/{…}
storage.delete(path: string)—DELETE /api/v1/store/{…}
storage.publicUrl(bucket: string, objectPath: string, projectId?: string)Permanent URL of an object in a public bucket.—
storage.listBuckets()List buckets.GET /api/v1/store/buckets
storage.createBucket(body: JsonObject)Create a bucket (public, file size limit, allowed MIME types).POST /api/v1/store/buckets
storage.getBucket(name: string)Bucket settings.GET /api/v1/store/buckets/{…}
storage.updateBucket(name: string, body: JsonObject)Change bucket settings.PATCH /api/v1/store/buckets/{…}
storage.deleteBucket(name: string)Delete an (empty) bucket.DELETE /api/v1/store/buckets/{…}
storage.listObjects(bucket: string, query?: { prefix?: string })List objects, optionally under a prefix.GET /api/v1/store/objects/{…}
storage.signDownload(bucket: string, objectPath: string, expiresIn = 3600)Time-limited download URL for a private object.—
storage.signUpload(bucket: string, objectPath: string, expiresIn = 3600)Time-limited upload URL, so browsers can upload directly.—
storage.moveObject(body: JsonObject)Move or rename an object.POST /api/v1/store/objects/move
storage.upload(bucket: string, objectPath: string, file: Blob, options: { upsert?: boolean; contentType?: string } = {})Upload a file / Blob to bucket/path (multipart; upsert and contentType options).POST /api/v1/store/objects/{…}
storage.download(bucket: string, objectPath: string)Download an object as a Blob.GET /api/v1/store/objects/{…}
storage.remove(bucket: string, objectPath: string)Delete an object.DELETE /api/v1/store/objects/{…}

sovaria.system

Platform health.

MethodWhat it doesHTTP
system.enginesHealth()—GET /api/v1/system/engines/health

sovaria.billing

Plans, subscriptions, usage and invoices.

MethodWhat it doesHTTP
billing.listPlans()—GET /api/v1/plans
billing.getPlan(name: string)—GET /api/v1/plans/{…}
billing.getSubscription(orgId: string)——
billing.setSubscription(orgId: string, payload: { plan: string billingCycle?: 'monthly' / 'annual' stripeCustomerId?: string metadata?: JsonObject })——
billing.cancelSubscription(orgId: string, options: { immediate?: boolean } = {})——
billing.listSubscriptions()—GET /api/v1/subscriptions
billing.getUsage(orgId: string, period?: string)——
billing.getUsageHistory(orgId: string, months = 6)——
billing.listInvoices(orgId: string)—GET /api/v1/invoices/{…}
billing.buildInvoice(orgId: string, period?: string)—POST /api/v1/invoices/{…}/build
billing.getCompute(orgId: string, period?: string)—GET /api/v1/compute/{…}
billing.checkout(body: JsonObject)—POST /api/v1/billing/checkout
billing.getProvider()—GET /api/v1/billing/provider
billing.getFx()—GET /api/v1/billing/fx
billing.getOverage(orgId: string)—GET /api/v1/billing/overage/{…}
billing.getOpenInvoice()—GET /api/v1/billing/invoices/open
billing.payInvoice(orgId: string, period: string, body: JsonObject = {})——
billing.razorpayCreateOrder(body: JsonObject)—POST /api/v1/billing/razorpay/create-order
billing.razorpayVerifyPayment(body: JsonObject)—POST /api/v1/billing/razorpay/verify-payment
billing.getAccount(accountId: string)—GET /api/v1/accounts/{…}
billing.cancelAccount(accountId: string)—POST /api/v1/accounts/{…}/cancel
billing.resumeAccount(accountId: string)—POST /api/v1/accounts/{…}/resume

sovaria.vector

Embeddings and similarity search.

MethodWhat it doesHTTP
vector.embed(texts: string[])Turn texts into embeddings.—
vector.upsert(collection: string, docs: Array<{ id?: string; text: string; metadata?: JsonObject }>)Insert or update vectors in a collection.POST /api/v1/vectors/upsert
vector.search(collection: string, query: string, options: { topK?: number; metadataFilter?: JsonObject } = {})Nearest neighbours for a query vector or text.POST /api/v1/vectors/search
vector.listCollections()—GET /api/v1/collections
vector.listRecords(collection: string, options: { limit?: number; offset?: number } = {})——
vector.deleteRecord(collection: string, recordId: string)——
vector.deleteCollection(collection: string)——

sovaria.keys

MethodWhat it doesHTTP
keys.list()—GET /api/v1/apikeys
keys.create(payload: JsonObject)—POST /api/v1/apikeys
keys.ensureDefaults()—POST /api/v1/apikeys/ensure-defaults
keys.revoke(keyId: string)—DELETE /api/v1/apikeys/{…}
Something unclear or missing on this page?Tell us