Skip to main content
RateLoopAI Assurance Loop

RateLoop SDK

The SDK connects your application to invited workspace reviews and their evidence.

These examples target the unreleased @rateloop/sdk 0.3.0 API. The published 0.1.0 package cannot run them. Use workspace MCP for agent review until a compatible SDK is released.

You can use the workspace MCP connection for agent review or the browser evidence verifier. This application repository is private; a source checkout is not a public installation path.

Invited review sequence

For connected agents, createInvitedReviewClient follows the saved policy through getPolicy, evaluate, ask, wait and result. The lower-level example prepares material; it does not dispatch assignments.

Use a project, integration, request profile, and cohort that the owner has configured for invited reviewers.

import { createTokenlessRateLoopClient } from "@rateloop/sdk";

const client = createTokenlessRateLoopClient({
  apiBaseUrl: process.env.RATELOOP_API_BASE_URL!,
  apiKey: process.env.RATELOOP_AGENT_API_KEY!, // server-side workspace key
});
const { projects } = await client.assurance.listProjects();
const projectId = process.env.RATELOOP_PROJECT_ID!; // owner-configured project
if (!projects.some(project => project.projectId === projectId)) throw new Error("Project is not available");
const sourceText = "Customer asks whether an invoice can be split.";
const replyText = "Yes. Here are the split-billing steps.";
const review = await client.assurance.createPrivateReview({
  idempotencyKey: "reply-0001",
  integrationId: process.env.RATELOOP_INTEGRATION_ID!,
  projectId,
  requestProfile: {
    id: process.env.RATELOOP_REQUEST_PROFILE_ID!,
    version: Number(process.env.RATELOOP_REQUEST_PROFILE_VERSION!),
    hash: process.env.RATELOOP_REQUEST_PROFILE_HASH! as `sha256:${string}`,
  },
  cohortId: process.env.RATELOOP_COHORT_ID!,
  dataClassification: "internal",
  source: { contentType: "text/plain; charset=utf-8", bytesBase64: Buffer.from(sourceText).toString("base64") },
  suggestion: { contentType: "text/plain; charset=utf-8", bytesBase64: Buffer.from(replyText).toString("base64") },
});
console.log(review.privateReviewId, review.status, review.responseDeadline);

const { runs } = await client.assurance.getProject({ projectId });
for (const run of runs) {
  const status = await client.assurance.getRunStatus({ runId: run.runId });
  console.log(status.runId, status.runStatus);
}

To create a project first, call client.assurance.createProject with a name, data classification, and retention period, then finish its review configuration in RateLoop. The private review response has its own ID, bindings, and deadline; it does not promise an immediate project run ID. Project runs are listed separately. createPrivateReview sends the idempotency key as a header so an exact retry returns the same review. These source and reply strings are base64 transport bytes; RateLoop encrypts the decoded artifacts before storage.

Generate with model routing

Enable API generation for a connected API-key agent in its settings. This permission is separate from cost optimization and review access. The first version accepts text and uses the saved review question.

API generation sends submitted prompts, messages and system instructions through Vercel AI Gateway to the configured OpenAI provider. Use only public, synthetic or safely redacted material in this Alpha.

import { createGenerationClient, createInvitedReviewClient } from "@rateloop/sdk";

const options = {
  apiBaseUrl: "https://www.rateloop.ai",
  apiKey: process.env.RATELOOP_AGENT_API_KEY!,
};
const draft = await createGenerationClient(options).generate({
  agentId: process.env.RATELOOP_AGENT_ID!,
  clientRequestId: "reply-0001",
  workflowKey: "support-reply",
  messages: [{ role: "user", content: "Draft a concise reply to this synthetic request." }],
  maxOutputTokens: 1024,
});
if (!draft.review || !draft.opportunityId) {
  // Repair setup and retry the identical request; keep this draft unapproved.
  throw new Error(draft.reviewSetup.errorCode ?? "review_setup_required");
}
let review = draft.review;
if (review.continuation) {
  review = await createInvitedReviewClient(options).wait({
    opportunityId: draft.opportunityId,
    cursor: review.continuation.cursor,
  });
}
console.log(draft.model, draft.usage, review.lifecycle.state);

POST /api/agent/v1/generations creates one draft and its normal review. The SDK sends clientRequestId as Idempotency-Key; an exact retry reuses both for 24 hours, then returns HTTP 410 without generating again. Keep draft.text behind the saved release policy: a pending, inconclusive or failed review is not approval. Continue waiting on the original opportunity when needed.

If review setup fails after generation, the API returns the saved draft with review set to null and reviewSetup.state set to retry_required. Repair the reported condition and retry the identical request to resume review without generating again. Retrieving a draft is not release approval.

Integration rules

  • Reuse an idempotency key only for the same review payload.
  • Keep workspace API keys on your server and revoke credentials that are no longer needed.
  • Wait for the original review; a timeout is not an approval or a reason to create a duplicate.

Authorization

Create scoped, revocable workspace API keys in Settings → Integrations. RateLoop derives the workspace and authorized project access from the credential. Browser clients use the HttpOnly RateLoop session. A caller-supplied account or workspace identifier does not grant access.

Evidence exports

Workspace members with the required role can export a completed run packet, adaptive-coverage history, the workspace audit chain, and the workspace's trusted-key history.

GET /api/account/workspaces/{workspaceId}/assurance/runs/{runId}/evidence
GET /api/account/workspaces/{workspaceId}/assurance/coverage/export
GET /api/account/workspaces/{workspaceId}/audit/export
GET /api/evidence/trusted-keys
GET /api/account/workspaces/{workspaceId}/assurance/trusted-keys
GET /api/account/workspaces/{workspaceId}/assurance/trusted-keys?format=spki&keyId=ed25519:…

A packet reader needs no RateLoop account to obtain its current or retired SPKI pin from the public, cacheable verification-key endpoint. Workspace members can also download it from the authenticated key history. Run the downloadable packet verifier with an explicit key ID instead of trusting the key in the packet:

curl --fail --show-error --output verify-rateloop-evidence.mjs   https://www.rateloop.ai/docs/verify-rateloop-evidence.mjs
node verify-rateloop-evidence.mjs ./packet.json   --public-key ./trusted-evidence-key.txt --key-id ed25519:…

Audit-chain and attestation checkers are not public downloads yet. Read the Evidence reference for verification boundaries or Agents & MCP for the connected workspace path.

SDK guide | RateLoop