SDK Overview

Phosra provides official SDKs to accelerate your integration. All SDKs wrap the REST API and provide typed interfaces and token management. (There is no general automatic-retry option in @phosra/[email protected] — the one built-in retry is the single onTokenExpired 401 retry; see the TypeScript SDK.)

Available SDKs

Published packages

These are the packages actually on the public npm registry today. Versions verified against npm view — pin the ones you use.

PackageVersionWhat it doesPage
@phosra/sdk0.1.0Typed control-plane client (PhosraClient) — families, children, policies, rules, enforcementTypeScript SDK
@openchildsafety/ocss0.1.5The vendor-neutral OCSS reference library — sign/verify receipts, sealed envelopes, trust list, vocabularyDeveloper SDK
@phosra/link0.6.1Public writer-plane SDK — consent ceremony + signed rule-write directives. Golden 0.7.10 remains a private candidate.Link
@phosra/gatekeeper0.7.0Public platform SDK — signed profiles, local decisions, §8.3.8 receipts. Golden 0.8.12 remains a private candidate.Platform
@phosra/connect0.1.1Embeddable Connect component (the "Plaid Link" for parental-controls apps) — web + React Native
@phosra/mcp0.4.0MCP server exposing Phosra tools to AI agents (npx @phosra/mcp)MCP Server
@phosra/cli0.2.0Partner CLI — scaffold configs, verify OCSS setup, sandbox round-trip checks (npx @phosra/cli)
@phosra/provider0.1.0Provider-side helpers over @openchildsafety/ocss
@phosra/classify0.1.1Rule-category classification helpers

The native iOS and Android enforcement SDKs are distributed privately (not on npm/Maven Central yet) — see iOS SDK and Android SDK, or email [email protected] for repo access. There is no published @ocss/* npm scope; the open standard's library ships under @openchildsafety/*.

Language coverage

Phosra ships a first-party TypeScript SDK today. Every other language talks to the same plain-JSON REST API directly — no SDK required, and the Quickstart proves the curl / Python / Go paths run copy-paste against the live sandbox.

LanguageHow you call PhosraStatus
TypeScript / JavaScript@phosra/sdk — typed PhosraClientPublished
Shellcurl against the REST APIWorks today
Pythonrequests (or stdlib urllib) against the REST APIWorks today
Gonet/http against the REST APIWorks today
Python SDKfirst-party typed clientPlanned

Generate a typed client in any language

Need Python, Go, Java, Rust, or C#? The OpenAPI spec drives standard code generators to produce a fully-typed client in about a minute. The Generate a client in your language guide runs the real commands (openapi-generator-cli for Python/Go/Java, openapi-typescript for TS) against the live sandbox and pastes the actual output — including a generated-client call that returns 201.

Generate a client in your language

Worked TypeScript, Python, and Go clients from the hosted spec — verified copy-paste, plus which-spec guidance and the RFC 9421 data-plane caveat.

SDK Comparison

FeatureTypeScriptMCPiOSAndroid
PlatformNode.js / BrowserAI AgentsiOS 16+Android 8.0+
Auth methodsAPI key, Bearer, Device keyAPI keyParent JWT, Device keyParent JWT, Device key
InstallnpmnpxSPMGradle
On-device enforcement----FamilyControlsUsageStats + VPN
Policy sync----APNs + pollingFCM + WorkManager
Reporting----Enforcement + screen timeEnforcement + screen time

Direct API Access

All SDKs are optional. The REST API is plain JSON over HTTPS — call it from any language. Every tab leads with the open sandbox (https://phosra-api-sandbox-production.up.railway.app) so your first copy-paste returns 201 with no API key. The same one-call setup in four languages:

bash
# Sandbox-first — no Authorization header needed.
curl -X POST https://phosra-api-sandbox-production.up.railway.app/api/v1/setup/quick \
  -H "Content-Type: application/json" \
  -d '{"child_name":"Emma","birth_date":"2016-03-15","strictness":"recommended"}'

Examples target the synthetic sandbox. There is no supported base-URL-and-key switch to production. Apply for a design-partner pilot when you need provisioned access and explicit operating boundaries.

Want the full zero-to-enforcement walkthrough? The Quickstart runs the same calls against the open sandbox — no auth needed.

See the API Reference for complete endpoint documentation, and the Errors reference for every status code, error class, and its fix.