finos-automation-sdk

The FinOS automation client SDK (import name finos.automation). Automation scripts import it to follow the FinOS automation calling contract without re-implementing it: it calls only the public Ledger and Platform API endpoints over HTTPS with a Clerk-signed bearer token, and grants no capability the API would not already grant that token.

It is standalone — it depends only on PyPI packages, so it installs anywhere (e.g. on a Windmill worker) without the FinOS monorepo:

pip install finos-automation-sdk            # API calling + token minting
pip install "finos-automation-sdk[telemetry]"   # + Sentry telemetry

# Pre-release dry runs are published to TestPyPI:
pip install -i https://test.pypi.org/simple/ finos-automation-sdk

Three independent capabilities

# API calling (any automation) — built from a JWT the caller already has.
from finos.automation import FinOSAPIClient
async with FinOSAPIClient(received_jwt) as api:
    ledgers = await api.ledger.ledgers.list_ledgers()
    me = await api.platform.users.read_own_profile()

# Token generation (dispatcher only) — Clerk M2M, hidden behind TokenMinter.
from finos.automation import TokenMinter
minter = TokenMinter()                       # CLERK_MACHINE_SECRET_KEY from env
obo = await minter.mint_for_user("user_123") # signed on_behalf_of claim

# Telemetry (every client) — optional Sentry extra, safe no-op without a DSN.
from finos.automation import init_telemetry, TelemetryContext
init_telemetry(context=TelemetryContext("import-csv", run_id, "manual"))

Plus verify_user_token (JWKS verification of a received token) and a typed error taxonomy in finos.automation.errors.

Operations under api.ledger / api.platform are reflected from the OpenAPI-generated clients by tag (api.<service>.<tag>.<operation>(...)), so no operation is hand-written and none needs re-writing when the clients are regenerated.

Configuration

Every constructor argument is optional and falls back to an environment variable when None. The one value with no env fallback is the API client's JWT — it is always passed by the caller.

License

MIT