interactor-sdk
Provides complete SDK implementations for integrating with the Interactor platform using TypeScript/Node.js or Python.
Install this skill
Security score
The interactor-sdk skill was audited on Feb 12, 2026 and we found 230 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 311 | config.headers.Authorization = `Bearer ${token}`; |
Template literal with variable interpolation in command context
| 409 | `/credentials/${credentialId}/token`, |
Template literal with variable interpolation in command context
| 430 | await this.coreClient.delete(`/credentials/${credentialId}`, { |
Template literal with variable interpolation in command context
| 437 | `/credentials/${credentialId}/refresh`, |
Template literal with variable interpolation in command context
| 470 | `/assistants/${assistantId}`, |
Template literal with variable interpolation in command context
| 489 | `/assistants/${assistantId}`, |
Template literal with variable interpolation in command context
| 511 | await this.coreClient.delete(`/assistants/${assistantId}`, { |
Template literal with variable interpolation in command context
| 535 | `/rooms/${roomId}`, |
Template literal with variable interpolation in command context
| 556 | await this.coreClient.delete(`/rooms/${roomId}`, { |
Template literal with variable interpolation in command context
| 572 | `/rooms/${roomId}/messages`, |
Template literal with variable interpolation in command context
| 585 | `/rooms/${roomId}/messages`, |
Template literal with variable interpolation in command context
| 617 | `/tools/${toolId}`, |
Template literal with variable interpolation in command context
| 638 | await this.coreClient.delete(`/tools/${toolId}`, { |
Template literal with variable interpolation in command context
| 650 | `/rooms/${roomId}/tool-results`, |
Template literal with variable interpolation in command context
| 680 | `/data-sources/${dataSourceId}`, |
Template literal with variable interpolation in command context
| 702 | `/data-sources/${dataSourceId}/sync`, |
Template literal with variable interpolation in command context
| 709 | await this.coreClient.delete(`/data-sources/${dataSourceId}`, { |
Template literal with variable interpolation in command context
| 737 | `/workflows/${workflowId}`, |
Template literal with variable interpolation in command context
| 758 | await this.coreClient.delete(`/workflows/${workflowId}`, { |
Template literal with variable interpolation in command context
| 782 | `/workflow-instances/${instanceId}`, |
Template literal with variable interpolation in command context
| 808 | `/workflow-instances/${instanceId}/input`, |
Template literal with variable interpolation in command context
| 822 | `/workflow-instances/${instanceId}/events`, |
Template literal with variable interpolation in command context
| 831 | `/workflow-instances/${instanceId}/cancel`, |
Template literal with variable interpolation in command context
| 843 | `/workflow-instances/${instanceId}/thread`, |
Template literal with variable interpolation in command context
| 855 | `/workflow-instances/${instanceId}/thread/messages`, |
Template literal with variable interpolation in command context
| 884 | `/webhooks/${webhookId}`, |
Template literal with variable interpolation in command context
| 910 | `/webhooks/${webhookId}`, |
Template literal with variable interpolation in command context
| 918 | await this.coreClient.delete(`/webhooks/${webhookId}`, { |
Template literal with variable interpolation in command context
| 925 | `/webhooks/${webhookId}/rotate-secret`, |
Template literal with variable interpolation in command context
| 938 | return `${this.config.coreApiUrl}/rooms/${roomId}/stream?token=${token}&namespace=${namespace}`; |
Template literal with variable interpolation in command context
| 943 | return `${this.config.coreApiUrl}/workflow-instances/${instanceId}/stream?token=${token}&namespace=${namespace}`; |
Template literal with variable interpolation in command context
| 1051 | `Request failed (attempt ${attempt + 1}/${maxRetries + 1}), ` + |
Template literal with variable interpolation in command context
| 1052 | `retrying in ${Math.round(waitMs / 1000)}s: ${error.message}` |
Template literal with variable interpolation in command context
| 1137 | console.error(`Interactor Error [${error.code}]:`, error.message); |
Template literal with variable interpolation in command context
| 1158 | `Missing required Interactor environment variables: ${missing.join(', ')}\n` + |
Template literal with variable interpolation in command context
| 2728 | console.log(`Unhandled event: ${payload.event}`); |
Template literal with variable interpolation in command context
| 2740 | console.log(`Credential connected: ${data.credential_id} for ${data.provider}`); |
Template literal with variable interpolation in command context
| 2745 | console.log(`Credential expired: ${data.credential_id}`); |
Template literal with variable interpolation in command context
| 2750 | console.log(`Credential revoked: ${data.credential_id}`); |
Template literal with variable interpolation in command context
| 2755 | console.log(`New message in room ${data.room_id}: ${data.content}`); |
Template literal with variable interpolation in command context
| 2760 | console.log(`Tool call pending: ${data.tool_call_id} for ${data.tool_name}`); |
Template literal with variable interpolation in command context
| 2765 | console.log(`Workflow halted: ${data.instance_id} at ${data.current_state}`); |
Template literal with variable interpolation in command context
| 2770 | console.log(`Workflow completed: ${data.instance_id}`); |
Template literal with variable interpolation in command context
| 3118 | id: `temp-${Date.now()}`, |
Template literal with variable interpolation in command context
| 3129 | id: `streaming-${Date.now()}`, |
Template literal with variable interpolation in command context
| 3149 | <div className={`text-sm px-4 py-1 ${isConnected ? 'bg-green-100' : 'bg-red-100'}`}> |
Template literal with variable interpolation in command context
| 3158 | className={`p-3 rounded-lg ${ |
Template literal with variable interpolation in command context
| 3402 | const namespace = `test_${Date.now()}`; |
Template literal with variable interpolation in command context
| 3872 | console.log(`Event ${event.idempotency_key} already processed, skipping`); |
Template literal with variable interpolation in command context
| 3949 | const response = await axios.post(`${accountServerUrl}/oauth/token`, { |
Template literal with variable interpolation in command context
| 3987 | const expectedNamespace = `user_${userId}`; |
Template literal with variable interpolation in command context
| 3993 | const namespace = `user_${req.user.id}`; |
Template literal with variable interpolation in command context
| 4175 | console.log(`Rate limited, waiting ${waitMs}ms before retry`); |
Template literal with variable interpolation in command context
| 4464 | `${client.config.coreApiUrl}/assistants`, |
Template literal with variable interpolation in command context
| 4468 | 'Authorization': `Bearer ${await client.getAccessToken()}`, |
Template literal with variable interpolation in command context
| 4521 | console.log(`Credential ${credentialId} refreshed successfully`); |
Template literal with variable interpolation in command context
| 4549 | title: `Your ${provider} connection expired`, |
Template literal with variable interpolation in command context
| 4553 | url: `/settings/connections/${credential_id}/reconnect`, |
Template literal with variable interpolation in command context
| 4582 | console.log(`Credential ${credentialId} fully revoked`); |
Webhook reference - potential data exfiltration
| 3 | description: Complete SDK implementations for Interactor platform integration. Use when building TypeScript/Node.js or Python applications that need full Interactor client libraries. Includes complete |
Webhook reference - potential data exfiltration
| 9 | Production-ready SDK implementations for TypeScript/Node.js and Python with complete client classes, webhook handlers, and real-time streaming components. |
Webhook reference - potential data exfiltration
| 15 | - **Webhook Handling**: Implementing secure webhook receivers with signature verification |
Webhook reference - potential data exfiltration
| 35 | # Optional - webhook secret for signature verification |
Webhook reference - potential data exfiltration
| 36 | INTERACTOR_WEBHOOK_SECRET=whsec_xxx |
Webhook reference - potential data exfiltration
| 267 | // Webhook Types |
Webhook reference - potential data exfiltration
| 268 | export interface Webhook { |
Webhook reference - potential data exfiltration
| 863 | // Webhooks |
Webhook reference - potential data exfiltration
| 866 | async createWebhook( |
Webhook reference - potential data exfiltration
| 873 | ): Promise<Webhook> { |
Webhook reference - potential data exfiltration
| 874 | const response = await this.coreClient.post<ApiResponse<Webhook>>( |
Webhook reference - potential data exfiltration
| 875 | '/webhooks', |
Webhook reference - potential data exfiltration
| 882 | async getWebhook(namespace: string, webhookId: string): Promise<Webhook> { |
Webhook reference - potential data exfiltration
| 883 | const response = await this.coreClient.get<ApiResponse<Webhook>>( |
Webhook reference - potential data exfiltration
| 884 | `/webhooks/${webhookId}`, |
Webhook reference - potential data exfiltration
| 890 | async listWebhooks( |
Webhook reference - potential data exfiltration
| 893 | ): Promise<PaginatedResponse<Webhook>> { |
Webhook reference - potential data exfiltration
| 894 | const response = await this.coreClient.get<PaginatedResponse<Webhook>>( |
Webhook reference - potential data exfiltration
| 895 | '/webhooks', |
Webhook reference - potential data exfiltration
| 904 | async updateWebhook( |
Webhook reference - potential data exfiltration
| 906 | webhookId: string, |
Webhook reference - potential data exfiltration
| 908 | ): Promise<Webhook> { |
Webhook reference - potential data exfiltration
| 909 | const response = await this.coreClient.patch<ApiResponse<Webhook>>( |
Webhook reference - potential data exfiltration
| 910 | `/webhooks/${webhookId}`, |
Webhook reference - potential data exfiltration
| 917 | async deleteWebhook(namespace: string, webhookId: string): Promise<void> { |
Webhook reference - potential data exfiltration
| 918 | await this.coreClient.delete(`/webhooks/${webhookId}`, { |
Webhook reference - potential data exfiltration
| 923 | async rotateWebhookSecret(namespace: string, webhookId: string): Promise<Webhook> { |
Webhook reference - potential data exfiltration
| 924 | const response = await this.coreClient.post<ApiResponse<Webhook>>( |
Webhook reference - potential data exfiltration
| 925 | `/webhooks/${webhookId}/rotate-secret`, |
Webhook reference - potential data exfiltration
| 2013 | # Webhooks |
Webhook reference - potential data exfiltration
| 2016 | async def create_webhook( |
Webhook reference - potential data exfiltration
| 2023 | """Create a webhook.""" |
Webhook reference - potential data exfiltration
| 2026 | "/webhooks", |
Webhook reference - potential data exfiltration
| 2036 | async def get_webhook(self, namespace: str, webhook_id: str) -> Dict[str, Any]: |
Webhook reference - potential data exfiltration
| 2037 | """Get webhook by ID.""" |
Webhook reference - potential data exfiltration
| 2040 | f"/webhooks/{webhook_id}", |
Webhook reference - potential data exfiltration
| 2045 | async def list_webhooks( |
Webhook reference - potential data exfiltration
| 2051 | """List webhooks.""" |
Webhook reference - potential data exfiltration
| 2054 | "/webhooks", |
Webhook reference - potential data exfiltration
| 2063 | async def update_webhook( |
Webhook reference - potential data exfiltration
| 2066 | webhook_id: str, |
Webhook reference - potential data exfiltration
| 2069 | """Update a webhook.""" |
Webhook reference - potential data exfiltration
| 2072 | f"/webhooks/{webhook_id}", |
Webhook reference - potential data exfiltration
| 2078 | async def delete_webhook(self, namespace: str, webhook_id: str) -> None: |
Webhook reference - potential data exfiltration
| 2079 | """Delete a webhook.""" |
Webhook reference - potential data exfiltration
| 2082 | f"/webhooks/{webhook_id}", |
Webhook reference - potential data exfiltration
| 2086 | async def rotate_webhook_secret( |
Webhook reference - potential data exfiltration
| 2089 | webhook_id: str |
Webhook reference - potential data exfiltration
| 2091 | """Rotate webhook secret.""" |
Webhook reference - potential data exfiltration
| 2094 | f"/webhooks/{webhook_id}/rotate-secret", |
Webhook reference - potential data exfiltration
| 2172 | > workflows, and webhooks. For advanced features like Tools, Data Sources, and Workflow Threads, |
Webhook reference - potential data exfiltration
| 2497 | # ========== Webhooks ========== |
Webhook reference - potential data exfiltration
| 2499 | def create_webhook(self, namespace: str, url: str, events: List[str]) -> Dict[str, Any]: |
Webhook reference - potential data exfiltration
| 2502 | "/webhooks", |
Webhook reference - potential data exfiltration
| 2507 | def list_webhooks(self, namespace: str) -> Dict[str, Any]: |
Webhook reference - potential data exfiltration
| 2508 | return self._request("GET", "/webhooks", namespace=namespace) |
Webhook reference - potential data exfiltration
| 2510 | def delete_webhook(self, namespace: str, webhook_id: str) -> None: |
Webhook reference - potential data exfiltration
| 2511 | self._request("DELETE", f"/webhooks/{webhook_id}", namespace=namespace) |
Webhook reference - potential data exfiltration
| 2513 | def get_webhook(self, namespace: str, webhook_id: str) -> Dict[str, Any]: |
Webhook reference - potential data exfiltration
| 2514 | """Get webhook by ID.""" |
Webhook reference - potential data exfiltration
| 2515 | return self._request("GET", f"/webhooks/{webhook_id}", namespace=namespace)["data"] |
Webhook reference - potential data exfiltration
| 2517 | def update_webhook( |
Webhook reference - potential data exfiltration
| 2520 | webhook_id: str, |
Webhook reference - potential data exfiltration
| 2525 | """Update a webhook.""" |
Webhook reference - potential data exfiltration
| 2535 | f"/webhooks/{webhook_id}", |
Webhook reference - potential data exfiltration
| 2654 | ## Webhook Handler Examples |
Webhook reference - potential data exfiltration
| 2656 | ### Express.js Webhook Handler |
Webhook reference - potential data exfiltration
| 2659 | // src/webhooks/express-handler.ts |
Webhook reference - potential data exfiltration
| 2666 | app.use('/webhooks/interactor', express.raw({ type: 'application/json' })); |
Webhook reference - potential data exfiltration
| 2668 | interface WebhookPayload { |
Webhook reference - potential data exfiltration
| 2690 | app.post('/webhooks/interactor', async (req, res) => { |
Webhook reference - potential data exfiltration
| 2692 | const webhookSecret = process.env.INTERACTOR_WEBHOOK_SECRET!; |
Webhook reference - potential data exfiltration
| 2695 | if (!signature || !verifySignature(req.body, signature, webhookSecret)) { |
Webhook reference - potential data exfiltration
| 2696 | console.error('Invalid webhook signature'); |
Webhook reference - potential data exfiltration
| 2701 | const payload: WebhookPayload = JSON.parse(req.body.toString()); |
Webhook reference - potential data exfiltration
| 2733 | console.error('Webhook processing error:', error); |
Webhook reference - potential data exfiltration
| 2775 | console.log('Webhook server listening on port 3000'); |
Webhook reference - potential data exfiltration
| 2779 | ### Flask Webhook Handler |
Webhook reference - potential data exfiltration
| 2782 | # webhooks/flask_handler.py |
Webhook reference - potential data exfiltration
| 2791 | WEBHOOK_SECRET = os.environ["INTERACTOR_WEBHOOK_SECRET"] |
Webhook reference - potential data exfiltration
| 2794 | """Verify webhook signature using HMAC SHA256.""" |
Webhook reference - potential data exfiltration
| 2796 | WEBHOOK_SECRET.encode(), |
Webhook reference - potential data exfiltration
| 2802 | @app.route("/webhooks/interactor", methods=["POST"]) |
Webhook reference - potential data exfiltration
| 2803 | def handle_webhook(): |
Webhook reference - potential data exfiltration
| 2830 | app.logger.error(f"Webhook handler error: {e}") |
Webhook reference - potential data exfiltration
| 3475 | ### Webhook Security |
Webhook reference - potential data exfiltration
| 3476 | - Always verify webhook signatures using HMAC SHA-256 |
Webhook reference - potential data exfiltration
| 3478 | - Implement idempotency keys for webhook processing |
Webhook reference - potential data exfiltration
| 3479 | - Log all webhook events for debugging |
Webhook reference - potential data exfiltration
| 3496 | - [ ] Webhook signature verification enabled |
Webhook reference - potential data exfiltration
| 3687 | #### Webhook Endpoints |
Webhook reference - potential data exfiltration
| 3691 | | `POST` | `/webhooks` | Create webhook | |
Webhook reference - potential data exfiltration
| 3692 | | `GET` | `/webhooks` | List webhooks | |
Webhook reference - potential data exfiltration
| 3693 | | `GET` | `/webhooks/{id}` | Get webhook by ID | |
Webhook reference - potential data exfiltration
| 3694 | | `PATCH` | `/webhooks/{id}` | Update webhook | |
Webhook reference - potential data exfiltration
| 3695 | | `DELETE` | `/webhooks/{id}` | Delete webhook | |
Webhook reference - potential data exfiltration
| 3696 | | `POST` | `/webhooks/{id}/rotate-secret` | Rotate webhook secret | |
Webhook reference - potential data exfiltration
| 3700 | ## Webhook Event Catalog |
Webhook reference - potential data exfiltration
| 3725 | interface WebhookEvent { |
Webhook reference - potential data exfiltration
| 3833 | ### Webhook Delivery Semantics |
Webhook reference - potential data exfiltration
| 3869 | async function handleWebhook(event: WebhookEvent): Promise<void> { |
Webhook reference - potential data exfiltration
| 3898 | """Decorator for idempotent webhook handling.""" |
Webhook reference - potential data exfiltration
| 3900 | key = f"webhook:processed:{event['idempotency_key']}" |
Webhook reference - potential data exfiltration
| 3941 | | `webhooks:read` | Read webhooks | `GET /webhooks` | |
Webhook reference - potential data exfiltration
| 3942 | | `webhooks:write` | Manage webhooks | `POST/PATCH/DELETE /webhooks` | |
Webhook reference - potential data exfiltration
| 4024 | INTERACTOR_WEBHOOK_SECRET=whsec_xxx # Webhook verification secret |
Webhook reference - potential data exfiltration
| 4043 | **Rotate Webhook Secret:** |
Webhook reference - potential data exfiltration
| 4045 | // API supports webhook secret rotation |
Webhook reference - potential data exfiltration
| 4046 | const result = await client.rotateWebhookSecret(namespace, webhookId); |
Webhook reference - potential data exfiltration
| 4059 | - Webhook deliveries logged with retry attempts |
Webhook reference - potential data exfiltration
| 4073 | - [ ] Webhook signature verification enabled |
Webhook reference - potential data exfiltration
| 4130 | - Added idempotency_key to all webhook events |
Webhook reference - potential data exfiltration
| 4215 | - Use webhooks instead of polling for real-time updates |
Webhook reference - potential data exfiltration
| 4252 | // Webhook metrics |
Webhook reference - potential data exfiltration
| 4253 | 'interactor_webhook_received_total': { |
Webhook reference - potential data exfiltration
| 4256 | description: 'Webhooks received', |
Webhook reference - potential data exfiltration
| 4258 | 'interactor_webhook_processing_duration_ms': { |
Webhook reference - potential data exfiltration
| 4261 | description: 'Webhook processing time', |
Webhook reference - potential data exfiltration
| 4351 | | Webhook processing failures | > 10% | Warning | |
Webhook reference - potential data exfiltration
| 4497 | | Create Webhook | UUID or hash of (namespace + url + events) | |
Webhook reference - potential data exfiltration
| 4535 | // Webhook handler for credential expiry |
Webhook reference - potential data exfiltration
| 4586 | ### Webhook Secret Rotation |
Webhook reference - potential data exfiltration
| 4589 | // Rotate webhook secret with zero downtime |
Webhook reference - potential data exfiltration
| 4590 | async function rotateWebhookSecret( |
Webhook reference - potential data exfiltration
| 4593 | webhookId: string |
Webhook reference - potential data exfiltration
| 4596 | const oldSecret = process.env.INTERACTOR_WEBHOOK_SECRET; |
Webhook reference - potential data exfiltration
| 4599 | const result = await client.rotateWebhookSecret(namespace, webhookId); |
Webhook reference - potential data exfiltration
| 4603 | await secretsManager.put('INTERACTOR_WEBHOOK_SECRET', newSecret); |
Webhook reference - potential data exfiltration
| 4604 | await secretsManager.put('INTERACTOR_WEBHOOK_SECRET_OLD', oldSecret); |
Webhook reference - potential data exfiltration
| 4611 | await secretsManager.delete('INTERACTOR_WEBHOOK_SECRET_OLD'); |
Webhook reference - potential data exfiltration
| 4621 | process.env.INTERACTOR_WEBHOOK_SECRET, |
Webhook reference - potential data exfiltration
| 4622 | process.env.INTERACTOR_WEBHOOK_SECRET_OLD, |
Webhook reference - potential data exfiltration
| 4675 | ### 5. Setup Webhook (5 min) |
Webhook reference - potential data exfiltration
| 4677 | - [ ] Register webhook |
Webhook reference - potential data exfiltration
| 4701 | - **interactor-webhooks**: Webhook and SSE event handling |
Webhook reference - potential data exfiltration
| 4711 | 4. Implements secure webhook verification |
Ngrok tunnel reference
| 4676 | - [ ] Expose endpoint (use ngrok for local dev) |
Access to .env file
| 1073 | clientId: process.env.INTERACTOR_CLIENT_ID!, |
Access to .env file
| 1074 | clientSecret: process.env.INTERACTOR_CLIENT_SECRET!, |
Access to .env file
| 1100 | clientId: process.env.INTERACTOR_CLIENT_ID!, |
Access to .env file
| 1101 | clientSecret: process.env.INTERACTOR_CLIENT_SECRET!, |
Access to .env file
| 1154 | const missing = required.filter((key) => !process.env[key]); |
Access to .env file
| 1159 | `Please configure these in your .env file or environment.` |
Access to .env file
| 2692 | const webhookSecret = process.env.INTERACTOR_WEBHOOK_SECRET!; |
Access to .env file
| 3398 | const runIntegrationTests = process.env.INTERACTOR_SANDBOX_CLIENT_ID; |
Access to .env file
| 3406 | clientId: process.env.INTERACTOR_SANDBOX_CLIENT_ID!, |
Access to .env file
| 3407 | clientSecret: process.env.INTERACTOR_SANDBOX_CLIENT_SECRET!, |
Access to .env file
| 3951 | client_id: process.env.INTERACTOR_CLIENT_ID, |
Access to .env file
| 3952 | client_secret: process.env.INTERACTOR_CLIENT_SECRET, |
Access to .env file
| 3961 | # .env for background job processor |
Access to .env file
| 3967 | # .env for API server |
Access to .env file
| 3973 | # .env for admin service |
Access to .env file
| 4596 | const oldSecret = process.env.INTERACTOR_WEBHOOK_SECRET; |
Access to .env file
| 4621 | process.env.INTERACTOR_WEBHOOK_SECRET, |
Access to .env file
| 4622 | process.env.INTERACTOR_WEBHOOK_SECRET_OLD, |
External URL reference
| 55 | | **Account Server** | `https://auth.interactor.com/api/v1` | Authentication, OAuth clients | |
External URL reference
| 56 | | **Core API** | `https://core.interactor.com/api/v1` | Credentials, Agents, Workflows | |
External URL reference
| 290 | accountServerUrl: 'https://auth.interactor.com/api/v1', |
External URL reference
| 291 | coreApiUrl: 'https://core.interactor.com/api/v1', |
External URL reference
| 1194 | account_server_url: str = "https://auth.interactor.com/api/v1" |
External URL reference
| 1195 | core_api_url: str = "https://core.interactor.com/api/v1" |
External URL reference
| 2194 | account_server_url: str = "https://auth.interactor.com/api/v1" |
External URL reference
| 2195 | core_api_url: str = "https://core.interactor.com/api/v1" |
External URL reference
| 3512 | | Production | `https://auth.interactor.com/api/v1` | `https://core.interactor.com/api/v1` | |
External URL reference
| 3513 | | Sandbox | `https://sandbox-auth.interactor.com/api/v1` | `https://sandbox-core.interactor.com/api/v1` | |
External URL reference
| 3591 | > - Production: `https://core.interactor.com/api/v1/openapi.yaml` |
External URL reference
| 4644 | INTERACTOR_ACCOUNT_SERVER_URL=https://sandbox-auth.interactor.com/api/v1 |
External URL reference
| 4645 | INTERACTOR_CORE_API_URL=https://sandbox-core.interactor.com/api/v1 |
External URL reference
| 4656 | - [ ] Create account at https://dashboard.interactor.com |
External URL reference
| 4688 | | Status Page | https://status.interactor.com | |
External URL reference
| 4691 | | Community Discord | https://discord.gg/interactor | |