Kolaboro / Docs / SDKs

Official SDKs

TypeScript and Python clients for the open data API. They check Kolaboro's Ed25519 signature on every answer before handing you the data, recompute Merkle proofs, and can audit the whole public log on your machine.

0.1.0version, both languages

…ES module size

…Python wheel size

0runtime dependencies

Install

Not on npm or PyPI yet: install straight from kolaboro.com and compare the hash. The hashes below are read from /sdk/manifest.json and /sdk/SHA256SUMS; the button recomputes them in your browser from the files themselves.

JavaScript and TypeScript

Browsers, Node 20+, Deno, Bun and Cloudflare Workers. Types in kolaboro.d.ts.

import { Kolaboro } from 'https://kolaboro.com/sdk/kolaboro-0.1.0.mjs'; const k = new Kolaboro(); // verify: true by default const s = await k.stats(); console.log(s.projects, k.last.signature); // { checked: true, ok: true, kid: 'kb-…' }

Pin the versioned file with Subresource Integrity. SHA-384 (SRI):

…

The unversioned /sdk/kolaboro.mjs always points to the latest release; /sdk/kolaboro-0.1.0.mjs never changes.

Python 3.8+

pip install https://kolaboro.com/sdk/kolaboro-0.1.0-py3-none-any.whl

SHA-256 of the wheel:

…

from kolaboro import Kolaboro k = Kolaboro() for p in k.all_projects(market='Dubai', min_confirmed=3): print(p['id'], p['score'], p['vscore']) print(k.audit_log()['ok'])

No dependency. With pip install "kolaboro[fast] @ https://kolaboro.com/sdk/kolaboro-0.1.0-py3-none-any.whl" the cryptography package checks signatures; without it the RFC 8032 reference code inside the package does (slower, same answers).

Try it here

This loads /sdk/kolaboro-0.1.0.mjs in your browser and runs it against the live API: one signed answer, one Merkle proof, and a full audit of the public log.

Output appears here.

What the client checks for you

Signatures. Every JSON and CSV answer of /api/open/* carries x-kolaboro-signature: Ed25519 over "kolaboro-sig-v1\n" + SHA-256(body). The client checks it against keys pinned in the package (looking up unknown key ids once at /.well-known/kolaboro-keys.json, and refusing revoked keys). A missing or wrong signature throws KolaboroSignatureError; the data is never returned.
Proofs. verifyProject(id) recomputes the project's leaf and Merkle path up to the daily root recorded in the public log.
The log. auditLog() recomputes every daily head and its link to the previous one, checks the signed checkpoint, proves every day is in the checkpoint tree, and proves each older tree is a prefix of the current one (RFC 9162 consistency).
The dataset. dataset() downloads /data/bali-cases.json and compares its SHA-256 with the fingerprint in a signed answer.

The verification code is not new: it is kolaboro-verify.js and kolaboro_verify.py, bundled unchanged, the same code that already checks our test vectors every day.

Methods

TypeScript	Python	Endpoint
stats()	stats()	/api/open/stats
projects(filters)	projects(**filters)	/api/open/projects (market, country, stage, min_public, min_confirmed, all_six, flags, limit, offset)
allProjects(filters)	all_projects(**filters)	pages through /api/open/projects
project(id), projectAt(id, day)	project(id), project_at(id, day)	/api/open/projects/{id}, /at/{day}
markets(), marketsCsv(), projectsCsv()	markets(), markets_csv(), projects_csv()	/api/open/markets, CSV
changes(since), freshness()	changes(since), freshness()	/api/open/changes, /freshness
log(), logInput(), proof(id)	log(), log_input(), proof(id)	/api/open/log, /log-input, /proof/{id}
checkpoint(), logProof(day), logConsistency(m, n)	checkpoint(), log_proof(day), log_consistency(m, n)	/api/open/checkpoint, /log-proof, /log-consistency
verifyProject(id), auditLog(), dataset()	verify_project(id), audit_log()	checks run locally
evals(), uptime(), aiSpend(), build(), pdf(sha), receipt(id)	evals(), uptime(), ai_spend(), build(), pdf(sha), receipt(id)	/api/open/…
json(path), text(path)	json(path), text(path)	any /api/open path, signature checked

Options: baseUrl, verify (default true), apiKey, timeoutMs, retries (429 and 5xx, exponential backoff), fetch, publicKeys. With an API key the same calls go through the metered endpoint /api/x/k/m/*, which returns the identical signed body and counts the call against your daily quota.

Tests

Both packages are tested against production, not against mocks: signed answers, a tampered body and a stripped signature (both must be refused), filters, paging through every project, a 404, a Merkle proof, the checkpoint, a full log audit and the published test vectors.

Suite	Tests	Result	Run
TypeScript (node --test, Node 22)	13	13 passed	3 Nov 2026
Python (unittest, Python 3.13, clean venv without cryptography)	12	12 passed	3 Nov 2026

node --test sdk/src/js/test.mjs cd sdk/src/python && python3 -m unittest discover -s tests

Source

Everything is published: kolaboro.ts, client.py, types.py, the tests (JS, Python), the build script, the wheel builder and the README. MIT licence. The data stays CC BY 4.0: credit Kolaboro.

Not yet: packages on npm and PyPI (they need accounts in the company's name), a Go client (the verifier exists in Go, the client does not).