The management client

ledger.fetch answers one question: what did this request cost? The admin plane answers several hundred more, and the management client is the typed way to ask them from code.

Reach for it when you are scripting the control plane — exporting spend by tenant, minting virtual keys, reading anomaly findings, driving a config change from CI. Reach for ledger.fetch when you want a costed row and nothing else.

Getting a client

It ships inside the same package, under its own import path, and is not re-exported from the root.

from tokentriage.management import Client

client = Client("http://127.0.0.1:9090")     # or $TOKENTRIAGE_ADMIN_URL
caps = client.meta.capabilities_get()
print(caps.management_api.version)

import { Client } from "tokentriage/management";

const client = new Client("http://127.0.0.1:9090");
const caps = await client.meta.capabilitiesGet();
console.log(caps.managementApi.version);

2.19

That number is the management contract version, and it is not the SDK’s contract version. The instrumentation contract is at 1 and moves rarely; the management contract tracks the admin API and moves whenever a resource is added. Asking the server for its version is the first call worth making, because a client generated against 2.19 talking to an older server will find operations that are not there.

What is on it

Calls are grouped by resource, matching the server’s own structure:

alerts · analytics · annotation_queue · annotations · anomalies · audit · auth · budgets
cache · config · content · control · costanalytics · evals · events · evidence · exports
feedback · fleet · governance · guardrails · instances · judges · meta · outcomes · pricing
providers · quality · recommendations · reconcile · schedules · share · stream · tokens
users · views · webhooks

Thirty-seven groups, each carrying its own operations and typed models. The API reference renders the same surface from the same OpenAPI description, so use it to find the operation you want and this client to call it.

Every file here is generated

There is no hand-written module in either management package. Both are emitted from the server’s own resource registry, which is the same source the published OpenAPI description is generated from.

That arrangement is what makes one check sufficient. A regeneration gate fails the build on any hand edit or stale file, and a cross-projection test compares the bindings to the contract field by field, so a divergence is a build failure rather than a runtime surprise.

Two consequences for you. Do not edit these files; regenerate them. And an operation missing from the client is missing from the server’s registry too, rather than being an oversight in one language.

Credentials

The management token is TOKENTRIAGE_ADMIN_TOKEN, from the environment, with no keyword argument anywhere — the same rule as the instrumentation SDK, because this package reuses that transport.

The token is attached only after the far end has identified itself as this management plane, and it appears in no log line, exception message or repr. The credential protocol is the same one described for the ledger.

What can go wrong