Authorization: Bearer …. Two things are easy to get wrong:
- Publishing is not a separate resource.
publishis a query flag ontransformations.create,transformations.update,libraries.createandlibraries.update. Without it the call only writes a revision: the code is not live, andtransformations.connectanswers400 "Transformation is not published". - Use the right region. A token only works on the host its workspace lives in. Pass
region: 'eu'when you sign in atapp.eu.rudderstack.com; the default is the US host,api.rudderstack.com.regionis a plugin option, not part of a tenant’s credentials, so every tenant of one plugin instance uses the same host.
libraries.publishpublishes both kinds of revision. Despite the path, it takestransformationsandlibrariesarrays of version IDs and needs at least one of them. RudderStack runs the code on its servers first, so a failing test rejects the whole call and publishes nothing.- Every update writes a revision.
transformations.updateandlibraries.updatealways append one, so the plugin never retries them after a failure: a retry would leave a second revision behind that nobody asked for. - A destination holds one transformation.
transformations.connectreplaces whatever was connected to that destination, so readtransformationsbefore connecting if the existing one matters. - The name and language are fixed. A library’s
importNamecomes from its name at creation and neither can be changed; a transformation cannot switch betweenjavascriptandpythonfaas.libraries.updatestill requireslanguage, because RudderStack validates it against the existing value. - Container keys differ per route.
GET /transformationsanswerstransformations, the version routes answerTransformationVersions(capital T) andlibraryVersions, and the get-by-ID routes answer the object itself. The response models follow each route. - Errors carry only a message. There is no error code and no documented error catalogue, so the status is the only structured signal.
401isInvalid Access TokenorUnauthorised;403is a token missing a scope. - Paging: the version routes take
count(default 5) andorderBy(ascordesconcreatedAt), and nothing else.
- 17 typed API operations
Setup
1
Install
2
Add the plugin
corsair.ts
multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.3
Choose authentication
- API Key (Recommended)
No setup required yet. When you make your first request as a tenant, Corsair prompts for the API key.More: API Key
4
Connect a tenant
Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.
Example API calls
List the published transformationsWhat’s next
API reference
Every
rudderstacktransform.api.* operation with input and output types.Connect / OAuth
createLink, Hub delivery, and tenant connect flows.
Use with agents
Expose this plugin’s operations as MCP tools.