SDKs
Python and TypeScript
Define Workers, States, and Functions in the language your service is already written in. Typed clients, streaming responses, and local runs against the same runtime. Go SDK coming soon.
Build on Lemma.Any Surface. One Runtime.
SDKs for Python and TypeScript, a REST API, and a CLI. Define Workers in code, promote them through environments, and keep the governance and evidence you get in the canvas.
From Visual Canvas to Code-First Control.
Move between the visual builder, a code-first SDK, the API, and the CLI without leaving governance or runtime evidence behind. Terraform support is coming soon.
01# Define a Worker and its initial state.
02from sh.lemma.workers.worker import Worker
03from sh.lemma.states import SetState
04
05# Set the starting status
06worker = Worker(
07 name="My_Worker",
08 states=[
09 SetState(
10 name="Initialize",
11 set={"status": "started"},
12 ),
13 ],
14)
main.tf
01# Define Functions and other Lemma primitives, reviewed before deployment.
02# Register an internal API your team owns
03resource "lemma_api" "inventory" {
04 name = "inventory"
05 description = "Stock levels by SKU"
06 type = "OPENAPI_3_1"
07}
08
09# Version the contract every call must follow
10resource "lemma_api_spec" "inventory" {
11 api_id = lemma_api.inventory.id
12 main_file_path = "inventory.yaml"
13 contents = file("inventory.yaml")
14}
15
16# Approve which calls become Functions
17resource "lemma_api_listing" "inventory" {
18 api_id = lemma_api.inventory.id
19 spec_id = lemma_api_spec.inventory.id
20 base_url = "https://inventory.internal"
21 function {
22 method = "GET"
23 path = "/items/{sku}"
24 }
25}
01# Follow a Run through to its result.
02import os
03from sh.lemma.config import LemmaConfig
04from sh.lemma.runs import RunService
05
06# Connect with your API key
07config = LemmaConfig(
08 api_key=os.environ["LEMMA_API_KEY"],
09)
10runs = RunService(config=config)
11
12# Wait until it completes, fails, or pauses
13run = runs.wait_for_run_completion(
14 run_id="run_01J8K2",
15)
16print(run.status, run.end_time)
17
18# Read what the Run produced
19result = runs.get_result(run.id)
20print(result.data)
Four Surfaces. One Control Plane.
Everything the canvas can do, the API can do. The SDKs and CLI are thin clients over it, so a Worker defined in any of them runs on the same runtime, under the same policy, with the same evidence. The Go SDK and Terraform provider are coming soon.
REST API
Every Primitive, Over HTTP
Workers, runs, knowledge, tenants, webhooks, and audit logs. Versioned endpoints with the same identity and policy checks the canvas applies.
CLI
Validate, Deploy, Promote
Run a Worker locally, validate its policy and Connections, and promote it through environments from a shell or a CI job.
Terraform
Terraform Provider — Coming Soon
Infrastructure as code support is planned. The Terraform provider is not yet released.
Fine-Grained Access.
Access is granted per workspace, per folder, per Worker, and per action. Who can read a run, who can edit a State, who can approve a deploy, and which Connections a Worker may resolve are separate grants, written as policy, and checked on every call from every surface.
Policy grantsroles × actions
A table of roles against actions. Viewer reads evidence; operator runs and reads; approver approves and reads; admin does all four; a custom role is composed from run, approve, and read evidence.
4 built-in roles, and 1 composed from run, approve, and read evidence.
Policy grantsscopes × actions
A table of scopes against actions. A grant to run and approve is attached at the folder, inherited by the Worker and the environment under it, and does not reach the workspace above.
Attached at the folder and inherited downward, with nothing above it.
Policy grantsconnections × Workers
A table of connections against Workers. The review Worker resolves Slack, Postgres and an API key, is refused Vertex, and every resolution is written to a log under the table.
Prove Every Decision.
When someone asks what a Worker did and why, the answer is already written: the input, each policy decision, each approval, and what the model returned, recorded as it happened. The same trace leaves through OpenTelemetry, so it lands in the collector, the SIEM, and the dashboards you already run.
Run history and execution trace
Runs Where You Run.
A Worker is the same object in every deployment model. Which one it lands in is a setting on the environment, not a fork of the code, so moving from our cloud to yours to no cloud at all is a plan and an apply.
Managed, Multi-Tenant
Start on our cloud. Logical isolation per tenant, continuous updates, and nothing of your own to operate.
Managed, Single-Tenant
Dedicated infrastructure we run for you, with your own upgrade window and configuration.
Your Cloud
Deploy into your own Google Cloud or Azure account through the marketplace listing. Data never leaves your boundary.
On-Premise and Air-Gapped
GovCloud, your data center, or no network at all. SOC 2 Type 2, HIPAA, GDPR, and CJIS, with CMMC Level 2 in progress and FedRAMP next.
Procure it through the cloud marketplace you already buy from, and deploy from the same listing.
The Canvas Is Optional.The Governance Is Not.
Whatever surface you build on, every run carries the same identity, policy, and evidence. Swap models, swap providers, move from a laptop to an air-gapped site, and nothing about the Worker has to change.
Ready to Build?
Start with the quickstart.
Read the Docs