Go SDK

Getting it

go get github.com/403ent/transmute/sdk/[email protected]

The module is versioned by sdk/go/vX.Y.Z tags cut from the same commit as API release vX.Y.Z; pin the version matching the API release you target.

First publish pending. Until the first tagged release is publicly resolvable, access to the module is provided during onboarding — contact support if go get can't resolve it yet.

Convert a message

package main

import (
    "context"
    "fmt"
    "os"

    transmute "github.com/403ent/transmute/sdk/go"
)

func main() {
    client, err := transmute.New(
        "https://api.transmute.403fin.io",
        transmute.WithAPIKey(os.Getenv("TRANSMUTE_KEY")),
    )
    if err != nil {
        panic(err)
    }

    resp, err := client.ConvertMessageWithResponse(context.Background(),
        &transmute.ConvertMessageParams{},
        transmute.ConvertRequest{
            To:      "camt.053",
            Message: mt940Text, // raw MT; From omitted → auto-detect
        })
    if err != nil {
        panic(err) // transport failure
    }
    if resp.JSON200 == nil {
        // API error: resp.StatusCode() and the RFC 9457 problem in resp.Body
        panic(string(resp.Body))
    }

    fmt.Println(resp.JSON200.Meta.DetectedType) // "mt940"
    for _, w := range resp.JSON200.Warnings {
        fmt.Printf("%s (%s)
", w.Code, w.Severity)
    }
}

Client embeds the generated ClientWithResponses, so every route has a <Operation>WithResponse method: NormalizeMessageWithResponse, ValidateMessageWithResponse, ConvertBatchWithResponse, ListJobItemsWithResponse, DiffMessagesWithResponse, VerifyConversionWithResponse, AnonymizeMessageWithResponse, GetSampleWithResponse, ListHistoryWithResponse, the override, webhook and connection routes, and more. Raw-body variants (ConvertMessageWithTextBodyWithResponse) take the message text directly, with from and to in the params struct. Each typed response carries JSON200 (and other status-specific fields) next to the raw Body.

transmute.WithToken(...) authenticates with an OAuth access token instead of an API key; transmute.WithHTTPDoer(...) injects your own http.Client (proxies, custom timeouts).

Pin the API version

New in this release: transmute.WithAPIVersion("2026-06-01") sends X-Api-Version on every request, pinning date-versioned behaviour (today, the default Standards Release). An XApiVersion set in one call's params wins over it. Leave it out to follow your API key's pin, else the current version. See Migrating from SR2025 to SR2026.

client, err := transmute.New(
    "https://api.transmute.403fin.io",
    transmute.WithAPIKey(os.Getenv("TRANSMUTE_KEY")),
    transmute.WithAPIVersion("2026-06-01"),
)

Verify a webhook delivery

err := transmute.VerifyWebhookSignature(
    endpointSecret,                        // "whsec_..." — the full string
    r.Header.Get("X-Transmute-Signature"), // "t=...,v1=..."
    rawBody,                               // raw bytes, read before parsing
    5*time.Minute,                         // timestamp tolerance
)

Constant-time comparison and the replay-window check are built in — see Webhooks for the delivery contract.

Notes

• The client is generated from the same OpenAPI document that serves api.transmute.403fin.io/docs; a CI gate keeps them in lockstep.
• Amount fields are strings in all response types — parse with a decimal library, never float64.
• Error responses carry the RFC 9457 problem body (typed per status, for example ApplicationproblemJSON400), including the type slug from the error catalog.
• Requires Go 1.25 or newer.
• The portal endpoints are intentionally absent from the SDK — they are the web dashboard's internal surface.