Gateco

from gateco_sdk import GatecoClient
client = GatecoClient("https://api.gateco.ai")client.login("[email protected]", "...")
result = client.retrievals.execute(    query="What is the CEO's salary?",    principal_id="user_james_wu",    connector_id="connector_hr_docs",    search_mode="hybrid",)
# result.allowed_chunks → [] (denied — James Wu lacks HR classification access)# result.denied_count   → 1# result.decision       → "DENIED"# Your AI model never sees the salary data

from gateco_sdk import AsyncGatecoClient, GatecoClient
# Async client with API keyclient = AsyncGatecoClient("https://api.gateco.ai", api_key="gck_live_abc123...")
# Sync client with API keyclient = GatecoClient("https://api.gateco.ai", api_key="gck_live_abc123...")
# Or use email/password login (issues a short-lived JWT)client = GatecoClient("https://api.gateco.ai")client.login("[email protected]", "password")

import asynciofrom gateco_sdk import AsyncGatecoClient
async def main():    async with AsyncGatecoClient(        "https://api.gateco.ai",        api_key="gck_live_abc123...",    ) as client:
        # Policy-gated retrieval — the core Gateco primitive        result = await client.retrievals.execute(            query="What is the CEO's salary?",            principal_id="user_james_wu",            connector_id="connector_hr_docs",            search_mode="hybrid",            alpha=0.7,   # 70% vector weight, 30% keyword            top_k=5,        )
        # Allowed chunks are safe to pass to your LLM        for chunk in result.allowed_chunks:            print(f"[ALLOWED] {chunk.resource_id} score={chunk.score}")
        # Denied chunks are redacted — only metadata is surfaced        print(f"Denied: {result.denied_count} chunk(s)")
asyncio.run(main())

from gateco_sdk import GatecoClient
with GatecoClient("https://api.gateco.ai", api_key="gck_live_abc123...") as client:    result = client.retrievals.execute(        query="What is the CEO's salary?",        principal_id="user_james_wu",        connector_id="connector_hr_docs",        search_mode="hybrid",    )    print(result.decision)  # "DENIED"

# Vector search (default) — semantic similarityresult = await client.retrievals.execute(    query="quarterly earnings", principal_id="...", connector_id="...",)
# Keyword search — ranked full-text search (BM25)result = await client.retrievals.execute(    query="quarterly earnings", principal_id="...", connector_id="...",    search_mode="keyword",)
# Hybrid search — vector + keyword fused (RRF)result = await client.retrievals.execute(    query="quarterly earnings", principal_id="...", connector_id="...",    search_mode="hybrid",    alpha=0.5,   # 1.0 = all-vector, 0.0 = all-keyword)
# Grep — exact pattern matchingresult = await client.retrievals.execute(    query="ERR-4021", principal_id="...", connector_id="...",    search_mode="grep",    pattern_type="regex",    case_sensitive=False,)

# Create a key — the plaintext is returned exactly oncekey_info = await client.api_keys.create(name="prod-worker")print(key_info["key"])    # gck_live_abc123...  (store this securely)print(key_info["prefix"]) # gck_live_abc
# List keys (plaintext never returned after creation)keys = await client.api_keys.list()
# Rotate a key — old key is invalidated immediatelynew_key = await client.api_keys.rotate(key_id="key-uuid-here")
# Delete a keyawait client.api_keys.delete(key_id="key-uuid-here")

# Create a direct relation: Alice owns resource Rrel = await client.relationships.create(    subject_principal_id="principal-uuid",    relation_name="owner_of",    object_resource_id="resource-uuid",)print(rel["id"])
# List relations for a principalrels = await client.relationships.list(    subject_id="principal-uuid",    relation="owner_of",)
# Delete a relation (invalidates policy cache immediately)await client.relationships.delete(relationship_id=rel["id"])

# Policy rule: allow access when principal has owner_of relation on the resourcerule = {"field": "relation.owner_of", "operator": "eq", "value": True}

# Check which onboarding steps are completestatus = await client.onboarding.status()for step in status["steps"]:    print(f"{step['name']:30s}  {step['status']}")
# Dismiss the checklist once the org is fully configuredawait client.onboarding.dismiss()

# Resolve a principal by email (read-only — never creates)principal = await client.principals.resolve(email="[email protected]")
# Resolve by raw IDP-side user IDprincipal = await client.principals.resolve(provider_subject="okta-user-123")
# Scoped to a specific identity providerprincipal = await client.principals.resolve(    email="[email protected]",    identity_provider_id="idp-uuid-here",)

answer = await client.answers.execute(    query="Summarise the Q4 revenue results.",    principal_id="user_alice",    connector_id="connector_finance_docs",    search_mode="hybrid",)
print(answer.answer_text)      # LLM-generated answer from allowed chunks onlyprint(answer.outcome)          # "answered" | "no_access" | "insufficient_context"for citation in answer.citations:    print(f"  [{citation.score:.2f}] {citation.resource_id}")

# Create an RBAC policypolicy = await client.policies.create(    name="Engineering read-only",    description="Allow engineering group to read internal resources",    type="rbac",    effect="allow",    rules=[{        "description": "Engineering group members",        "effect": "allow",        "conditions": [{"field": "principal.groups", "operator": "contains", "value": "engineering"}],        "priority": 1,    }],    resource_selectors=[{"field": "resource.classification", "op": "lte", "value": "internal"}],)

result = await client.retrievals.execute(    query="quarterly earnings",    principal_id="user_alice",    connector_id="connector_finance_docs",    search_mode="hybrid",)
# All retrieval responses include diagnosticsprint(result.diagnostics.outcome_detail)    # Human-readable explanationprint(result.diagnostics.candidates_fetched)  # How many candidates were checkedprint(result.diagnostics.candidates_denied)   # How many were denied by policyprint(result.diagnostics.refill_rounds)       # How many refill rounds ran (0 = first pass sufficient)

# Check if a connector is production-ready before using it in retrievalspreflight = client.connectors.preflight(connector_id="...")print(preflight.ready_for_production)  # boolprint(preflight.recommendation)        # What to fix nextfor check in preflight.checks:    print(f"{check.name}: {'PASS' if check.passed else 'FAIL'} (blocking={check.blocking})")

# Aggregated dashboard statisticsstats = await client.dashboard.stats()print(stats["total_retrievals"])print(stats["allowed_retrievals"])
# Activation funnel metricsactivation = client.dashboard.get_activation_stats()print(activation.total_retrievals_30d)print(activation.allowed_retrievals_30d)print(activation.no_access_retrievals_30d)  # Retrievals where 0 results were authorizedprint(activation.p95_latency_ms)            # End-to-end p95 latency

async for connector in client.connectors.list_all():    print(connector.name)

from gateco_sdk.errors import NotFoundError, RateLimitError, AuthenticationError
try:    conn = await client.connectors.get("nonexistent-id")except NotFoundError:    print("Connector not found")except RateLimitError as e:    print(f"Rate limited — retry after {e.retry_after}s")except AuthenticationError:    print("Invalid or expired credentials")