Imported from context-plugins/plugin-marketplace (plugins/plaid/skills/typescript/typescript-getting-started/SKILL.md). Install upstream with npx skills add context-plugins/plugin-marketplace --skill typescript-getting-started. Copyright stays with the author.

Getting started with the The Plaid API TypeScript SDK

Who this skill is for. This is the lookup layer for anyone writing The Plaid API TypeScript SDK code — it is yours to follow directly and fully. Ground every contract fact here (in the SDK map, and in the source files it names) rather than in recall, and carry those facts onto a contract sheet before you implement. Load typescript-integrate-the-plaid-api for the workflow that wraps this skill.

This is the SDK-specific entry point. For general patterns that apply to any APIMatic-generated TypeScript SDK (client construction, auth, calling endpoints, models, error handling, resilience, testing), see the companion API-agnostic skills: typescript-client-initialization, typescript-authentication, typescript-calling-endpoints, typescript-models, typescript-error-handling, typescript-configuration-resilience and typescript-testing.

This page and those companion skills are complementary — load both. This page is authoritative for the SDK's identity and surface (what to install, what to import, the resources, which file owns which fact); the companion skills are the usage layer on top — the best-practice way to call each piece and the gotchas a signature cannot show. Reading a file in the installed package does not remove the need to load the skill for that step, so at each step below, load the companion and confirm names against the installed package.

SDK identity

Verified against package.json and sdk-map.md of the generated package at version 2020-09-14_1.708.0. Re-verify after a version bump — this page is a snapshot, not a live read.

The table above is orientation, not a copy-paste recipe — it gives you the names and facts (install, import specifier, the auth pattern, the base-URL knob), while the actual integration code comes from the companion skills. Load each one as you reach its step (see Integration workflow below) and confirm its types against the installed package.

Install

This SDK is not published to npm, so the install comes straight from the repository the plugin records for it:

npm install git+https://github.com/context-plugins/plaid-typescript-sdk#main

That fetches everything the package's files list packs — src/, sdk-map.md and the pages under map/operations/ — so every lookup on this page works as soon as the install finishes. Make sure the installed package is built, as the source on GitHub is not pre-built.

Do not vendor its src/ into your project, point tsconfig paths at a throwaway clone, or import from dist/ directly. Installing the package properly is what makes the exports map, the shipped .d.ts chain and the dual-dialect resolution behave the way the SDK expects — and it is what puts the SDK map inside node_modules, which is where every lookup below reads it from. Requires Node >=20 (engines.node).

Imports — one entry, and only one

Every public name is re-exported from the package root — the client, ClientOptions, ServerEnvironment, 2104 model types with the schema value beside each, the error classes, and the runtime types (ApiPromise, ApiResult, RequestOptions, ErrorPayload, Declared, Schema, EnumSchema, Encoded).

import { ThePlaidApiClient, ServerEnvironment, ResponseError, ThePlaidApiError } from "the-plaid-api";
import type { ClientOptions, AamvaAnalysis } from "the-plaid-api";

Things the specifier alone will not tell you:

• Deep imports do not resolve. The exports map exposes . and ./package.json and nothing else, so the-plaid-api/models/… fails (TS2307) even though the file exists in the shipped src/. Every Source path on the SDK map is where to read a shape, never what to import.
• ⚠ The SDK exports a model type literally named Error (src/models/error.ts, schema errorSchema). Import it unaliased and it shadows the global Error for the rest of the file. Alias it: import type { Error as SdkError } from "the-plaid-api".
• From CommonJS, the typed spelling is import sdk = require("the-plaid-api"). A plain require destructure runs but yields any.
• instanceof is reliable within one dialect. A process that loads both (import in one file, require in another) gets two independent copies of every error class, and instanceof across that boundary is false — narrow on err.kind / err.payload.kind / err.name there.

Under verbatimModuleSyntax, names carrying no runtime value (ClientOptions, every model type) must be imported with import type. Under exactOptionalPropertyTypes, omit or spread an absent optional field rather than assigning undefined to it.

Environments

ClientOptions.serverEnvironment selects one environment for the whole client (src/servers.ts). ServerEnvironment is a const object with a derived union type — not a TypeScript enum — and unlike the model enums it is closed, so only its declared members are assignable.

Consequences to state on every contract sheet that touches configuration:

• Constructing the client with no options selects ServerEnvironment.Production, silently.
• An override merges with the built-in default per group-and-environment pair, key by key; a baseUrl override replaces the template verbatim, template variable values are percent-encoded into it, and templates expand per request rather than once at construction.
• Each operation is bound to one server group at generation time. A map block carries a Server bullet only when its group is not default.
• An environment value the SDK does not know throws SdkError synchronously out of the operation method at the first call — not at construction — so try/await catches it but .asApiResult() and .catch() never see it.

Auth pattern (4 schemes)

Authentication is per operation: every operation declares the requirement it enforces and the SDK sends exactly that. Each block on a map page carries an Auth bullet, none included. There is no client-global switch and no per-call override. 334 of the 335 operations require a credential and 1 is public.

const client = new ThePlaidApiClient({
  clientId: process.env.API_KEY!,
  secret: process.env.API_KEY!,
  plaidVersion: process.env.API_KEY!,
  oauth2: { clientId: process.env.CLIENT_ID!, clientSecret: process.env.CLIENT_SECRET! },
});

Every credential field is optional at the type level and that is a trap worth flagging on every sheet. Omit one and nothing fails at construction — the request simply goes out without that credential and the server decides. Most APIs then answer 401; one that serves anonymous traffic answers 200 and hides the omission entirely. So a 401 on a call you believed was authenticated is usually an unset field rather than an SDK failure; verify the field is set rather than waiting for a 401 to tell you, and check the operation's Auth bullet against what the client was actually given.

Three more behaviours the type does not show:

• A credential may be a function. Every field typed TokenProvider is re-read on every request with no caching, so a key can rotate without rebuilding the client. An empty string counts as absent; a function counts as present without being invoked.
• Composition is emitted, not configured. Where the spec puts two schemes in one requirement the SDK sends both; where it lists alternatives it sends the first configured one, in the order the Auth bullet prints them.
• A 401 invalidates, it does not retry. On a 401 (401 only, not 403) the SDK clears whatever that operation's scheme had cached, so the next call re-acquires; the current request still rejects.

OAuth 2 fetches and caches its own token. The token request goes through the same client — same timeout, same fetch — sends a form-urlencoded body, and decodes the response against a schema rather than casting it. A token is cached until shortly before it expires; a response with no expires_in is treated as never expiring (RFC 6749 §5.1); concurrent callers share one in-flight fetch. A refused token endpoint rejects with AuthError, wrapping the underlying ResponseError as cause — so a bad secret never looks like the business call failing, and AuthError is not a ResponseError.

oauth2Strategy on ClientOptions substitutes the whole token request (getToken(credentials, signal), plus tryRefreshToken(…) where the grant is refreshable); the caching, expiry buffer and single-flight behaviour still apply.

The token endpoint follows the same base URL as the operations on its group, so it always tracks the environment or the override — you never configure it separately. Its group is named in the table above, against src/servers.ts.

See typescript-authentication for the full picture.

Resources

This SDK groups nothing: every operation is a method on client itself, so there are no resource getters to reach through.

335 operations are methods on the client itself: client.accountsBalanceGet · client.accountsGet · client.applicationGet · client.assetReportAuditCopyCreate · client.assetReportAuditCopyGet · client.assetReportAuditCopyPdfGet · client.assetReportAuditCopyRemove · client.assetReportCreate · client.assetReportFilter · client.assetReportGet · client.assetReportPdfGet · client.assetReportRefresh · client.assetReportRemove · client.authGet · client.authVerify · client.bankTransferBalanceGet · client.bankTransferCancel · client.bankTransferCreate · client.bankTransferEventList · client.bankTransferEventSync · client.bankTransferGet · client.bankTransferList · client.bankTransferMigrateAccount · client.bankTransferSweepGet · client.bankTransferSweepList · client.beaconAccountRiskEvaluate · client.beaconDuplicateGet · client.beaconReportCreate · client.beaconReportGet · client.beaconReportList · client.beaconReportSyndicationGet · client.beaconReportSyndicationList · client.beaconUserAccountInsightsGet · client.beaconUserCreate · client.beaconUserGet · client.beaconUserHistoryList · client.beaconUserReview · client.beaconUserUpdate · client.betaEwaReportV1Get · client.betaPartnerCustomerV1Create · client.betaPartnerCustomerV1Enable · client.betaPartnerCustomerV1Get · client.betaPartnerCustomerV1Update · client.businessVerificationCreate · client.businessVerificationGet · client.cashflowReportGet · client.cashflowReportInsightsGet · client.cashflowReportRefresh · client.cashflowReportTransactionsGet · client.categoriesGet · client.consentEventsGet · client.consumerReportPdfGet · client.craCheckReportBaseReportGet · client.craCheckReportCashflowInsightsGet · client.craCheckReportCreate · client.craCheckReportIncomeInsightsGet · client.craCheckReportLendScoreGet · client.craCheckReportNetworkInsightsGet · client.craCheckReportPartnerInsightsGet · client.craCheckReportPdfGet · client.craCheckReportVerificationGet · client.craCheckReportVerificationPdfGet · client.craCreditProfileReportGet · client.craLoansApplicationsRegister · client.craLoansRegister · client.craLoansUnregister · client.craLoansUpdate · client.craMonitoringInsightsGet · client.craMonitoringInsightsSubscribe · client.craMonitoringInsightsUnsubscribe · client.craPartnerInsightsGet · client.craReportGet · client.createPaymentToken · client.creditAssetReportFreddieMacGet · client.creditAuditCopyTokenCreate · client.creditAuditCopyTokenUpdate · client.creditBankEmploymentGet · client.creditBankIncomeGet · client.creditBankIncomePdfGet · client.creditBankIncomeRefresh · client.creditBankIncomeWebhookUpdate · client.creditBankStatementsUploadsGet · client.creditEmploymentGet · client.creditFreddieMacReportsGet · client.creditPayrollIncomeGet · client.creditPayrollIncomeParsingConfigUpdate · client.creditPayrollIncomePrecheck · client.creditPayrollIncomeRefresh · client.creditPayrollIncomeRiskSignalsGet · client.creditRelayCreate · client.creditRelayGet · client.creditRelayPdfGet · client.creditRelayRefresh · client.creditRelayRemove · client.creditReportAuditCopyRemove · client.creditSessionsGet · client.dashboardUserGet · client.dashboardUserList · client.employersSearch · client.employmentVerificationGet · client.fdxConsentsGet · client.fdxConsentsList · client.fdxConsentsRevocationGet · client.fdxConsentsRevoke · client.fdxNotifications · client.getRecipient · client.getRecipients · client.identityDocumentsUploadsGet · client.identityGet · client.identityMatch · client.identityRefresh · client.identityVerificationAutofillCreate · client.identityVerificationCreate · client.identityVerificationGet · client.identityVerificationList · client.identityVerificationRetry · client.incomeVerificationCreate · client.incomeVerificationDocumentsDownload · client.incomeVerificationPaystubsGet · client.incomeVerificationPrecheck · client.incomeVerificationTaxformsGet · client.institutionsGet · client.institutionsGetById · client.institutionsSearch · client.investmentsAuthGet · client.investmentsHoldingsGet · client.investmentsRefresh · client.investmentsTransactionsGet · client.issuesGet · client.issuesSearch · client.issuesSubscribe · client.itemAccessTokenInvalidate · client.itemActivityList · client.itemApplicationList · client.itemApplicationScopesUpdate · client.itemApplicationUnlink · client.itemCreatePublicToken · client.itemGet · client.itemImport · client.itemProductsTerminate · client.itemPublicTokenExchange · client.itemRemove · client.itemWebhookUpdate · client.liabilitiesGet · client.linkDeliveryCreate · client.linkDeliveryGet · client.linkOauthCorrelationIdExchange · client.linkTokenCreate · client.linkTokenGet · client.networkStatusGet · client.oauthIntrospect · client.oauthRevoke · client.oauthToken · client.partnerCustomerCreate · client.partnerCustomerEnable · client.partnerCustomerGet · client.partnerCustomerOauthInstitutionsGet · client.partnerCustomerRemove · client.paymentInitiationConsentCreate · client.paymentInitiationConsentGet · client.paymentInitiationConsentPaymentExecute · client.paymentInitiationConsentRevoke · client.paymentInitiationPaymentCreate · client.paymentInitiationPaymentGet · client.paymentInitiationPaymentList · client.paymentInitiationPaymentReverse · client.paymentInitiationRecipientCreate · client.paymentInitiationRecipientGet · client.paymentInitiationRecipientList · client.paymentProfileCreate · client.paymentProfileGet · client.paymentProfileRemove · client.processorAccountGet · client.processorApexProcessorTokenCreate · client.processorAuthGet · client.processorBalanceGet · client.processorBankTransferCreate · client.processorIdentityGet · client.processorIdentityMatch · client.processorInvestmentsAuthGet · client.processorInvestmentsHoldingsGet · client.processorInvestmentsTransactionsGet · client.processorLiabilitiesGet · client.processorSignalDecisionReport · client.processorSignalEvaluate · client.processorSignalPrepare · client.processorSignalReturnReport · client.processorStripeBankAccountTokenCreate · client.processorTokenCreate · client.processorTokenPermissionsGet · client.processorTokenPermissionsSet · client.processorTokenWebhookUpdate · client.processorTransactionsGet · client.processorTransactionsRecurringGet · client.processorTransactionsRefresh · client.processorTransactionsSync · client.profileNetworkStatusGet · client.protectCompute · client.protectEventGet · client.protectEventSend · client.protectReportCreate · client.protectUserInsightsGet · client.sandboxBankIncomeFireWebhook · client.sandboxBankTransferFireWebhook · client.sandboxBankTransferSimulate · client.sandboxCraCashflowUpdatesUpdate · client.sandboxFdxConsentSeed · client.sandboxIncomeFireWebhook · client.sandboxItemApplicationSeed · client.sandboxItemFireWebhook · client.sandboxItemResetLogin · client.sandboxItemSetVerificationStatus · client.sandboxOauthSelectAccounts · client.sandboxPaymentProfileResetLogin · client.sandboxPaymentSimulate · client.sandboxProcessorTokenCreate · client.sandboxPublicTokenCreate · client.sandboxTransactionsCreate · client.sandboxTransferFireWebhook · client.sandboxTransferLedgerDepositSimulate · client.sandboxTransferLedgerSimulateAvailable · client.sandboxTransferLedgerWithdrawSimulate · client.sandboxTransferRefundSimulate · client.sandboxTransferRepaymentSimulate · client.sandboxTransferSimulate · client.sandboxTransferSweepSimulate · client.sandboxTransferTestClockAdvance · client.sandboxTransferTestClockCreate · client.sandboxTransferTestClockGet · client.sandboxTransferTestClockList · client.sandboxUserResetLogin · client.sessionTokenCreate · client.signalDecisionReport · client.signalEvaluate · client.signalPrepare · client.signalReturnReport · client.signalSchedule · client.statementsDownload · client.statementsList · client.statementsRefresh · client.transactionsEnhance · client.transactionsEnrich · client.transactionsGet · client.transactionsRecurringGet · client.transactionsRefresh · client.transactionsRulesCreate · client.transactionsRulesList · client.transactionsRulesRemove · client.transactionsSync · client.transactionsUserInsightsGet · client.transferAuthorizationCancel · client.transferAuthorizationCreate · client.transferBalanceGet · client.transferCancel · client.transferCapabilitiesGet · client.transferConfigurationGet · client.transferCreate · client.transferDiligenceDocumentUpload · client.transferDiligenceSubmit · client.transferEventList · client.transferEventSync · client.transferGet · client.transferIntentCreate · client.transferIntentGet · client.transferLedgerDeposit · client.transferLedgerDistribute · client.transferLedgerEventList · client.transferLedgerGet · client.transferLedgerWithdraw · client.transferList · client.transferMetricsGet · client.transferMigrateAccount · client.transferOriginatorCreate · client.transferOriginatorFundingAccountCreate · client.transferOriginatorFundingAccountUpdate · client.transferOriginatorGet · client.transferOriginatorList · client.transferPlatformOriginatorCreate · client.transferPlatformPersonCreate · client.transferPlatformRequirementSubmit · client.transferQuestionnaireCreate · client.transferRecurringCancel · client.transferRecurringCreate · client.transferRecurringGet · client.transferRecurringList · client.transferRefundCancel · client.transferRefundCreate · client.transferRefundGet · client.transferRepaymentList · client.transferRepaymentReturnList · client.transferReturnRecover · client.transferSweepGet · client.transferSweepList · client.userAccountSessionEventSend · client.userAccountSessionGet · client.userCreate · client.userFinancialDataRefresh · client.userGet · client.userIdentityRemove · client.userItemsAssociate · client.userItemsGet · client.userItemsRemove · client.userProductsTerminate · client.userRemove · client.userThirdPartyTokenCreate · client.userThirdPartyTokenRemove · client.userTransactionsRefresh · client.userUpdate · client.walletCreate · client.walletGet · client.walletList · client.walletTransactionExecute · client.walletTransactionGet · client.walletTransactionList · client.watchlistScreeningEntityCreate · client.watchlistScreeningEntityGet · client.watchlistScreeningEntityHistoryList · client.watchlistScreeningEntityHitList · client.watchlistScreeningEntityList · client.watchlistScreeningEntityProgramGet · client.watchlistScreeningEntityProgramList · client.watchlistScreeningEntityReviewCreate · client.watchlistScreeningEntityReviewList · client.watchlistScreeningEntityUpdate · client.watchlistScreeningIndividualCreate · client.watchlistScreeningIndividualGet · client.watchlistScreeningIndividualHistoryList · client.watchlistScreeningIndividualHitList · client.watchlistScreeningIndividualList · client.watchlistScreeningIndividualProgramGet · client.watchlistScreeningIndividualProgramList · client.watchlistScreeningIndividualReviewCreate · client.watchlistScreeningIndividualReviewList · client.watchlistScreeningIndividualUpdate · client.webhookVerificationKeyGet.

Every operation has the same call shape — op(request, options?), one flat, channel-blind request object first and RequestOptions ({ signal }) second — and returns ApiPromise<T, E>.

⚠ The request type name is not uniformly <Operation>Request. 317 operations take <Operation>RequestParams instead: accountsBalanceGet, accountsGet, applicationGet, assetReportAuditCopyCreate, assetReportAuditCopyGet, assetReportAuditCopyPdfGet, assetReportAuditCopyRemove, assetReportCreate, assetReportFilter, assetReportGet, assetReportPdfGet, assetReportRefresh, assetReportRemove, authGet, authVerify, bankTransferBalanceGet, bankTransferCancel, bankTransferCreate, bankTransferEventList, bankTransferEventSync, bankTransferGet, bankTransferList, bankTransferMigrateAccount, bankTransferSweepGet, bankTransferSweepList, beaconAccountRiskEvaluate, beaconDuplicateGet, beaconReportCreate, beaconReportGet, beaconReportList, beaconReportSyndicationGet, beaconReportSyndicationList, beaconUserAccountInsightsGet, beaconUserCreate, beaconUserGet, beaconUserHistoryList, beaconUserReview, beaconUserUpdate, betaEwaReportV1Get, betaPartnerCustomerV1Create, betaPartnerCustomerV1Enable, betaPartnerCustomerV1Get, betaPartnerCustomerV1Update, businessVerificationCreate, businessVerificationGet, cashflowReportGet, cashflowReportInsightsGet, cashflowReportRefresh, cashflowReportTransactionsGet, consentEventsGet, consumerReportPdfGet, craCheckReportBaseReportGet, craCheckReportCashflowInsightsGet, craCheckReportCreate, craCheckReportIncomeInsightsGet, craCheckReportLendScoreGet, craCheckReportNetworkInsightsGet, craCheckReportPartnerInsightsGet, craCheckReportPdfGet, craCheckReportVerificationGet, craCheckReportVerificationPdfGet, craCreditProfileReportGet, craLoansApplicationsRegister, craLoansRegister, craLoansUnregister, craLoansUpdate, craMonitoringInsightsGet, craMonitoringInsightsSubscribe, craMonitoringInsightsUnsubscribe, craPartnerInsightsGet, craReportGet, creditAuditCopyTokenCreate, creditAuditCopyTokenUpdate, creditBankEmploymentGet, creditBankIncomeGet, creditBankIncomePdfGet, creditBankIncomeRefresh, creditBankIncomeWebhookUpdate, creditBankStatementsUploadsGet, creditEmploymentGet, creditFreddieMacReportsGet, creditPayrollIncomeGet, creditPayrollIncomeParsingConfigUpdate, creditPayrollIncomePrecheck, creditPayrollIncomeRefresh, creditPayrollIncomeRiskSignalsGet, creditRelayCreate, creditRelayGet, creditRelayPdfGet, creditRelayRefresh, creditRelayRemove, creditSessionsGet, dashboardUserGet, dashboardUserList, employersSearch, employmentVerificationGet, identityDocumentsUploadsGet, identityGet, identityMatch, identityRefresh, identityVerificationAutofillCreate, identityVerificationCreate, identityVerificationGet, identityVerificationList, identityVerificationRetry, incomeVerificationCreate, incomeVerificationDocumentsDownload, incomeVerificationPaystubsGet, incomeVerificationPrecheck, incomeVerificationTaxformsGet, institutionsGet, institutionsGetById, institutionsSearch, investmentsAuthGet, investmentsHoldingsGet, investmentsRefresh, investmentsTransactionsGet, issuesGet, issuesSearch, issuesSubscribe, itemAccessTokenInvalidate, itemActivityList, itemApplicationList, itemApplicationScopesUpdate, itemApplicationUnlink, itemGet, itemImport, itemProductsTerminate, itemPublicTokenExchange, itemRemove, itemWebhookUpdate, liabilitiesGet, linkDeliveryCreate, linkDeliveryGet, linkTokenCreate, linkTokenGet, networkStatusGet, partnerCustomerCreate, partnerCustomerEnable, partnerCustomerGet, partnerCustomerRemove, paymentInitiationConsentCreate, paymentInitiationConsentGet, paymentInitiationConsentPaymentExecute, paymentInitiationConsentRevoke, paymentInitiationPaymentCreate, paymentInitiationPaymentGet, paymentInitiationPaymentList, paymentInitiationPaymentReverse, paymentInitiationRecipientCreate, paymentInitiationRecipientGet, paymentInitiationRecipientList, paymentProfileCreate, paymentProfileGet, paymentProfileRemove, processorAccountGet, processorApexProcessorTokenCreate, processorAuthGet, processorBalanceGet, processorBankTransferCreate, processorIdentityGet, processorIdentityMatch, processorInvestmentsAuthGet, processorInvestmentsHoldingsGet, processorInvestmentsTransactionsGet, processorLiabilitiesGet, processorSignalDecisionReport, processorSignalEvaluate, processorSignalPrepare, processorSignalReturnReport, processorStripeBankAccountTokenCreate, processorTokenCreate, processorTokenPermissionsGet, processorTokenPermissionsSet, processorTokenWebhookUpdate, processorTransactionsGet, processorTransactionsRecurringGet, processorTransactionsRefresh, processorTransactionsSync, profileNetworkStatusGet, protectCompute, protectEventGet, protectEventSend, protectReportCreate, protectUserInsightsGet, sandboxBankIncomeFireWebhook, sandboxBankTransferFireWebhook, sandboxBankTransferSimulate, sandboxCraCashflowUpdatesUpdate, sandboxFdxConsentSeed, sandboxIncomeFireWebhook, sandboxItemApplicationSeed, sandboxItemFireWebhook, sandboxItemResetLogin, sandboxItemSetVerificationStatus, sandboxOauthSelectAccounts, sandboxPaymentProfileResetLogin, sandboxPaymentSimulate, sandboxProcessorTokenCreate, sandboxPublicTokenCreate, sandboxTransactionsCreate, sandboxTransferFireWebhook, sandboxTransferLedgerDepositSimulate, sandboxTransferLedgerSimulateAvailable, sandboxTransferLedgerWithdrawSimulate, sandboxTransferRefundSimulate, sandboxTransferRepaymentSimulate, sandboxTransferSimulate, sandboxTransferSweepSimulate, sandboxTransferTestClockAdvance, sandboxTransferTestClockCreate, sandboxTransferTestClockGet, sandboxTransferTestClockList, sandboxUserResetLogin, sessionTokenCreate, signalDecisionReport, signalEvaluate, signalPrepare, signalReturnReport, signalSchedule, statementsDownload, statementsList, statementsRefresh, transactionsEnrich, transactionsGet, transactionsRecurringGet, transactionsRefresh, transactionsRulesCreate, transactionsRulesList, transactionsRulesRemove, transactionsSync, transactionsUserInsightsGet, transferAuthorizationCancel, transferAuthorizationCreate, transferBalanceGet, transferCancel, transferCapabilitiesGet, transferConfigurationGet, transferCreate, transferDiligenceDocumentUpload, transferDiligenceSubmit, transferEventList, transferEventSync, transferGet, transferIntentCreate, transferIntentGet, transferLedgerDeposit, transferLedgerDistribute, transferLedgerEventList, transferLedgerGet, transferLedgerWithdraw, transferList, transferMetricsGet, transferMigrateAccount, transferOriginatorCreate, transferOriginatorFundingAccountCreate, transferOriginatorFundingAccountUpdate, transferOriginatorGet, transferOriginatorList, transferPlatformOriginatorCreate, transferPlatformPersonCreate, transferPlatformRequirementSubmit, transferQuestionnaireCreate, transferRecurringCancel, transferRecurringCreate, transferRecurringGet, transferRecurringList, transferRefundCancel, transferRefundCreate, transferRefundGet, transferRepaymentList, transferRepaymentReturnList, transferReturnRecover, transferSweepGet, transferSweepList, userAccountSessionEventSend, userAccountSessionGet, userCreate, userFinancialDataRefresh, userGet, userIdentityRemove, userItemsAssociate, userItemsGet, userItemsRemove, userProductsTerminate, userRemove, userThirdPartyTokenCreate, userThirdPartyTokenRemove, userTransactionsRefresh, userUpdate, walletCreate, walletGet, walletList, walletTransactionExecute, walletTransactionGet, walletTransactionList, watchlistScreeningEntityCreate, watchlistScreeningEntityGet, watchlistScreeningEntityHistoryList, watchlistScreeningEntityHitList, watchlistScreeningEntityList, watchlistScreeningEntityProgramGet, watchlistScreeningEntityProgramList, watchlistScreeningEntityReviewCreate, watchlistScreeningEntityReviewList, watchlistScreeningEntityUpdate, watchlistScreeningIndividualCreate, watchlistScreeningIndividualGet, watchlistScreeningIndividualHistoryList, watchlistScreeningIndividualHitList, watchlistScreeningIndividualList, watchlistScreeningIndividualProgramGet, watchlistScreeningIndividualProgramList, watchlistScreeningIndividualReviewCreate, watchlistScreeningIndividualReviewList, watchlistScreeningIndividualUpdate, webhookVerificationKeyGet. Take the name from the operation's Signature bullet on its map page; never construct it from the method name.

SDK map — look up first, open the file second

The SDK ships a generated map, and package.json's files list includes it, so installing the package gives you the map — no clone is needed. It sits at the package root, the directory holding package.json and the src/ tree:

• sdk-map.md — the index: client construction with the full ClientOptions table, the Not on this SDK table, the two error families with ApiResult and .asApiResult(), wire serialization for every channel, the full enum table with every member and its wire value, servers and auth, runtime and packaging, and the link table into the operations pages.
• map/operations/<resource>.md — one page per resource, one ### block per operation, with bullets in the fixed order Server, Signature, Wire (verb and route), Auth, Request body, SDK-sent, Returns, Error, Error arms — then a Fields table giving every request field its channel, wire name, type, required flag and default, and a Type sources table naming the declaring file and schema value of every type the operation mentions.

Locate the installed package before you rely on a lookup:

node -e "console.log(require.resolve('the-plaid-api/package.json'))"

Failing that it is at node_modules/the-plaid-api/. If the package is not installed, there is no map and no source to read — mark the fact UNVERIFIED and say what would settle it rather than answering from memory.

Every Source path on the map is relative to that package root, so src/models/<file>.ts opens as written from there — the package ships its src/ tree, so the path resolves inside node_modules/the-plaid-api/ exactly as the map writes it. An import specifier ending .js inside that source is the NodeNext spelling of the sibling .ts file.

The map is the locator; the source files are the shapes. Read the map first — signatures, routes, request fields with their channels and defaults, return types, error arms, enum values, and which file declares a type are all answered there without opening a single .ts file. Then open the one file the map names for what it deliberately does not carry: a model's members, whether each is required, optional or nullable. The map says so itself — "Shapes live only in the source … Do not derive the path from the type name."

sdk-map.md carries the invariants every operation block assumes, so read it before any map/operations/ page; the pages are written to be read beside it. And silence means the default: the index states what holds for every operation — the call shape, the flat channel-blind request object, the ApiPromise<T, E> return, the default server group, no pagination and no streaming — and a block departs from one only by saying so. Take the default and move on rather than opening the source to confirm it.

The map carries shapes; what an operation means lives elsewhere. When what to pass depends on meaning — which values a field accepts beyond its type, a rule that couples two fields, what a defaulted header actually selects — the map will not settle it. Read that operation's entry in api-reference.md at the package root, keyed by the same signature, before writing the sheet row, and record what you found. A value you already "know" for a field the map types as a plain string is a lookup, not a recall — the memory ban applies to it.

Contract facts — the map first, then the source file

Seven of these are map lookups — don't open a source file for them: an operation's signature; its request fields with channel, wire name, required flag and default; its return type; its error subclass and the arms with the status each covers; the ClientOptions fields and their defaults; the environments, base URLs and auth wiring; and every enum's members with their wire values, which sdk-map.md tabulates in full.

The table below covers everything else, and the full body behind a map row. Paths are relative to node_modules/the-plaid-api/:

Read scoped. Search for the one symbol and read the lines around it rather than whole files, and never copy a design comment's rationale onto a contract sheet — the sheet carries facts an implementer must obey, not the reasoning behind them.

Keep lookups cheap — the rules that keep a session's context small:

• Collect the contracts for every in-scope operation in one pass — signature, request fields with channels and defaults, required members, the error arms, enum values — into a short contract sheet in your plan, then implement from the sheet. Don't re-open a map page per field, and never re-look-up a fact the sheet already carries.
• Recurse into a model's members only where the task actually sets them — a full transitive expansion is hundreds of rows nobody needs.
• Never grep, glob or find the package to locate a type — the map is the locator, and it says so. Grep only inside the file its Type sources table names, for the symbol. A sweep for a cross-cutting shape is a different question and is fine: "every field typed unknown", "every required-nullable member" are things nothing indexes, and one targeted grep -rn over src/models/ is the right tool — record what it found on the sheet.
• Trust the compiler over this page: if a name here ever fails to type-check, re-read the file the table above names and report the drift; never patch around it from memory.

Integration workflow — load the companion skill at each step

Before you write the code for each step, load the named companion skill — even if you have already read the relevant file. Each step calls out the trap the signature hides (in parens). A typical integration reaches them in this order:

1. Client construction & lifetime — load typescript-client-initialization before you write new ThePlaidApiClient(…). (The signature won't tell you: every option is optional, so a client built with no arguments compiles and talks to the default environment with no credential; the client must be long-lived and app-scoped, never rebuilt per request, because the OAuth 2 token cache lives on it; there is no close() or dispose() — it owns no pool, only a fetch; and when no fetch is reachable the constructor throws SdkError, not the first call.)
2. Authentication — load typescript-authentication before you set credentials. The 4 schemes are clientId, secret, plaidVersion, oauth2 on ClientOptions. (The signature won't tell you: the field is optional — omit it and every request goes out unauthenticated with no failure at construction; the token is fetched lazily and cached on the client; a failed token fetch raises AuthError, which is not a ResponseError and bypasses .asApiResult() entirely; and a 401 invalidates the cache without retrying the current call. Load secrets from the environment or a secret store, never hardcode.)
3. Calling an endpoint — load typescript-calling-endpoints before the first client.<resource>.<operation>(…) call. (The signature won't tell you: the request object is flat and channel-blind — a field named body is the whole request body and every other field is fanned out to path, query or header by the SDK, so nothing is nested by channel; an omitted field that has a default is still sent, with that default; 11 operations resolve to undefined; and .asApiResult() must be called on the value the operation returned, because ApiPromise overrides Symbol.species and .then()/.catch() hand back a plain Promise with the method gone.)
4. Models — load typescript-models the moment a request/response member is not a plain string or number. (The signature won't tell you: models are plain types built from object literals — no constructor, no builder; f?: T means omit the key, while f: T | null is required and nullable and null is a distinct value; enums are open (const companion plus a union admitting (string & {})), so the schema validates the base type only and an unknown server value round-trips instead of throwing — use .values to test membership yourself; and every type has a schema companion usable in both directions.)
5. Error handling — load typescript-error-handling before you write any try/catch. (The signature won't tell you: there are two disjoint families — ResponseError and its per-operation subclasses for an API error status, and the ThePlaidApiError set (ConnectionError, TimeoutError, AbortError, SdkError, SchemaError, AuthError) for no usable response — and neither is instanceof the other, so a complete catch needs both arms; arm tags are schema-derived, not statuses (see the sheet checklist below); a malformed 2xx body rejects with SchemaError, not ResponseError, and .asApiResult() does not convert it; and a missing response field the schema permits is silently undefined rather than any error at all.)
6. Configuration & resilience — load typescript-configuration-resilience when you set the base URL, timeouts, proxies, TLS, or logging. (The signature won't tell you: the SDK performs no retries at all — a failed call rejects once, so retry/backoff is entirely yours to build or deliberately omit; there is no logging and there are no hooks, middleware or interceptors — ClientOptions.fetch is the single extension point for all of it; timeout is client-wide with no per-request timeout, and a non-finite or non-positive value is not "no timeout" but a fallback to the transport's own ceiling; and a fetch replacement that drops init.signal makes both the timeout and every RequestOptions.signal inert.)
7. Testing — load typescript-testing before you stub the SDK. (The signature won't tell you: the seam is ClientOptions.fetch, not the client class and not the resource classes — whose constructors take unexported engine internals, so they cannot be instantiated in a test; stub bodies in wire shape and let the SDK decode them; assert on the request the SDK actually built, headers included; and cover the failure kinds a ResponseError-only test misses, SchemaError above all.)

What a contract sheet must carry for this SDK

Beyond the usual signatures and model members, a contract sheet for the The Plaid API TypeScript SDK is incomplete without these, because each one is a decision the implementer cannot make correctly from the signature alone.

1. Which host each deployment talks to, and where that is set. The members are ServerEnvironment.Production, ServerEnvironment.Environment2, defaulting to ServerEnvironment.Production when the field is unset.
2. 11 operations resolve to undefined — await gives you nothing to inspect, so .asApiResult() is the only way to observe their status and headers — decide the mode at write time, not by retrofit.
3. The exact request type name per operation, taken from the Signature bullet — 317 operations take <Operation>RequestParams, not <Operation>Request.
4. Every request field with its channel, wire name and default, because the request object is flat and channel-blind and the SDK fans fields out. An omitted field that has a default is still sent with that default, so a defaulted header shapes the response whether or not the sheet mentions it. Any caller-supplied idempotency or request-id field is the ONLY idempotency this SDK has: it injects none and RequestOptions is { signal } only.
5. Required vs optional vs required-nullable for every model member the task sets — f: T required, f?: T omit the key, f: T | null required and nullable. And that under exactOptionalPropertyTypes an absent optional is omitted or spread, never assigned undefined.
6. The error arms for each operation in scope, with the status each covers — and the warning that arm tags are schema-derived, not status codes. Every operation rejects with its own ResponseError subclass narrowed on err.payload.kind, and a tag comes from the arm's body schema: an arm whose body is a direct model reference is named after that model in lower camel ("apiError"), and every other body — a primitive, an array, a map, or no content — is named "error{Status}" ("error400", "error4XX", "errorDefault"), with a numeric suffix on the second of two arms that would otherwise land on the same name. The same tag means different statuses on different operations, and the same status carries different tags — so a tag is only meaningful beside the arm table it came from, and a shared helper that switches on kind across operations is a bug. 289 of 335 operations declare typed error bodies; the rest reject with the base ResponseError. Every operation also carries an always-present "undeclared" arm holding rawBody: ArrayBuffer, for which matcher precedence matters: an exact numeric status is looked up across the whole table first, and only then does the first covering wildcard or range win.
7. That a malformed or drifted 2xx body rejects with SchemaError, not ResponseError, in both response modes — .asApiResult() converts an HTTP error status, never a Family B failure. Any sheet row for a call whose result is used must name the members the implementer has to assert on, because a thin or truncated body decodes without complaint and the hole surfaces later.
8. That the SDK performs no retries, no logging, no pagination and no streaming at all, and that ClientOptions.fetch is the one seam where any of it can be added — so whatever the task needs there is yours to build or deliberately omit. Say which.
9. That Error imported from this package is a model type, not the global of that name — every sheet that references one should carry the alias it will be imported under. The error base is re-exported as ThePlaidApiError for the same reason.
10. A REQUIRED READING block naming the typescript-* companions that govern the steps, with inline MUST load pointers.