Skip to main content

​
Prerequisites

  • Node.js and npm.
  • An API key in your shell environment.
The preferred command is secapi. omni-sec remains a compatibility alias.

​
Check local configuration

config show is local-only and reports the configured origin and credential source names without printing secrets. doctor can call the API to check setup and account context; use it when authentication is uncertain.

​
Run one source-backed command

Expect JSON containing a current filing identity. Preserve accessionNumber, filingDate, filingUrl, and requestId if you use the result in a script or report. The filing identity is live and changes when a newer annual filing becomes available. To inspect a command before making a request:

​
Handle failures

  • A missing or invalid key returns an authentication failure. Check the environment variable rather than passing a secret as a command argument.
  • For 429, wait for the documented retry interval before retrying a read.
  • For a persistent failure, rerun with --request-summary and retain the request ID, status, endpoint, and timestamp. The command response remains on stdout; the summary is written to stderr.

​
Production notes

  • In CI, inject keys through the runner’s secret mechanism. Never write them into profiles, command history, or command output.
  • Use --dry-run only on supported mutating commands to inspect a request shape; it does not test account permission or delivery behavior.
  • Profiles store environment-variable names, not secret values. Use a separate profile and base URL only for an environment you control.
  • Parse JSON as a contract that can gain optional fields; pin any application assumptions to the relevant API reference.
Next: API conventions, request diagnostics, or JavaScript SDK.