What's in every SDK

Soxom doesn’t just turn your OpenAPI spec into types — it generates SDKs with the runtime ergonomics your customers expect from a hand-written client. Every generated SDK, in every language, ships the same baseline feature set.

These aren’t aspirational checkboxes. Each capability is exercised at runtime by our cross-language conformance suite: the same scenarios run against a generated SDK in each language, calling the real public API and asserting the real result. If a feature can’t perform, the build fails — it doesn’t ship.

The baseline — every language

Capability	Python	TypeScript	Go	Java	Ruby	C#
Fully typed models, params & responses	✅	✅	✅	✅	✅	✅
Cursor pagination (transparent auto-iteration)	✅	✅	✅	✅	✅	✅
Offset pagination	✅	✅	✅	✅	✅	✅
Automatic retries (exponential backoff + jitter, Retry-After)	✅	✅	✅	✅	✅	✅
Bearer / API key (header·query·cookie) / Basic auth	✅	✅	✅	✅	✅	✅
OAuth2 client-credentials (lazy fetch + auto-refresh)	✅	✅	✅	✅	✅	✅
AND / OR / optional / no-auth scheme combinations	✅	✅	✅	✅	✅	✅
Multipart / form-urlencoded file uploads	✅	✅	✅	✅	✅	✅
Octet-stream bodies & binary downloads	✅	✅	✅	✅	✅	✅
Server-Sent Events (SSE) streaming	✅	✅	✅	✅	✅	✅
Typed, status-specific error exceptions	✅	✅	✅	✅	✅	✅
Typed webhook receivers (3.1 webhooks)	✅	✅	✅	✅	✅	✅
Configurable timeouts & per-request overrides	✅	✅	✅	✅	✅	✅

Tip

The full keyword-level OpenAPI 3.0 / 3.1 support matrix (every JSON Schema 2020-12 keyword, parameter style, and content type, per generator) lives in the OpenAPI compatibility reference.

What each capability means

Type-safe & idiomatic

Models, method parameters, and responses are fully typed, so editor autocomplete and the compiler catch mistakes before runtime. Each generator emits code that reads like it was written by hand for that language — Pydantic models in Python, structs that pass gofmt/goimports in Go, Java records, TypeScript interfaces via the Compiler API, idiomatic Ruby with YARD docs, and C# records with System.Text.Json.

Auto-pagination

List endpoints return a page object that is also iterable. The simplest consumer loops once and the SDK fetches every page transparently; hold the page object when you want manual control over cursors and limits. Both cursor-based and offset-based schemes are supported — see Pagination.

Automatic retries

Connection errors, request timeouts, and retryable status codes (408, 409, 429, 5xx) are retried with exponential backoff and full jitter, capped, and honoring a parseable Retry-After header. Retries of unsafe methods are gated on an idempotency key so they’re safe by default. Configure the budget per-client or per-request — see Retries.

Authentication

Bearer tokens, API keys (header, query, or cookie), HTTP basic, OAuth2 (client-credentials with lazy token fetch, in-memory caching, refresh coalescing, and 401-triggered refresh), OpenID Connect discovery, and mutual TLS are all handled by the runtime. Multiple schemes compose with AND/OR semantics, and per-operation security overrides are respected. See Authentication.

Streaming

Operations marked streaming return a typed, lazily-parsed async stream of Server-Sent Events that you can iterate and cancel via a native signal. The TypeScript runtime additionally supports NDJSON / JSON-lines streams and raw byte streams. See Streaming.

Typed errors

Non-2xx responses raise a status-specific exception (NotFoundError, AuthenticationError, RateLimitError, …) that descends from a single SDK base error. Each carries the parsed error body, response headers, and the request ID, so you can catch precisely the condition you care about.

File uploads & downloads

multipart/form-data and application/x-www-form-urlencoded request bodies, application/octet-stream payloads, and binary response downloads work out of the box. Per-part encoding declared in your spec is honored.

Typed webhook receivers

Declare top-level webhooks in an OpenAPI 3.1 spec and Soxom emits a typed payload plus a framework-agnostic receiver per webhook, including a multi-event mux that dispatches on a discriminator. Receivers gate on content-type and method; signature verification is left to you. (Operation-level callbacks get the same treatment in Go and TypeScript.)

Timeouts & cancellation

Set a default timeout on the client and override it per request, alongside per-call headers, query params, retry budgets, and a user-supplied cancellation signal. See Timeouts.

Beyond the baseline

A few capabilities are richer in some languages than others:

• OpenID Connect & mutual TLS are wired natively in Python, TypeScript, Go, and Java. Ruby surfaces mTLS as a configurable SSL context and C# applies it via default headers.
• Advanced OAuth2 flows (authorization-code, implicit, password) ship in Go, Java, TypeScript, and Ruby in addition to the universally-supported client-credentials flow.
• NDJSON and raw byte streams are available in the TypeScript runtime today; other languages support SSE.
• Typed response headers are emitted by Python, TypeScript, Go, Java, and Ruby.

The per-keyword detail for all of the above — and the handful of JSON Schema keywords that degrade rather than fully model — is in the OpenAPI compatibility matrix.

On top of the generated runtime

Beyond the SDK runtime, Soxom preserves your hand-written extensions across regenerations (Custom Code), manages versioning and changelogs through a two-environment release flow, and publishes to your registries from your own GitHub repos. See How Soxom works.