Sure API

Use this skill when the user asks to:

• - operate Sure through its API
• inspect accounts, transactions, categories, tags, merchants, imports, holdings, trades, valuations, or chats
• create/update/delete supported Sure resources safely
• verify whether the upstream Sure API changed
• keep this skill in sync with the official Sure API docs

Official source-of-truth URLs

These are the URLs the agent should trust first when updating or validating this skill:

• - Sure repo: INLINECODE0
• API docs directory: INLINECODE1
• OpenAPI spec page: INLINECODE2
• Raw OpenAPI download used by the update script: INLINECODE3

If behavior and local scripts disagree, re-check the upstream OpenAPI first.

Local config

Read secrets from secure env only:

• - INLINECODE4
• INLINECODE5

Single source of truth: INLINECODE6

Never paste the API key into chat or into non-secure files.

Auth

Default auth header:

• - INLINECODE7

Note: the current upstream OpenAPI snapshot also shows Authorization header notes on some valuation endpoints. Treat upstream OpenAPI as authoritative if those endpoints behave differently in practice.

Skill layout

CODEBLOCK0

Capability model

This skill has two layers:

Layer 1: high-level wrapped commands

Implemented in scripts/sure_api_cli.js:

• - INLINECODE10
• INLINECODE11
• INLINECODE12
• INLINECODE13
• INLINECODE14
• INLINECODE15
• INLINECODE16
• INLINECODE17
• INLINECODE18
• INLINECODE19
• INLINECODE20
• INLINECODE21
• INLINECODE22
• INLINECODE23
• INLINECODE24

Layer 2: raw official endpoint access

• - INLINECODE25

This means the skill can still operate against official endpoints such as:

• - merchant detail
• holding detail
• import detail / create import
• trade create / retrieve / update / delete
• valuation create / retrieve / update
• chats list / create / retrieve / update / delete / send message / retry
• other official endpoints present in INLINECODE26

Quick start

Smoke test

CODEBLOCK1

Common wrapped commands

CODEBLOCK2

Safe write pattern

Always prefer:

1. 1. read current state
2. dry-run if the wrapped command supports it
3. send the real write only with explicit confirmation flags

Example:

CODEBLOCK3

Raw endpoint examples for official API coverage

Retrieve a merchant by id

CODEBLOCK4

Retrieve a holding by id

CODEBLOCK5

Retrieve an import by id

CODEBLOCK6

Create an import from raw CSV content

CODEBLOCK7

Create a trade

CODEBLOCK8

Create a valuation

CODEBLOCK9

Create a chat and send a message

CODEBLOCK10

Pagination and filtering

Most list endpoints return a resource list plus a pagination block.
Typical filters in the official API include:

• - INLINECODE27
• INLINECODE28
• account/category/merchant/tag ids
• date or date ranges
• type/status filters on some resources

For exact parameters, read references/openapi.yaml.

Error handling

• - 401 / 403 → auth missing, invalid, or insufficient feature scope
• INLINECODE32 → wrong path or object not found
• INLINECODE33 → validation error; inspect request body against INLINECODE34
• INLINECODE35 / 5xx → retry with backoff up to 3 times if the action is idempotent

Self-update this skill

This skill is designed to be self-maintainable.

Fast refresh from official API

CODEBLOCK11

What it does:

1. 1. downloads the latest official OpenAPI from the Sure GitHub repo
2. overwrites INLINECODE37
3. regenerates INLINECODE38

After updating OpenAPI

Do this in order:

1. 1. re-read INLINECODE39
2. compare new endpoints/params with current INLINECODE40
3. extend high-level wrappers only for endpoints that are common, stable, and worth scripting
4. keep less-common endpoints accessible via INLINECODE41
5. run acceptance checks

When to read references

Read references/openapi.yaml when you need:

• - exact request bodies
• exact response shapes
• enum values
• parameter names
• authoritative behavior after upstream changes

Read references/api_endpoints_summary.md when you need:

• - a fast endpoint inventory
• a quick check of what the upstream API currently exposes

ClawHub publish readiness

Before publishing or bumping a version, run:

CODEBLOCK12

Optional live API validation:

CODEBLOCK13

The acceptance script checks:

• - required files exist
• INLINECODE44 frontmatter is valid enough for publishing
• official URLs are present
• self-update instructions are present
• endpoint summary matches the checked-in OpenAPI
• optional live smoke test passes

ClawHub publish commands

First confirm login:

CODEBLOCK14

Initial publish example:

CODEBLOCK15

Update publish example:

CODEBLOCK16

Notes for future maintenance

• - Keep SKILL.md concise; put exact API detail in references/.
• Do not add README / CHANGELOG / extra docs just for packaging.
• Only wrap high-value flows in sure_api_cli.js; leave long-tail official endpoints to the raw request wrapper.
• If upstream removes or renames endpoints, update examples and acceptance checks in the same commit.