postq-sdk

Official PostQ SDK for Python. Submit quantum-risk scans and read results from the PostQ API.

pip install postq-sdk

Quickstart

from postq import PostQ, Finding

pq = PostQ(api_key="pq_live_…")  # or set POSTQ_API_KEY env var

# Submit a scan
result = pq.scans.submit(
    type="url",
    target="example.com",
    risk_score=85,
    risk_level="High",
    findings=[
        Finding(severity="high", title="RSA-2048 public key"),
    ],
)
print(result.url)  # https://app.postq.dev/scans/...

# List recent scans
for scan in pq.scans.list(limit=10):
    print(scan.target, scan.risk_level)

# Iterate every scan with automatic pagination
for scan in pq.scans.iter_all():
    ...

# Fetch a full scan record (HNDL, certificate, TLS, normalized findings)
detail = pq.scans.get(result.id)
print(detail.hndl.severity if detail.hndl else None,
      detail.certificate.days_until_expiry if detail.certificate else None)

# Download the CycloneDX 1.6 CBOM for a scan
cbom = pq.scans.cbom(result.id)  # parsed dict

# Or ask the API to perform and persist a real scan
tls = pq.scans.run_url(target="example.com")
aws = pq.scans.run_cloud(
    provider="aws",
    target="123456789012",
    aws={"regions": ["us-east-1"]},
)

Assets and keys (0.3.0+)

# Browse your cryptographic inventory
assets = pq.assets.list(provider="aws", risk="HIGH", limit=50)
for a in assets.data:
    print(a.name, a.algorithm, a.risk)

# Or stream every asset
for a in pq.assets.iter_all(environment="production"):
    ...

# Browse keys discovered by cloud scans
keys = pq.keys.list(algorithm="RSA", risk="High")
for k in keys.data:
    print(k.provider, k.region, k.external_id, k.algorithm)

Hybrid signing and multicloud Vault

pq.vault.put_settings(
    default_kek_provider="gcp-kms",
    gcp={
        "kekKeyName": "projects/acme/locations/global/keyRings/postq/cryptoKeys/vault-kek",
        "keyRingName": "projects/acme/locations/us-east1/keyRings/postq-signing",
        "protectionLevel": "HSM",
    },
)
key = pq.hybrid_keys.create(
    name="release-signing",
    algorithm="mldsa65+ecdsa-p256",
    kek_provider="gcp-kms",
    key_provider="gcp-kms",
)
signature = pq.sign(key_id=key.id, payload="release manifest")
assert pq.verify(
    public_key=key.public_key,
    payload="release manifest",
    signature=signature.signature,
).ok

Configuration

POST operations are never automatically replayed because they can create keys, signatures, scans, policies, or Ledger entries.

Errors

All exceptions extend PostQError:

from postq import PostQ, PostQAuthError, PostQRateLimitError

try:
    pq.scans.list()
except PostQAuthError:
    print("bad API key")
except PostQRateLimitError:
    print("slow down")

Requirements

• Python 3.9+
• Single dependency: requests

License

MIT — see LICENSE.