Saner SDK for Python

Official Python SDK for the SecPod Saner CVEM platform — continuous vulnerability and exposure management, patching, compliance, and endpoint management.

📖 Full API reference: apidocs-cvem.readme.io

This README is a quickstart. Every endpoint, parameter, and response shape is documented on the developer portal.

Installation

pip install secpod-saner-sdk

Requires Python 3.9+. The only runtime dependency is requests.

Quickstart

from saner import SanerClient

client = SanerClient(
    api_key="<YOUR_API_KEY>",
    accountid="<YOUR_ACCOUNT>",
    base_url="https://saner.secpod.com",
)

orgs = client.platform.Organization.get()
print(orgs)

client.close()

The client owns pooled HTTP connections, so close it when you're done — or let a with block do it:

with SanerClient(api_key="...", accountid="...") as client:
    devices = client.cvem.Device.get(ip="192.168.1.10")

Configuration

api_key, accountid, base_url, and verify_ssl all fall back to environment variables when omitted, so SanerClient() works unmodified across dev, CI, and containers — only the environment differs. An explicit argument always wins over the environment, which keeps the multi-client pattern (several clients, several accounts, one script) isolated even when the variables are set.

# with SANER_API_KEY / SANER_ACCOUNT_ID set in the environment
client = SanerClient()

Resources

Resources are split into two products, each with its own client if you only need one of them:

SanerClient (the universal client) nests both under client.platform.* / client.cvem.* instead. Prefer it when your process touches both products — each client instance opens its own pair of pooled sessions, so creating a PlatformClient and a CvemClient side by side doubles connection overhead for no benefit over one SanerClient. Reach for PlatformClient/CvemClient only when you exclusively work within one product and want flatter attribute access.

Methods return the parsed JSON response as a dict. Endpoints that produce a file (Report.getPdf, AD.downloadAgent) return bytes instead:

with SanerClient(api_key="...", accountid="...") as client:
    report = client.platform.Report.getPdf(accountid="MyAccount", reportname="Asset Report")
    if isinstance(report, bytes):
        open("report.zip", "wb").write(report)

Error handling

Every SDK error derives from SanerError and carries structured context, so you can branch on it without parsing message strings.

from saner import SanerClient, SanerAuthError, SanerRateLimitError, SanerError

try:
    client.cvem.Device.get(ip="192.168.1.10")
except SanerAuthError:
    ...                                  # 401 / 403 — bad or expired key
except SanerRateLimitError as e:
    print("retry after", e.retry_after)  # 429, exhausted retries
except SanerError as e:
    print(e.status_code, e.method, e.url, e.attempts, e.response_body)

Invalid arguments raise plain ValueError / TypeError before any network call is made.

Retries

The SDK retries HTTP 429 and 500/502/503/504, plus connection failures, using exponential backoff with jitter capped at 60s. A Retry-After header always takes precedence over the computed delay.

Writes are not retried by default. Replaying a request that already reached the server can duplicate it — creating the same remediation job twice, for example. So retries apply to read-only calls only. Two exceptions are always safe and always retried: HTTP 429 (the server refused to process the request) and connect timeouts (the request never arrived).

Set retry_on_write=True if your workload is idempotent and you'd rather have the retries.

Logging

With enable_logging=True the SDK writes one JSON object per request to <log_dir>/secpod-saner-sdk__<account>__<hash>.jsonl, rotating weekly and keeping 8 backups.

Credentials (password, client_secret, token, ssl, …) are replaced with ***REDACTED*** and long values are truncated. Response bodies are not redacted, and in a CVEM product those contain asset inventories and CVE exposure data — treat the log directory as sensitive.

For application-level logging, the SDK also emits retry warnings through the standard logging module under the saner.* logger namespace.

Thread safety

None of the three client classes (SanerClient, PlatformClient, CvemClient) are thread-safe — each wraps requests.Session, which does not guarantee thread safety. Create one client per thread.

Support

• API reference: https://apidocs-cvem.readme.io/docs/installation
• Support: support@secpod.com

License

Proprietary — see LICENSE. Use is governed by your SecPod license agreement.