SW360 Base Library for Python

This Python project implements the REST API of SW360 and allows an easy way to interact with SW360.

Documentation

Have a look at the documentation: https://sw360.github.io/sw360python/

Usage

Installation

This project is available as Python package on PyPi.org.
Install sw360 and required dependencies:

  pip install sw360 requests

Using the API

• Get a REST API token from your SW360 server. In default configuration, tokens can be generated in your Preferences.

• Starting with SW360 v20, tokens can also be generated using a Keycloak client_id and client_secret which you can request from your SW360 admin team. There's a special helper class to generate the access tokens:

  from sw360 import SW360Keycloak
  kc = SW360Keycloak(sw360_url)
  sw360_api_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
  

• Start using the API:

  import sw360
  # oauth2=True is required for tokens created using client_id and client_secret.
  client = sw360.SW360(sw360_url, sw360_api_token, oauth2=True)
  client.login_api():
  r = client.get_release(release_id)
  

• For long running operations the token may expire while the operation is still running. In that case you can use SW360KeycloakClient, which takes the Keycloak credentials instead of a token and renews the token shortly before it expires (five minutes by default, see refresh_before_seconds):

  from sw360 import SW360KeycloakClient
  client = SW360KeycloakClient(sw360_url, client_id, client_secret, write_access=False)
  client.login_api()
  r = client.get_release(release_id)
  

  The client uses its own session, so it does not affect clients created with a static token. If you need to hand the token to another component which creates its own client, use client.current_token to get a token that is valid now.

• Starting with v1.12, most responses are wrapped in SW360Response, a dict subclass, so existing code keeps working unchanged, but you get new convenience methods for the _links and _embedded sections of the SW360 HAL responses:

  release = client.get_release(release_id)
  
  # get the component id from the release, instead of
  #   client.get_id_from_href(release["_links"]["sw360:component"]["href"])
  component_id = release.linked_id("component")
  component = client.get_component(component_id)
  
  # get the first attachment for the release, instead of
  #   client.get_id_from_href(release["_embedded"]["sw360:attachments"][0]["_links"]["self"]["href"])
  attachment_id = release.embedded_list("attachments")[0].linked_id()
  attachment = client.get_attachment(attachment_id)
  

  For now, the get_all_* and get_*_by_* methods (e.g. get_all_components or get_releases_by_external_id) still return a list of dicts, this is planned to be changed in a future release to also return a list of SW360Response objects.

Contribute

• All contributions in form of bug reports, feature requests or merge requests!
• Use proper docstrings to document
  functions and classes
• Extend the testsuite poetry run pytest with the new functions/classes
• The documentation website can automatically be generated by the Sphinx autodoc extension

Build

Building the Documentation

The documentation of the project is built using Sphinx:

poetry run sphinx-build ./docs-source/ ./docs/

Building Python package

For building the library, you need Poetry.
The build is then triggered using

poetry build

This creates the source and wheel files in dist/ subdirectory -- which can then be
uploaded or installed locally using pip.

Test

Start the complete test suite or a specific test case (and generate coverage report):

poetry run pytest

or

poetry run coverage run -m pytest
poetry run coverage report -m --omit "*/site-packages/*.py"
poetry run coverage html --omit "*/site-packages/*.py"

Demo

The script check_project.py shows how to use the library to retrieve some information
of a given project on SW360. This requires colorama>=0.4.1.

License

Copyright 2019-2026 Siemens

The project is licensed under the MIT license. SPDX-License-Identifier: MIT

SBOM

For an up-to-date CycloneDX SBOM, please have a look at the SBOM folder.