DEPRECATED -- This project has been merged into xsoar-cli and will receive no further updates.
xsoar-client
Python client library for Palo Alto XSOAR (formerly Demisto). Provides programmatic access to XSOAR servers for content pack management, case operations, and artifact handling.
This library is the foundation for xsoar-cli. Use xsoar-client directly when building custom integrations or automation scripts. For command-line usage, use xsoar-cli instead.
Installation
pip install xsoar-client
Requirements
- Python 3.10 or higher
- XSOAR/XSIAM server (version 6 or 8)
- Valid API credentials
Configuration
Environment Variables
Authentication credentials are read from environment variables:
DEMISTO_API_KEY- XSOAR API keyDEMISTO_BASE_URL- XSOAR server URL (e.g.,https://xsoar.example.com)XSIAM_AUTH_ID- XSIAM authentication ID (XSOAR 8 only)
ClientConfig Parameters
server_version(required) - XSOAR server version (6 or 8)custom_pack_authors- List of custom pack authors (default:[])api_token- API token (default: fromDEMISTO_API_KEYenvironment variable)server_url- Server URL (default: fromDEMISTO_BASE_URLenvironment variable)xsiam_auth_id- XSIAM auth ID (default: fromXSIAM_AUTH_IDenvironment variable)verify_ssl- SSL verification, boolean or path to CA bundle (default:False)
Artifact Providers
Artifact providers handle storage and retrieval of custom content packs from cloud storage.
AWS S3
Requires AWS credentials configured via AWS CLI or standard AWS environment variables.
Azure Blob Storage
Requires AZURE_STORAGE_SAS_TOKEN environment variable.
Use Cases
- Custom automation scripts for XSOAR operations
- CI/CD pipeline integration for content deployment
- Bulk operations across multiple XSOAR instances
- Custom tooling built on top of XSOAR APIs
For CLI-based workflows and usage examples, see xsoar-cli.
License
Distributed under the MIT license.
1 maintainer
Metadata
1 maintainer
Release files for xsoar-client 2.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| xsoar_client-2.2.1.tar.gz | 38.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| xsoar_client-2.2.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 52.8 kB
Release files / xsoar_client-2.2.1.tar.gz
| Download URL | xsoar_client-2.2.1.tar.gz |
|---|---|
| Size | 38.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ff8efd98f55a8af53ca7c6ffaac8a7a653d85bd9a0663c0e5e2111c6bbfeb770
|
|
BLAKE2b-256 checksum How to use checksums |
7c8433f4ebf302e62cf64690b0b7424ad2a09cb3c52f0faa3eb86d5f3442492f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Mar 30, 2026.
Transparency logRelease files / xsoar_client-2.2.1-py3-none-any.whl
| Download URL | xsoar_client-2.2.1-py3-none-any.whl |
|---|---|
| Size | 14.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b70743b25d209362072a897e5737cd413cb3cfa1b70bcdf77ee9bbb4a576e243
|
|
BLAKE2b-256 checksum How to use checksums |
26490551ba99cc1edf16e8e2a33235bc26bf50593ff864f8fc404962d3cef7ee
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Mar 30, 2026.
Transparency log
