Developers · SDKs and API
Build on Solomon.
SolomonPy and SolomonJS give your applications and AI agents the same platform the Solomon SOC console runs on: threat intelligence, agentic investigations, approvals for agent actions and fleet data, through one authenticated gateway.
# shell
export GATEWAY_URL="https://api.vintercept.ai"
export TOKEN_URL="https://auth.vintercept.ai/oauth/v2/token"
export TENANT_ID="your-tenant-id"
export CLIENT_ID="your-client-id"
export PRIVATE_KEY="$(cat solomon-key.pem)"
# python
from sdkpy import CyberCore
core = CyberCore()
intel = core.get_threat_intelligence(ip="203.0.113.7")
print(intel.risk_score, intel.ai_analysis)Values are placeholders. Keys come from the developer dashboard.
SDKs
Pick your language.
- Python 3.10+ · package sdkpySolomonPyThe full SDK. Synchronous and asynchronous clients for everything the Solomon SOC console itself uses.
- Threat intelligence and MITRE ATT&CK
- Agentic investigations with streaming
- Approvals for AI-agent actions
- Fleet health, cloud assets, roles
- TypeScript · Node.js · package sdknodeSolomonJSA typed Node client for the core intelligence and Copilot endpoints.
- Observable analysis with remediation status
- MITRE ATT&CK search
- Agent log analysis
- Copilot feedback and approved actions
What you can build
The platform, as an API.
The SDKs wrap the platform's REST API. Method names below are SolomonPy's; SolomonJS covers the intelligence and Copilot parts today.
Intelligence and investigation
- Analyze an IP and get a risk score, AI analysis and remediation status
- Search the MITRE ATT&CK knowledge base by phase and platform
- Run agentic investigations: sessions, evidence upload, live streaming
Approvals for AI agents
- Gate your own agents' tool calls (LangGraph, CrewAI, Bedrock, OpenAI Agents SDK) on a Solomon approval
- Verify the platform's Ed25519 grant, and the approver's hardware or passkey signature, before acting
- Verification fails closed when no key is pinned
Fleet and response
- List agents and roll up fleet health by version, rollout ring and policy mode
- Queue approval-gated identity actions: suspend a user or revoke all their sessions
- Query cross-host swarm incidents
Cloud assets
- Kubernetes clusters, nodes, workloads, networking and access controls discovered by OmniMesh
- Compute inventory and on-demand inventory sync
- Security posture per cluster sub-resource
Roles and capabilities
- The platform's role catalogue, shipped with the SDK
- Check a capability, not a list of role names
- Same answers as the platform, pinned by a checksum test
One authenticated gateway
- Every call goes through the Solomon gateway; nothing talks to platform internals
- Service calls authenticate with a signed JWT assertion (RFC 7523) from your private key
- Your tenant comes from the verified token, never from a header
Access
From sign-up to first call.
Keys are issued per organization in the developer dashboard. The platform generates the key pair and you download the private key once; VIntercept does not store it, so keep it in a secrets manager.
New here? Request developer access first.
Production gateway: https://api.vintercept.ai
- 1RegisterRequest developer access for your organization.
- 2Generate a keyCreate a key pair in the developer dashboard and download the private key (.pem) once.
- 3ConfigurePoint the SDK at the gateway with your tenant, client id and private key.
- 4CallThe SDK exchanges a signed assertion for a token and calls the API for you.
Start building.
Register for developer access, then generate your key pair in the developer dashboard. The private key is downloaded once; VIntercept does not keep a copy.