SolomonPy · Python SDK
Solomon, from Python.
SolomonPy (package sdkpy) is the SDK the Solomon SOC backend itself uses to call the platform. Synchronous and async clients, Pydantic v2 models and typed errors, for Python 3.10 and later.
from sdkpy import CyberCore, CyberCoreError
core = CyberCore() # reads GATEWAY_URL, TENANT_ID, TOKEN_URL, CLIENT_ID, PRIVATE_KEY
try:
intel = core.get_threat_intelligence(ip="203.0.113.7")
print(intel.risk_score, intel.ai_analysis, intel.remediation_status)
techniques = core.get_mitre_attacks(search="Phishing", phase="Initial Access", limit=5)
except CyberCoreError as e:
print(f"Error: {e}")IP from a documentation range. Configuration comes from the environment.
Set up
Install, configure, call.
The SDK depends only on httpx, Pydantic v2 and cryptography. It speaks REST to the Solomon gateway and authenticates with your private key: it signs a JWT assertion (RFC 7523), exchanges it for a short-lived token, and scopes every request to your tenant.
Generate the key in the developer dashboard. Read secrets from the environment or a secrets manager, never from code.
# from the directory that holds the sdkpy source
pip install ./sdkpy- GATEWAY_URL
- Solomon gateway. https://api.vintercept.ai in production.
- TENANT_ID
- Tenant every request is scoped to.
- TOKEN_URL
- Token endpoint of the identity provider.
- CLIENT_ID
- Your client id.
- PRIVATE_KEY
- Your private key: PEM string or JSON key file.
- API_TIMEOUT
- Request timeout in seconds (default 120).
- SOLOMON_HITL_GRANT_PUBKEY
- Pinned Ed25519 key that verifies approval grants.
- SOLOMON_HITL_GRANT_KEY_ID
- The key id that public key belongs to.
What is in the box
One package, every surface.
CyberCore and AsyncCyberCore
- Synchronous and asynchronous clients over httpx
- Threat intelligence, MITRE ATT&CK, incidents, detections, hosts
- Copilot feedback and analyst-approved actions
SolomonClient
- Async client for agents and agent signals, approvals and response actions
- Fleet health roll-up by version, rollout ring, policy mode and drift
- Cloud assets and Kubernetes posture discovered by OmniMesh
InvestigationAPI
- core.investigation: sessions, evidence upload, live streaming
- The agent's answer, plan, reasoning and artifacts on every result
- Bring your own model key from the provider catalogue
HitlApprovalsClient
- Gate an AI agent's tool calls on a Solomon approval
- Works for agentless agents: LangGraph, CrewAI, Bedrock, OpenAI Agents SDK
- Sync and async (AsyncHitlApprovalsClient)
roles
- The platform's role catalogue, shipped in the wheel
- roles.has_capability(token_roles, "approve_remediation")
- Separation-of-duties checks and who may grant each role
Typed errors
- One CyberCoreError hierarchy, never raw httpx errors
- AuthenticationError, ForbiddenError, NotFoundError, ConflictError, RateLimitError
- APIError.detail keeps the platform's own explanation
Examples
Three things to build first.
Run an agentic investigation
The same investigation agent as the Investigation tab in Solomon SOC. Results carry the answer, the plan and any artifacts. Signing the analyst identity needs SOLOMON_ACTOR_SECRET, which can impersonate any analyst: keep it server-side.
from sdkpy import CyberCore
core = CyberCore(gateway_url="https://api.vintercept.ai", tenant_id=tenant_id)
# Bind an analyst first: the agent scopes sessions and tools to this identity.
inv = core.investigation.as_actor("analyst@example.com", roles=["tier-3-analysts"])
session = inv.create_session(skills=["threat-hunting"])
inv.upload_file(session.id, "auth.log", open("auth.log", "rb").read(), content_type="text/plain")
result = inv.investigate("Triage the SSH brute force on host web-03.", session_id=session.id)
print(result.content) # the answer
print([(t.title, t.status) for t in result.tasks]) # the agent's planMake your own AI agent ask first
Hold a risky tool call until a human approves it, on the console or on Solomon XGuard. The SDK verifies the platform's Ed25519 grant locally before you act, and fails closed if no key is pinned.
from sdkpy import HitlApprovalDeniedError, HitlApprovalExpiredError, HitlApprovalsClient
hitl = HitlApprovalsClient(
tenant_id=tenant_id,
gateway_url="https://api.vintercept.ai",
token=workload_token,
agent_id="langgraph-secops-agent",
grant_verify_pubkey=s202_pubkey_hex,
grant_key_id=s202_key_id,
)
try:
grant = hitl.hold_for_grant(
{"tool": "aws.ec2.terminate_instances", "target": "i-0123456789abcdef0", "blast_radius": "high"},
justification="Contain compromised bastion host",
timeout_s=300,
)
print("Approved by:", grant.approver_id)
except HitlApprovalDeniedError as exc:
print("Denied:", exc.reason)
except HitlApprovalExpiredError as exc:
print("Expired:", exc.reason)Queue a four-eyes identity action
Suspend a user or revoke their sessions at Okta, Entra ID, Auth0 or PingOne. The request only queues an approval; the platform calls the identity provider when a second analyst approves.
from sdkpy import ForbiddenError, SolomonClient
client = SolomonClient(tenant_id=tenant_id, token=analyst_token)
queued = await client.request_identity_action(
"idp_suspend_user", "okta", "00u1abcd",
user_display="Jane Doe", reason="Impossible travel",
)
print(queued.approval_id, queued.status) # "awaiting_approval"
try:
await client.approve_identity_action(queued.approval_id, note="confirmed")
except ForbiddenError as exc:
print(exc.detail) # e.g. you may not approve your own requestBuild with SolomonPy.
Register for developer access, then generate your key pair in the developer dashboard. The private key is downloaded once; VIntercept does not keep a copy.