Client SDKs

Two Apache-2.0 client packages cover the Sigmatic, Warden and VectorFlow APIs. They ship with the sign-in service’s own release, identity/vX.Y.Z: each identity release regenerates them from the OpenAPI documents of each product’s newest release and publishes them at identity’s version:

• Python: veltro-sdk from PyPI
• TypeScript: @veltrosecurity/sdk from npm

The clients talk to the gateway. Use one signed-in session for every installed product, or one product’s client under its path (/vectorflow, /sigmatic, /warden). On Sigmatic and Warden, a personal access token from the admin console works as a bearer token with its owner’s current grants. VectorFlow REST v1 requires an environment-scoped service-account key.

Python

python3 -m pip install veltro-sdk

from veltro_sdk import VeltroClient

suite = VeltroClient.login(
    "https://soc.example.com",
    "analyst@example.com",
    password,
    vectorflow_key=vectorflow_service_key,
)

sources = suite.sigmatic.data_sources.list()
cases = suite.warden.cases.list()
pipelines = suite.vectorflow.pipelines.list()

For one product with a personal access token, include the gateway prefix in the base URL:

from veltro_sdk import BearerToken, SigmaticClient

sigmatic = SigmaticClient("https://soc.example.com/sigmatic", auth=BearerToken(token))
alerts = sigmatic.alerts.list()

TypeScript

pnpm add @veltrosecurity/sdk

import { VeltroClient } from "@veltrosecurity/sdk";

const suite = await VeltroClient.login(
  "https://soc.example.com",
  "analyst@example.com",
  password,
  { vectorflowKey: vectorflowServiceKey },
);

const sources = await suite.sigmatic.dataSources.list();
const cases = await suite.warden.cases.list();
const pipelines = await suite.vectorflow.pipelines.list();

Example: morning triage

Each SDK ships a small read-only script that lists open Warden cases and new critical or high Sigmatic alerts. Both read VELTRO_URL and VELTRO_TOKEN (a personal access token with warden:cases:read and sigmatic:alerts:read) from the environment and tell you what to fix when the token is rejected or short a scope.

• Python: sdk/python/examples/triage.py
• TypeScript: packages/sdk-ts/examples/triage.ts

Errors and limits

Both clients set request timeouts, cap response bodies, and expose typed HTTP errors. They do not retry non-idempotent write methods. A missing VectorFlow service-account key fails locally with a named credential error instead of sending an unusable suite session.

API coverage and releases

Each identity release checks out each product’s newest published release, extracts their OpenAPI documents, and regenerates both clients’ operations before it builds them, so a client never lists an endpoint those product releases don’t serve. The packages reach PyPI and npm through trusted publishing only, after identity’s GitHub release is published; the repository stores no registry token.

Each product’s API page shows its own client: VectorFlow, Sigmatic and Warden.