---
id: demisto-py
version: "3.3.1"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# demisto-py — "A Python library for the Demisto API"

License: permissive · Maintenance: active · Downloads: 104.6K/mo

## What it is and what it does

demisto-py is a Python wrapper around the Demisto REST API, generated from the Demisto Server 4.5.0 Swagger definition. It provides a structured interface for authenticating to Demisto or Cortex XSIAM platforms and performing operations like creating incidents and querying data. The library supports multiple authentication methods: API key, username/password (XSOAR only), and Cortex XSIAM's auth_id scheme. Configuration can be passed directly or via environment variables, making it suitable for both interactive scripts and automated deployments.

The package depends on standard HTTP and date/time utilities (urllib3, certifi, python-dateutil, tzlocal, six, setuptools) and is designed for developers building integrations, incident response automation, or security operations workflows. It is actively maintained and supports Python 3.10 through 3.14.

Use it for:

- Automate incident creation and enrichment from external security tools into Demisto.
- Build custom reporting tools that query incident and alert data from Demisto via API.
- Integrate Demisto with third-party ticketing systems to synchronize security events.
- Develop security automation that programmatically triggers Demisto operations based on external events.
- Bulk-import historical incidents or test data into Demisto for training purposes.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

A Python client library for the Demisto API, enabling programmatic interaction with Demisto and Cortex XSIAM platforms to create incidents and automate security workflows.

Yes. The package is actively maintained, has no known vulnerabilities, uses a permissive Apache-2.0 license, and offers low-friction installation. It is the official client for Demisto API integration and is suitable for any Python-based security automation or integration project targeting Demisto or Cortex XSIAM platforms.

## Install

pip install demisto-py
uv add demisto-py
poetry add demisto-py

## Installing demisto-py

Before you install: Low friction install with standard dependencies. Actively maintained with last commit on 2026-07-29; supports Python 3.10 through 3.14.

License in practice: Apache-2.0 permissive license allows commercial and private use without restriction; suitable for proprietary integrations.

Quickstart:

pip install demisto-py

import demisto_client

api_key = 'YOUR_API_KEY'
host = 'https://YOUR_DEMISTO_HOST'
api_instance = demisto_client.configure(base_url=host, api_key=api_key)

Requires valid Demisto API key (generated from Demisto Settings > API Keys) and network access to a Demisto or Cortex XSIAM server.

Verify before relying:

- Whether the library supports Demisto server versions prior to 4.5 or only 4.5 and later as stated.
- Performance characteristics when handling large incident batches or high-frequency API calls.
- Whether generated code is kept in sync with newer Demisto server versions automatically.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 104.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

demisto api client, security orchestration python, incident management api, cortex xsiam client, demisto automation library, api client library, incident creation, security-orchestration, api-client, incident-management

[View on SkillFed](https://skillfed.io/packages/demisto-py) · [View on PyPI](https://pypi.org/project/demisto-py/)