Python client for the Thinkst Canary API
Latest commit 8c7217f Feb 7, 2017 @mclmax mclmax Initial commit
Failed to load latest commit information.
canarytools Initial commit Feb 7, 2017
docs Initial commit Feb 7, 2017
.gitignore Initial commit Feb 7, 2017
LICENSE.txt Initial commit Feb 7, 2017
README.rst Initial commit Feb 7, 2017
setup.cfg Initial commit Feb 7, 2017


Python Canary API Wrapper

Thinkst Applied Research


The Python Canary API Wrapper allows access to the Canary Web API.


The API is supported on python 2.7. The recommended way to install the API Wrapper is via pip.

pip install canarytools

For instructions on installing python and pip see "The Hitchhiker's Guide to Python" Installation Guides.


Assuming you have your API key handy as well as the domain of your website:

import canarytools
console = canarytools.Console(api_key='API_KEY', domain='CLIENT_DOMAIN')

Note: You can find your API key and domain on your console. Head over to the console's setup page and under Canary Console API you'll find your API key. Your domain is the tag in-front of '' in the console's url. For example in, testconsole is the domain.

Alternatively, you can download a configurations file from the Canary Console API tab. Inside the file you'll find instructions on where to place it. If you have this on your system the api_key and domain parameters are no longer necessary when instantiating a Console object.

With the console instance you can then interact with a Canary Console:

# Get all devices

# Acknowledge all incidents for a device older than 3 days
console.incidents.acknowledge(node_id='329921d242c30b5e', older_than='3d')

# Update all devices
for device in console.devices.all():

# Acknowledge and delete all host port scan Incidents
for incident in console.incidents.unacknowledged():
    if isinstance(incident, canarytools.IncidentHostPortScan):

# Create a web image Canarytoken
    memo='Drop this token on DC box',

# Print out the name of all incidents and the source IP address
for incident in console.incidents.all():
    print incident.description, incident.src_host

Please see the API doc's documentation for more examples of what you can do with the Canary Console API.

Discussion and Support

Please file bugs and feature requests as issues on GitHub after first searching to ensure a similar issue was not already filed. If such an issue already exists please give it a thumbs up reaction. Comments to issues containing additional information are certainly welcome.


The documentation is located at


The Python Canary API Wrapper's source (v1.0.0+) is provided under the Revised BSD License.

  • Copyright (c), 2017, Thinkst Applied Research