blackshield-sdk 0.2.2__tar.gz → 0.2.3__tar.gz

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/.gitignore

@@ -52,4 +52,6 @@ coverage.xml
 .claude/worktrees/
 
 Blackshield features - Human Review - Features - v1.csv
-.coverage.*
+.coverage.*
+# Local ingestion failure evidence is private runtime data.
+.ingestion-quarantine/

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: blackshield-sdk
-Version: 0.2.2
+Version: 0.2.3
 Summary: Official Python SDK for the BlackShield Security Platform
 Project-URL: Homepage, https://blackshield.chaplau.com
 Project-URL: Documentation, https://blackshield.chaplau.com/en/docs
@@ -100,6 +100,13 @@ asyncio.run(main())
 | `client.oauth_apps` | OAuth app and grant governance | `client.oauth_apps.grants(status="pending_review")` |
 | `client.threat_modeling` | Hosted threat-model sessions & exports | `client.threat_modeling.create_session(title="Review")` |
 
+The 0.2.3 release candidate adds appliance inventory and policy operations,
+identity sessions, agent operations, SIEM entities and statistics, and ingestion
+submission responses that accept either `id` or `job_id`. These operations have
+matching synchronous and asynchronous clients. Publish and verify this candidate
+before updating a lab's SDK lock; an existing 0.2.2 installation does not include
+these additions.
+
 Version 0.2.2 preserves the 0.2.0 surface and accepts both the legacy `job_id`
 and current `id` ingestion job status fields. It also includes the 0.2.1 durable
 EASM verification outcomes, explicit challenge rotation, and synchronous/asynchronous

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/README.md

@@ -70,6 +70,13 @@ asyncio.run(main())
 | `client.oauth_apps` | OAuth app and grant governance | `client.oauth_apps.grants(status="pending_review")` |
 | `client.threat_modeling` | Hosted threat-model sessions & exports | `client.threat_modeling.create_session(title="Review")` |
 
+The 0.2.3 release candidate adds appliance inventory and policy operations,
+identity sessions, agent operations, SIEM entities and statistics, and ingestion
+submission responses that accept either `id` or `job_id`. These operations have
+matching synchronous and asynchronous clients. Publish and verify this candidate
+before updating a lab's SDK lock; an existing 0.2.2 installation does not include
+these additions.
+
 Version 0.2.2 preserves the 0.2.0 surface and accepts both the legacy `job_id`
 and current `id` ingestion job status fields. It also includes the 0.2.1 durable
 EASM verification outcomes, explicit challenge rotation, and synchronous/asynchronous

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/_async_client.py

@@ -8,6 +8,7 @@ from blackshield.resources.ai_gateway import AsyncAiGatewayResource
 from blackshield.resources.ai_integrations import AsyncAiIntegrationsResource
 from blackshield.resources.alerts import AsyncAlertsResource
 from blackshield.resources.api_keys import AsyncApiKeysResource
+from blackshield.resources.appliances import AsyncAppliancesResource
 from blackshield.resources.assertions import AsyncAssertionsResource
 from blackshield.resources.audit import AsyncAuditResource
 from blackshield.resources.compliance import AsyncComplianceResource
@@ -25,6 +26,7 @@ from blackshield.resources.oauth_apps import AsyncOAuthAppsResource
 from blackshield.resources.policies import AsyncPoliciesResource
 from blackshield.resources.remediation import AsyncRemediationResource
 from blackshield.resources.reports import AsyncReportsResource
+from blackshield.resources.rules import AsyncRulesResource
 from blackshield.resources.runbooks import AsyncRunbooksResource
 from blackshield.resources.security_agents import AsyncSecurityAgentsResource
 from blackshield.resources.security_reviews import AsyncSecurityReviewsResource
@@ -82,6 +84,8 @@ class AsyncBlackShield:
         self._oauth_apps = AsyncOAuthAppsResource(self._http)
         self._customer_notifications = AsyncCustomerNotificationsResource(self._http)
         self._threat_modeling = AsyncThreatModelingResource(self._http)
+        self._rules = AsyncRulesResource(self._http)
+        self._appliances = AsyncAppliancesResource(self._http)
 
     @property
     def findings(self) -> AsyncFindingsResource:
@@ -203,6 +207,16 @@ class AsyncBlackShield:
     def threat_modeling(self) -> AsyncThreatModelingResource:
         return self._threat_modeling
 
+    @property
+    def rules(self) -> AsyncRulesResource:
+        """Detection ruleset operations."""
+        return self._rules
+
+    @property
+    def appliances(self) -> AsyncAppliancesResource:
+        """Appliance configuration operations."""
+        return self._appliances
+
     async def close(self) -> None:
         """Close the underlying async HTTP client."""
         await self._http.close()

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/_client.py

@@ -8,6 +8,7 @@ from blackshield.resources.ai_gateway import AiGatewayResource
 from blackshield.resources.ai_integrations import AiIntegrationsResource
 from blackshield.resources.alerts import AlertsResource
 from blackshield.resources.api_keys import ApiKeysResource
+from blackshield.resources.appliances import AppliancesResource
 from blackshield.resources.assertions import AssertionsResource
 from blackshield.resources.audit import AuditResource
 from blackshield.resources.compliance import ComplianceResource
@@ -25,6 +26,7 @@ from blackshield.resources.oauth_apps import OAuthAppsResource
 from blackshield.resources.policies import PoliciesResource
 from blackshield.resources.remediation import RemediationResource
 from blackshield.resources.reports import ReportsResource
+from blackshield.resources.rules import RulesResource
 from blackshield.resources.runbooks import RunbooksResource
 from blackshield.resources.security_agents import SecurityAgentsResource
 from blackshield.resources.security_reviews import SecurityReviewsResource
@@ -92,6 +94,8 @@ class BlackShield:
         self._oauth_apps = OAuthAppsResource(self._http)
         self._customer_notifications = CustomerNotificationsResource(self._http)
         self._threat_modeling = ThreatModelingResource(self._http)
+        self._rules = RulesResource(self._http)
+        self._appliances = AppliancesResource(self._http)
 
     @property
     def findings(self) -> FindingsResource:
@@ -238,6 +242,16 @@ class BlackShield:
         """Hosted threat-modeling sessions and exports."""
         return self._threat_modeling
 
+    @property
+    def rules(self) -> RulesResource:
+        """Detection ruleset operations."""
+        return self._rules
+
+    @property
+    def appliances(self) -> AppliancesResource:
+        """Appliance configuration operations."""
+        return self._appliances
+
     def close(self) -> None:
         """Close the underlying HTTP client."""
         self._http.close()

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/_version.py

@@ -1,3 +1,3 @@
 """Single-source version for the BlackShield SDK."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/resources/__init__.py

@@ -2,6 +2,7 @@
 
 from blackshield.resources.ai_assets import AiAssetsResource, AsyncAiAssetsResource
 from blackshield.resources.ai_integrations import AiIntegrationsResource, AsyncAiIntegrationsResource
+from blackshield.resources.appliances import AppliancesResource, AsyncAppliancesResource
 from blackshield.resources.assertions import AssertionsResource, AsyncAssertionsResource
 from blackshield.resources.customer_notifications import (
     AsyncCustomerNotificationsResource,
@@ -10,6 +11,7 @@ from blackshield.resources.customer_notifications import (
 from blackshield.resources.dast import AsyncDastResource, DastResource
 from blackshield.resources.evidence import AsyncEvidenceResource, EvidenceResource
 from blackshield.resources.oauth_apps import AsyncOAuthAppsResource, OAuthAppsResource
+from blackshield.resources.rules import AsyncRulesResource, RulesResource
 from blackshield.resources.runbooks import AsyncRunbooksResource, RunbooksResource
 from blackshield.resources.security_agents import AsyncSecurityAgentsResource, SecurityAgentsResource
 from blackshield.resources.siem import AsyncSiemResource, SiemResource
@@ -18,14 +20,17 @@ from blackshield.resources.threat_modeling import AsyncThreatModelingResource, T
 __all__ = [
     "AiAssetsResource",
     "AiIntegrationsResource",
+    "AppliancesResource",
     "AssertionsResource",
     "AsyncAiAssetsResource",
     "AsyncAiIntegrationsResource",
+    "AsyncAppliancesResource",
     "AsyncAssertionsResource",
     "AsyncCustomerNotificationsResource",
     "AsyncDastResource",
     "AsyncEvidenceResource",
     "AsyncOAuthAppsResource",
+    "AsyncRulesResource",
     "AsyncRunbooksResource",
     "AsyncSecurityAgentsResource",
     "AsyncSiemResource",
@@ -34,6 +39,7 @@ __all__ = [
     "DastResource",
     "EvidenceResource",
     "OAuthAppsResource",
+    "RulesResource",
     "RunbooksResource",
     "SecurityAgentsResource",
     "SiemResource",

blackshield_sdk-0.2.3/src/blackshield/resources/appliances.py

@@ -0,0 +1,54 @@
+"""Appliance configuration resource."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from blackshield.types.appliances import ApplianceConfig
+
+if TYPE_CHECKING:
+    from blackshield._base_client import AsyncHTTPClient, SyncHTTPClient
+
+
+class AppliancesResource:
+    """Synchronous appliance configuration operations."""
+
+    def __init__(self, client: SyncHTTPClient) -> None:
+        self._client = client
+
+    def get(self, kind: str) -> ApplianceConfig | None:
+        """Fetch latest published configuration for an appliance kind, or None if not found."""
+        try:
+            response = self._client.get(f"/api/v1/appliance-config/{kind}")
+            return ApplianceConfig.model_validate(response.json())
+        except Exception as exc:
+            if getattr(exc, "status_code", None) == 404:
+                return None
+            raise
+
+    def publish(self, kind: str, *, config: dict[str, Any]) -> ApplianceConfig:
+        """Publish a new appliance configuration."""
+        response = self._client.post(f"/api/v1/appliance-config/{kind}/publish", json={"config": config})
+        return ApplianceConfig.model_validate(response.json())
+
+
+class AsyncAppliancesResource:
+    """Asynchronous appliance configuration operations."""
+
+    def __init__(self, client: AsyncHTTPClient) -> None:
+        self._client = client
+
+    async def get(self, kind: str) -> ApplianceConfig | None:
+        """Fetch latest published configuration for an appliance kind, or None if not found."""
+        try:
+            response = await self._client.get(f"/api/v1/appliance-config/{kind}")
+            return ApplianceConfig.model_validate(response.json())
+        except Exception as exc:
+            if getattr(exc, "status_code", None) == 404:
+                return None
+            raise
+
+    async def publish(self, kind: str, *, config: dict[str, Any]) -> ApplianceConfig:
+        """Publish a new appliance configuration."""
+        response = await self._client.post(f"/api/v1/appliance-config/{kind}/publish", json={"config": config})
+        return ApplianceConfig.model_validate(response.json())

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/resources/identity.py

@@ -11,6 +11,10 @@ from blackshield.types.identity import (
     OIDCConfig,
     SCIMConfig,
     SCIMRotateResponse,
+    SpiffeBundle,
+    SshCaInfo,
+    SshCertificate,
+    WorkloadAttestation,
 )
 
 
@@ -63,6 +67,26 @@ class IdentityResource:
         resp = self._client.get("/api/v1/identity/audit")
         return [IdentityAuditEvent.model_validate(e) for e in resp.json()]
 
+    def get_spiffe_bundle(self) -> SpiffeBundle:
+        """Fetch SPIFFE trust bundle."""
+        resp = self._client.get("/api/v1/identity/spiffe-bundle")
+        return SpiffeBundle.model_validate(resp.json())
+
+    def attest_workload(self, **payload: Any) -> WorkloadAttestation:
+        """Attest workload identity."""
+        resp = self._client.post("/api/v1/identity/workloads/attest", json=payload)
+        return WorkloadAttestation.model_validate(resp.json())
+
+    def get_ssh_ca_info(self) -> SshCaInfo:
+        """Fetch SSH CA public key information."""
+        resp = self._client.get("/api/v1/identity/ssh-ca")
+        return SshCaInfo.model_validate(resp.json())
+
+    def request_ssh_certificate(self, **payload: Any) -> SshCertificate:
+        """Request signed ephemeral SSH certificate."""
+        resp = self._client.post("/api/v1/identity/ssh-certificate", json=payload)
+        return SshCertificate.model_validate(resp.json())
+
 
 class AsyncIdentityResource:
     """Async identity operations."""
@@ -85,3 +109,23 @@ class AsyncIdentityResource:
     async def list_audit_events(self) -> list[IdentityAuditEvent]:
         resp = await self._client.get("/api/v1/identity/audit")
         return [IdentityAuditEvent.model_validate(e) for e in resp.json()]
+
+    async def get_spiffe_bundle(self) -> SpiffeBundle:
+        """Fetch SPIFFE trust bundle."""
+        resp = await self._client.get("/api/v1/identity/spiffe-bundle")
+        return SpiffeBundle.model_validate(resp.json())
+
+    async def attest_workload(self, **payload: Any) -> WorkloadAttestation:
+        """Attest workload identity."""
+        resp = await self._client.post("/api/v1/identity/workloads/attest", json=payload)
+        return WorkloadAttestation.model_validate(resp.json())
+
+    async def get_ssh_ca_info(self) -> SshCaInfo:
+        """Fetch SSH CA public key information."""
+        resp = await self._client.get("/api/v1/identity/ssh-ca")
+        return SshCaInfo.model_validate(resp.json())
+
+    async def request_ssh_certificate(self, **payload: Any) -> SshCertificate:
+        """Request signed ephemeral SSH certificate."""
+        resp = await self._client.post("/api/v1/identity/ssh-certificate", json=payload)
+        return SshCertificate.model_validate(resp.json())

blackshield_sdk-0.2.3/src/blackshield/resources/rules.py

@@ -0,0 +1,220 @@
+"""Detection ruleset operations resource for BlackShield SDK."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import Any, cast
+
+
+class RulesResource:
+    """Synchronous detection ruleset operations."""
+
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def list(
+        self,
+        *,
+        target_type: str | None = None,
+        category: str | None = None,
+        severity: str | None = None,
+        is_system: bool | None = None,
+        search: str | None = None,
+        parent_rule_id: str | None = None,
+        page: int = 1,
+        page_size: int = 50,
+    ) -> dict[str, Any]:
+        """List detection rules visible to the tenant."""
+        params: dict[str, Any] = {"page": page, "page_size": page_size}
+        if target_type:
+            params["target_type"] = target_type
+        if category:
+            params["category"] = category
+        if severity:
+            params["severity"] = severity
+        if is_system is not None:
+            params["is_system"] = is_system
+        if search:
+            params["search"] = search
+        if parent_rule_id:
+            params["parent_rule_id"] = parent_rule_id
+
+        resp = self._client.get("/api/v1/rules", params=params)
+        return cast(dict[str, Any], resp.json())
+
+    def get(self, rule_id: str) -> dict[str, Any]:
+        """Retrieve a detection rule by ID."""
+        resp = self._client.get(f"/api/v1/rules/{rule_id}")
+        return cast(dict[str, Any], resp.json())
+
+    def stats(self) -> dict[str, Any]:
+        """Retrieve ruleset catalog summary metrics."""
+        resp = self._client.get("/api/v1/rules/stats")
+        return cast(dict[str, Any], resp.json())
+
+    def create(
+        self,
+        *,
+        rule_id: str,
+        title: str,
+        description: str = "",
+        severity: str = "medium",
+        category: str = "general",
+        target_type: str = "log",
+        match_logic: dict[str, Any] | None = None,
+        mitre_attack: Sequence[str] | None = None,
+        compliance_frameworks: Sequence[str] | None = None,
+        parent_rule_id: str | None = None,
+        is_enabled: bool = True,
+        remediation_guidance: str | None = None,
+    ) -> dict[str, Any]:
+        """Create a tenant custom detection rule."""
+        payload: dict[str, Any] = {
+            "rule_id": rule_id,
+            "title": title,
+            "description": description,
+            "severity": severity,
+            "category": category,
+            "target_type": target_type,
+            "match_logic": match_logic or {},
+            "mitre_attack": list(mitre_attack or []),
+            "compliance_frameworks": list(compliance_frameworks or []),
+            "parent_rule_id": parent_rule_id,
+            "is_enabled": is_enabled,
+            "remediation_guidance": remediation_guidance,
+        }
+        resp = self._client.post("/api/v1/rules", json=payload)
+        return cast(dict[str, Any], resp.json())
+
+    def update(self, rule_id: str, **kwargs: Any) -> dict[str, Any]:
+        """Update a tenant custom detection rule."""
+        resp = self._client.patch(f"/api/v1/rules/{rule_id}", json=kwargs)
+        return cast(dict[str, Any], resp.json())
+
+    def delete(self, rule_id: str) -> None:
+        """Delete a tenant custom detection rule."""
+        self._client.delete(f"/api/v1/rules/{rule_id}")
+
+    def test(
+        self,
+        *,
+        payload: dict[str, Any],
+        target_type: str = "log",
+        rule_id: str | None = None,
+        rule: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Dry-run test a rule against a sample payload."""
+        req: dict[str, Any] = {"payload": payload, "target_type": target_type}
+        if rule_id:
+            req["rule_id"] = rule_id
+        if rule:
+            req["rule"] = rule
+        resp = self._client.post("/api/v1/rules/test", json=req)
+        return cast(dict[str, Any], resp.json())
+
+
+class AsyncRulesResource:
+    """Asynchronous detection ruleset operations."""
+
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    async def list(
+        self,
+        *,
+        target_type: str | None = None,
+        category: str | None = None,
+        severity: str | None = None,
+        is_system: bool | None = None,
+        search: str | None = None,
+        parent_rule_id: str | None = None,
+        page: int = 1,
+        page_size: int = 50,
+    ) -> dict[str, Any]:
+        """List detection rules visible to the tenant asynchronously."""
+        params: dict[str, Any] = {"page": page, "page_size": page_size}
+        if target_type:
+            params["target_type"] = target_type
+        if category:
+            params["category"] = category
+        if severity:
+            params["severity"] = severity
+        if is_system is not None:
+            params["is_system"] = is_system
+        if search:
+            params["search"] = search
+        if parent_rule_id:
+            params["parent_rule_id"] = parent_rule_id
+
+        resp = await self._client.get("/api/v1/rules", params=params)
+        return cast(dict[str, Any], resp.json())
+
+    async def get(self, rule_id: str) -> dict[str, Any]:
+        """Retrieve a detection rule by ID asynchronously."""
+        resp = await self._client.get(f"/api/v1/rules/{rule_id}")
+        return cast(dict[str, Any], resp.json())
+
+    async def stats(self) -> dict[str, Any]:
+        """Retrieve ruleset catalog summary metrics asynchronously."""
+        resp = await self._client.get("/api/v1/rules/stats")
+        return cast(dict[str, Any], resp.json())
+
+    async def create(
+        self,
+        *,
+        rule_id: str,
+        title: str,
+        description: str = "",
+        severity: str = "medium",
+        category: str = "general",
+        target_type: str = "log",
+        match_logic: dict[str, Any] | None = None,
+        mitre_attack: Sequence[str] | None = None,
+        compliance_frameworks: Sequence[str] | None = None,
+        parent_rule_id: str | None = None,
+        is_enabled: bool = True,
+        remediation_guidance: str | None = None,
+    ) -> dict[str, Any]:
+        """Create a tenant custom detection rule asynchronously."""
+        payload: dict[str, Any] = {
+            "rule_id": rule_id,
+            "title": title,
+            "description": description,
+            "severity": severity,
+            "category": category,
+            "target_type": target_type,
+            "match_logic": match_logic or {},
+            "mitre_attack": list(mitre_attack or []),
+            "compliance_frameworks": list(compliance_frameworks or []),
+            "parent_rule_id": parent_rule_id,
+            "is_enabled": is_enabled,
+            "remediation_guidance": remediation_guidance,
+        }
+        resp = await self._client.post("/api/v1/rules", json=payload)
+        return cast(dict[str, Any], resp.json())
+
+    async def update(self, rule_id: str, **kwargs: Any) -> dict[str, Any]:
+        """Update a tenant custom detection rule asynchronously."""
+        resp = await self._client.patch(f"/api/v1/rules/{rule_id}", json=kwargs)
+        return cast(dict[str, Any], resp.json())
+
+    async def delete(self, rule_id: str) -> None:
+        """Delete a tenant custom detection rule asynchronously."""
+        await self._client.delete(f"/api/v1/rules/{rule_id}")
+
+    async def test(
+        self,
+        *,
+        payload: dict[str, Any],
+        target_type: str = "log",
+        rule_id: str | None = None,
+        rule: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Dry-run test a rule against a sample payload asynchronously."""
+        req: dict[str, Any] = {"payload": payload, "target_type": target_type}
+        if rule_id:
+            req["rule_id"] = rule_id
+        if rule:
+            req["rule"] = rule
+        resp = await self._client.post("/api/v1/rules/test", json=req)
+        return cast(dict[str, Any], resp.json())

{blackshield_sdk-0.2.2 → blackshield_sdk-0.2.3}/src/blackshield/resources/security_agents.py

@@ -6,9 +6,12 @@ import uuid
 from typing import Any
 
 from blackshield.types.security_agents import (
+    AgentAssignment,
     AgentCredential,
     AgentInstallation,
     AgentMission,
+    AgentRun,
+    AgentRunReport,
     AgentWorkflow,
     CapabilityOperation,
     OperatorMessage,
@@ -37,6 +40,10 @@ class SecurityAgentsResource:
         ).json()
         return [AgentInstallation.model_validate(item) for item in response["items"]]
 
+    def create_installation(self, **payload: Any) -> AgentInstallation:
+        response = self._client.post("/api/v1/security-agents/installations", json=payload).json()
+        return AgentInstallation.model_validate(response)
+
     def archive_installation(self, installation_id: uuid.UUID | str) -> AgentInstallation:
         response = self._client.post(f"/api/v1/security-agents/installations/{installation_id}/archive")
         return AgentInstallation.model_validate(response.json())
@@ -44,6 +51,31 @@ class SecurityAgentsResource:
     def delete_installation(self, installation_id: uuid.UUID | str) -> None:
         self._client.delete(f"/api/v1/security-agents/installations/{installation_id}")
 
+    def assignments(self) -> list[AgentAssignment]:
+        response = self._client.get("/api/v1/security-agents/assignments").json()
+        return [AgentAssignment.model_validate(item) for item in response["items"]]
+
+    def create_assignment(self, **payload: Any) -> AgentAssignment:
+        response = self._client.post("/api/v1/security-agents/assignments", json=payload).json()
+        return AgentAssignment.model_validate(response)
+
+    def runs(self, *, limit: int = 100, offset: int = 0, include_archived: bool = False) -> list[AgentRun]:
+        params = {"limit": limit, "offset": offset, "include_archived": include_archived}
+        response = self._client.get("/api/v1/security-agents/runs", params=params).json()
+        return [AgentRun.model_validate(item) for item in response["items"]]
+
+    def run(self, run_id: uuid.UUID | str) -> AgentRun:
+        response = self._client.get(f"/api/v1/security-agents/runs/{run_id}").json()
+        return AgentRun.model_validate(response)
+
+    def run_report(self, run_id: uuid.UUID | str) -> AgentRunReport:
+        response = self._client.get(f"/api/v1/security-agents/runs/{run_id}/report").json()
+        return AgentRunReport.model_validate(response)
+
+    def archive_run(self, run_id: uuid.UUID | str) -> AgentRun:
+        response = self._client.post(f"/api/v1/security-agents/runs/{run_id}/archive").json()
+        return AgentRun.model_validate(response)
+
     def credentials(self) -> list[AgentCredential]:
         response = self._client.get("/api/v1/security-agents/credentials").json()
         return [AgentCredential.model_validate(item) for item in response["items"]]
@@ -136,14 +168,14 @@ class AsyncSecurityAgentsResource:
         return [CapabilityOperation.model_validate(item) for item in response["operations"]]
 
     async def installations(self, *, include_archived: bool = False) -> list[AgentInstallation]:
-        response = (
-            await self._client.get(
-                "/api/v1/security-agents/installations",
-                params={"include_archived": include_archived},
-            )
-        ).json()
+        params = {"include_archived": include_archived}
+        response = (await self._client.get("/api/v1/security-agents/installations", params=params)).json()
         return [AgentInstallation.model_validate(item) for item in response["items"]]
 
+    async def create_installation(self, **payload: Any) -> AgentInstallation:
+        response = (await self._client.post("/api/v1/security-agents/installations", json=payload)).json()
+        return AgentInstallation.model_validate(response)
+
     async def archive_installation(self, installation_id: uuid.UUID | str) -> AgentInstallation:
         response = await self._client.post(f"/api/v1/security-agents/installations/{installation_id}/archive")
         return AgentInstallation.model_validate(response.json())
@@ -151,6 +183,30 @@ class AsyncSecurityAgentsResource:
     async def delete_installation(self, installation_id: uuid.UUID | str) -> None:
         await self._client.delete(f"/api/v1/security-agents/installations/{installation_id}")
 
+    async def assignments(self) -> list[AgentAssignment]:
+        response = (await self._client.get("/api/v1/security-agents/assignments")).json()
+        return [AgentAssignment.model_validate(item) for item in response["items"]]
+
+    async def create_assignment(self, **payload: Any) -> AgentAssignment:
+        response = (await self._client.post("/api/v1/security-agents/assignments", json=payload)).json()
+        return AgentAssignment.model_validate(response)
+
+    async def runs(self, *, limit: int = 100, offset: int = 0, include_archived: bool = False) -> list[AgentRun]:
+        params = {"limit": limit, "offset": offset, "include_archived": include_archived}
+        response = (await self._client.get("/api/v1/security-agents/runs", params=params)).json()
+        return [AgentRun.model_validate(item) for item in response["items"]]
+
+    async def run(self, run_id: uuid.UUID | str) -> AgentRun:
+        return AgentRun.model_validate((await self._client.get(f"/api/v1/security-agents/runs/{run_id}")).json())
+
+    async def run_report(self, run_id: uuid.UUID | str) -> AgentRunReport:
+        response = (await self._client.get(f"/api/v1/security-agents/runs/{run_id}/report")).json()
+        return AgentRunReport.model_validate(response)
+
+    async def archive_run(self, run_id: uuid.UUID | str) -> AgentRun:
+        res = await self._client.post(f"/api/v1/security-agents/runs/{run_id}/archive")
+        return AgentRun.model_validate(res.json())
+
     async def credentials(self) -> list[AgentCredential]:
         response = (await self._client.get("/api/v1/security-agents/credentials")).json()
         return [AgentCredential.model_validate(item) for item in response["items"]]