zscaler-sdk-python 1.9.10__tar.gz → 1.9.11__tar.gz

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.9.10
+Version: 1.9.11
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -20,17 +20,19 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Provides-Extra: dev
+Requires-Dist: PyJWT (>=2.10.1)
 Requires-Dist: aenum (>=3.1.11)
 Requires-Dist: arrow (>=1.3.0)
 Requires-Dist: cryptography (>=45.0.2)
 Requires-Dist: flatdict (>=4.0.0)
+Requires-Dist: jwcrypto (>=1.5.6)
 Requires-Dist: pydash (>=8.0.3)
 Requires-Dist: python-box (>=7.3.0)
 Requires-Dist: python-dateutil (>=2.9.0)
-Requires-Dist: python-jose[cryptography] (>=3.5.0)
 Requires-Dist: pytz (>=2024.2)
 Requires-Dist: pyyaml (>=6.0.0)
 Requires-Dist: requests (>=2.32.3)
+Requires-Dist: urllib3 (>=2.6.0)
 Project-URL: Bug Tracker, https://github.com/zscaler/zscaler-sdk-python/issues
 Project-URL: Documentation, https://zscaler-sdk-python.readthedocs.io
 Project-URL: Repository, https://github.com/zscaler/zscaler-sdk-python

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.9.10"
+version = "1.9.11"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"
@@ -30,13 +30,15 @@ packages = [
 [tool.poetry.dependencies]
 python = ">=3.9.2,<4.0"
 requests = ">=2.32.3"
+urllib3 = ">=2.6.0"
 cryptography = ">=45.0.2"
 pyyaml = ">=6.0.0"
 pytz = ">=2024.2"
 python-box = ">=7.3.0"
 python-dateutil = ">=2.9.0"
 flatdict = ">=4.0.0"
-python-jose = {extras = ["cryptography"], version = ">=3.5.0"}
+PyJWT = ">=2.10.1"
+jwcrypto = ">=1.5.6"
 aenum = ">=3.1.11"
 pydash = ">=8.0.3"
 arrow = ">=1.3.0"
@@ -50,7 +52,7 @@ pytest-mock = ">=3.12.0"
 pytest-asyncio = ">=0.23.0"
 pytest-cov = ">=6.2.1"
 pytest-recording = ">=0.13.1"
-vcrpy = ">=7.0.0"  # Requires 7.0+ for urllib3 2.x support on Python 3.10+
+vcrpy = {version = ">=8.1.0", python = ">=3.10"}
 pyfakefs = ">=5.7.0"
 responses = ">=0.25.7"
 sphinx = ">=7.2.0"
@@ -59,7 +61,7 @@ sphinx_rtd_theme = ">=1.3.0"
 wheel = ">=0.42.0"
 
 [tool.poetry.extras]
-dev = ["black", "pytest", "pytest-asyncio", "pytest-mock", "pytest-recording", "pytest-cov", "pyfakefs", "vcrpy", "isort", "wheel"]
+dev = ["black", "pytest", "pytest-asyncio", "pytest-mock", "pytest-recording", "pytest-cov", "pyfakefs", "isort", "wheel"]
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.9.10"
+__version__ = "1.9.11"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/oneapi_oauth_client.py

@@ -3,11 +3,15 @@ import logging
 import json
 import os
 import requests
-from jose import jwt
 import time
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
+
+# JWT handling - using PyJWT instead of python-jose to avoid ecdsa dependency (CVE-2024-23342)
+import jwt as pyjwt
+from jwcrypto.jwk import JWK
+
 from zscaler.user_agent import UserAgent
 from zscaler.oneapi_http_client import HTTPClient
 from zscaler.errors.response_checker import check_response_for_error
@@ -335,9 +339,15 @@ class OAuth:
         private_key_obj: Union[rsa.RSAPrivateKey, Any]
         if private_key.strip().startswith("{"):
             # **JWK JSON Format**
+            # Using jwcrypto instead of python-jose to avoid ecdsa dependency (CVE-2024-23342)
             logging.info("Using JWK JSON format for private key.")
             jwk_key: Dict[str, Any] = json.loads(private_key.strip())  # Convert JWK string to dict
-            private_key_obj = jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk_key))
+            # Convert JWK to PEM using jwcrypto, then load with cryptography
+            jwk_obj = JWK.from_json(json.dumps(jwk_key))
+            pem_bytes = jwk_obj.export_to_pem(private_key=True, password=None)
+            private_key_obj = serialization.load_pem_private_key(
+                pem_bytes, password=None, backend=default_backend()
+            )
 
         elif "BEGIN PRIVATE KEY" in private_key:
             # **Raw PEM Private Key**
@@ -365,7 +375,8 @@ class OAuth:
         }
 
         # **Generate the JWT assertion using the private key**
-        assertion: str = jwt.encode(payload, private_key_obj, algorithm="RS256")
+        # Using PyJWT instead of python-jose to avoid ecdsa dependency (CVE-2024-23342)
+        assertion: str = pyjwt.encode(payload, private_key_obj, algorithm="RS256")
 
         # **Step 3: Prepare OAuth Request**
         form_data: Dict[str, str] = {

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/cyber_security.py

@@ -14,11 +14,12 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class CyberSecurityAPI(APIClient):
@@ -37,6 +38,30 @@ class CyberSecurityAPI(APIClient):
         super().__init__()
         self._request_executor = request_executor
 
+    def _extract_graphql_response(
+        self,
+        response,
+        api_url: str,
+        domain: str,
+        field: str,
+    ) -> Tuple[Optional[List[Dict[str, Any]]], Any, Optional[Exception]]:
+        """Extract data from GraphQL response and handle errors."""
+        try:
+            body = response.get_body() if response else {}
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+            data = body.get("data", {}) if isinstance(body, dict) else {}
+            entries = data.get(domain, {}).get(field, {}).get("entries", [])
+            return (entries, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
     def get_incidents(
         self,
         start_time: int,
@@ -124,14 +149,7 @@ class CyberSecurityAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("CYBER_SECURITY", {}).get("incidents", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "CYBER_SECURITY", "incidents")
 
     def get_incidents_by_location(
         self,
@@ -210,11 +228,4 @@ class CyberSecurityAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("CYBER_SECURITY", {}).get("cyber_security_location", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "CYBER_SECURITY", "cyber_security_location")

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/firewall.py

@@ -14,12 +14,13 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
 from zscaler.zinsights.models.inputs import FirewallEntriesFilterBy, FirewallEntryOrderBy
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class FirewallAPI(APIClient):
@@ -38,6 +39,30 @@ class FirewallAPI(APIClient):
         super().__init__()
         self._request_executor = request_executor
 
+    def _extract_graphql_response(
+        self,
+        response,
+        api_url: str,
+        domain: str,
+        field: str,
+    ) -> Tuple[Optional[List[Dict[str, Any]]], Any, Optional[Exception]]:
+        """Extract data from GraphQL response and handle errors."""
+        try:
+            body = response.get_body() if response else {}
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+            data = body.get("data", {}) if isinstance(body, dict) else {}
+            entries = data.get(domain, {}).get(field, {}).get("entries", [])
+            return (entries, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
     def get_traffic_by_action(
         self,
         start_time: int,
@@ -108,14 +133,7 @@ class FirewallAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("ZERO_TRUST_FIREWALL", {}).get("action", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "ZERO_TRUST_FIREWALL", "action")
 
     def get_traffic_by_location(
         self,
@@ -209,14 +227,7 @@ class FirewallAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("ZERO_TRUST_FIREWALL", {}).get("location_firewall", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "ZERO_TRUST_FIREWALL", "location_firewall")
 
     def get_network_services(
         self,
@@ -281,11 +292,4 @@ class FirewallAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("ZERO_TRUST_FIREWALL", {}).get("network_service", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "ZERO_TRUST_FIREWALL", "network_service")

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/iot.py

@@ -14,12 +14,13 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
 from zscaler.zinsights.models.inputs import IoTDeviceFilterBy, IoTDeviceOrderBy
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class IotAPI(APIClient):
@@ -127,6 +128,17 @@ class IotAPI(APIClient):
 
         try:
             body = response.get_body() if response else {}
+
+            # Check for GraphQL errors in the response
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+
             # GraphQL responses have data wrapped in "data" key
             data = body.get("data", {}) if isinstance(body, dict) else {}
             device_stats = data.get("IOT", {}).get("device_stats", {})

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/models/common.py

@@ -271,46 +271,6 @@ class FirewallReportEntry(ZscalerObject):
         return parent_req_format
 
 
-class RiskScoreEvent(ZscalerObject):
-    """
-    A risk score event entry.
-
-    Attributes:
-        time_stamp: The timestamp in epoch milliseconds.
-        threats_blocked_count: Number of threats blocked.
-        suspicious_activity_count: Number of suspicious activities.
-        active_infection_count: Number of active infections.
-        score: The calculated risk score.
-    """
-
-    def __init__(self, config: Optional[Dict[str, Any]] = None) -> None:
-        super().__init__(config)
-        if config:
-            self.time_stamp: Optional[int] = config.get("time_stamp")
-            self.threats_blocked_count: Optional[int] = config.get("threats_blocked_count")
-            self.suspicious_activity_count: Optional[int] = config.get("suspicious_activity_count")
-            self.active_infection_count: Optional[int] = config.get("active_infection_count")
-            self.score: Optional[int] = config.get("score")
-        else:
-            self.time_stamp = None
-            self.threats_blocked_count = None
-            self.suspicious_activity_count = None
-            self.active_infection_count = None
-            self.score = None
-
-    def request_format(self) -> Dict[str, Any]:
-        parent_req_format = super().request_format()
-        current_obj_format = {
-            "time_stamp": self.time_stamp,
-            "threats_blocked_count": self.threats_blocked_count,
-            "suspicious_activity_count": self.suspicious_activity_count,
-            "active_infection_count": self.active_infection_count,
-            "score": self.score,
-        }
-        parent_req_format.update(current_obj_format)
-        return parent_req_format
-
-
 # Export all common types
 __all__ = [
     "WebReportEntry",
@@ -321,5 +281,4 @@ __all__ = [
     "IoTDeviceStat",
     "ShadowITApp",
     "FirewallReportEntry",
-    "RiskScoreEvent",
 ]

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/saas_security.py

@@ -14,12 +14,13 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
 from zscaler.zinsights.models.inputs import CasbEntriesFilterBy, CasbEntryOrderBy
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class SaasSecurityAPI(APIClient):
@@ -36,6 +37,30 @@ class SaasSecurityAPI(APIClient):
         super().__init__()
         self._request_executor = request_executor
 
+    def _extract_graphql_response(
+        self,
+        response,
+        api_url: str,
+        domain: str,
+        field: str,
+    ) -> Tuple[Optional[List[Dict[str, Any]]], Any, Optional[Exception]]:
+        """Extract data from GraphQL response and handle errors."""
+        try:
+            body = response.get_body() if response else {}
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+            data = body.get("data", {}) if isinstance(body, dict) else {}
+            entries = data.get(domain, {}).get(field, {}).get("entries", [])
+            return (entries, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
     def get_casb_app_report(
         self,
         start_time: int,
@@ -116,11 +141,4 @@ class SaasSecurityAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("SAAS_SECURITY", {}).get("casb_app", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "SAAS_SECURITY", "casb_app")

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/shadow_it.py

@@ -14,12 +14,13 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
 from zscaler.zinsights.models.inputs import ShadowITAppsFilterBy, ShadowITAppsOrderBy
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class ShadowItAPI(APIClient):
@@ -36,6 +37,30 @@ class ShadowItAPI(APIClient):
         super().__init__()
         self._request_executor = request_executor
 
+    def _extract_graphql_response(
+        self,
+        response,
+        api_url: str,
+        domain: str,
+        field: str,
+    ) -> Tuple[Optional[List[Dict[str, Any]]], Any, Optional[Exception]]:
+        """Extract data from GraphQL response and handle errors."""
+        try:
+            body = response.get_body() if response else {}
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+            data = body.get("data", {}) if isinstance(body, dict) else {}
+            entries = data.get(domain, {}).get(field, {}).get("entries", [])
+            return (entries, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
     def get_apps(
         self,
         start_time: int,
@@ -147,14 +172,7 @@ class ShadowItAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            # GraphQL responses have data wrapped in "data" key
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("SHADOW_IT", {}).get("apps", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "SHADOW_IT", "apps")
 
     def get_shadow_it_summary(
         self,
@@ -307,6 +325,17 @@ class ShadowItAPI(APIClient):
 
         try:
             body = response.get_body() if response else {}
+
+            # Check for GraphQL errors in the response
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+
             # GraphQL responses have data wrapped in "data" key
             data = body.get("data", {}) if isinstance(body, dict) else {}
             summary = data.get("SHADOW_IT", {}).get("shadow_it_summary", {})

{zscaler_sdk_python-1.9.10 → zscaler_sdk_python-1.9.11}/zscaler/zinsights/web_traffic.py

@@ -14,12 +14,13 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 """
 
-from typing import Optional, List
+from typing import Optional, List, Tuple, Any, Dict
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.utils import format_url
 from zscaler.zinsights.models.inputs import WebEntriesFilterBy, WebOrderBy
+from zscaler.errors.graphql_error import is_graphql_error_response, GraphQLAPIError
 
 
 class WebTrafficAPI(APIClient):
@@ -39,6 +40,45 @@ class WebTrafficAPI(APIClient):
         super().__init__()
         self._request_executor = request_executor
 
+    def _extract_graphql_response(
+        self,
+        response,
+        api_url: str,
+        domain: str,
+        field: str,
+    ) -> Tuple[Optional[List[Dict[str, Any]]], Any, Optional[Exception]]:
+        """
+        Extract data from GraphQL response and handle errors.
+
+        Args:
+            response: The HTTP response object
+            api_url: The API URL for error reporting
+            domain: The GraphQL domain (e.g., "WEB_TRAFFIC")
+            field: The field to extract (e.g., "location", "protocols")
+
+        Returns:
+            Tuple of (entries, response, error)
+        """
+        try:
+            body = response.get_body() if response else {}
+
+            # Check for GraphQL errors in the response
+            if is_graphql_error_response(body):
+                error = GraphQLAPIError(
+                    url=api_url,
+                    response_details=response._response,
+                    response_body=body,
+                    service_type="zins"
+                )
+                return (None, response, error)
+
+            # Extract the data
+            data = body.get("data", {}) if isinstance(body, dict) else {}
+            entries = data.get(domain, {}).get(field, {}).get("entries", [])
+            return (entries, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
     def get_traffic_by_location(
         self,
         start_time: int,
@@ -140,13 +180,7 @@ class WebTrafficAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("WEB_TRAFFIC", {}).get("location", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "WEB_TRAFFIC", "location")
 
     def get_no_grouping(
         self,
@@ -241,13 +275,7 @@ class WebTrafficAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("WEB_TRAFFIC", {}).get("no_grouping", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "WEB_TRAFFIC", "no_grouping")
 
     def get_protocols(
         self,
@@ -315,13 +343,7 @@ class WebTrafficAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("WEB_TRAFFIC", {}).get("protocols", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "WEB_TRAFFIC", "protocols")
 
     def get_threat_super_categories(
         self,
@@ -391,13 +413,7 @@ class WebTrafficAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("WEB_TRAFFIC", {}).get("threat_super_categories", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "WEB_TRAFFIC", "threat_super_categories")
 
     def get_threat_class(
         self,
@@ -467,10 +483,4 @@ class WebTrafficAPI(APIClient):
         if error:
             return (None, response, error)
 
-        try:
-            body = response.get_body() if response else {}
-            data = body.get("data", {}) if isinstance(body, dict) else {}
-            entries = data.get("WEB_TRAFFIC", {}).get("threat_class", {}).get("entries", [])
-            return (entries, response, None)
-        except Exception as ex:
-            return (None, response, ex)
+        return self._extract_graphql_response(response, api_url, "WEB_TRAFFIC", "threat_class")