# Demisto

**Canonical:** https://apis.io/providers/demisto/  
**Website:** https://www.demisto.com  
**APIs profiled:** 24

Demisto is a Security Orchestration, Automation, and Response (SOAR) platform that unifies incident case management, playbook-driven automation, real-time analyst collaboration (the "War Room"), and threat-intelligence management. Founded as an independent security startup backed by Accel and Greylock, Demisto was acquired by Palo Alto Networks in 2019 for roughly $560M and rebranded as Cortex XSOAR; the demisto.com domain now redirects to the Cortex XSOAR product. The Demisto REST API exposes incidents, war-room entries, evidence, threat indicators, and automation scripts programmatically, with a Swagger 2.0 specification, an official Python client (demisto-py), and a content-development SDK/CLI (demisto-sdk). This API Evangelist profile was enriched from the provider's public developer surface (xsoar.pan.dev, docs-cortex.paloaltonetworks.com, and the github.com/demisto organization).

## Kin Score — 38.3 / 100 (thin)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 38.3).

| Facet | Score |
|---|---|
| Discoverability | 81.5 |
| Contract Quality | 47.4 |
| Governance | 16.7 |
| Contract Governance | 16.7 |
| Operational Transparency | 42.1 |
| Developer Ergonomics | 54.2 |
| Commercial Clarity | 0.0 |
| Access Clarity | 0.0 |

## Agent readiness — 30.6 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | documented |
| OpenAPI Examples | no |
| Rate Limit Signal | no |
| Event Surface Described | no |
| Agent Skills | derived |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Self-serve signup — onboarding: self-serve, pricing: unknown, trial: no (confidence: medium).

## APIs (24)

- **Demisto Apikeys API** — The Apikeys API from Demisto — 1 operation(s) for apikeys.
- **Demisto Automation API** — The Automation API from Demisto — 5 operation(s) for automation.
- **Demisto Classifier API** — The Classifier API from Demisto — 1 operation(s) for classifier.
- **Demisto Contentpacks API** — The Contentpacks API from Demisto — 1 operation(s) for contentpacks.
- **Demisto Dashboards API** — The Dashboards API from Demisto — 1 operation(s) for dashboards.
- **Demisto Entry API** — The Entry API from Demisto — 8 operation(s) for entry.
- **Demisto Evidence API** — The Evidence API from Demisto — 3 operation(s) for evidence.
- **Demisto Incident API** — The Incident API from Demisto — 8 operation(s) for incident.
- **Demisto Incidentfields API** — The Incidentfields API from Demisto — 2 operation(s) for incidentfields.
- **Demisto Incidents API** — The Incidents API from Demisto — 1 operation(s) for incidents.
- **Demisto Incidenttype API** — The Incidenttype API from Demisto — 1 operation(s) for incidenttype.
- **Demisto Incidenttypes API** — The Incidenttypes API from Demisto — 1 operation(s) for incidenttypes.
- **Demisto Indicator API** — The Indicator API from Demisto — 3 operation(s) for indicator.
- **Demisto Indicators API** — The Indicators API from Demisto — 8 operation(s) for indicators.
- **Demisto Inv Playbook API** — The Inv Playbook API from Demisto — 11 operation(s) for inv playbook.
- **Demisto Investigations API** — The Investigations API from Demisto — 1 operation(s) for investigations.
- **Demisto Layouts API** — The Layouts API from Demisto — 1 operation(s) for layouts.
- **Demisto Playbook API** — The Playbook API from Demisto — 1 operation(s) for playbook.
- **Demisto Report API** — The Report API from Demisto — 1 operation(s) for report.
- **Demisto Reports API** — The Reports API from Demisto — 4 operation(s) for reports.
- **Demisto Reputation API** — The Reputation API from Demisto — 1 operation(s) for reputation.
- **Demisto Settings API** — The Settings API from Demisto — 3 operation(s) for settings.
- **Demisto Statistics API** — The Statistics API from Demisto — 2 operation(s) for statistics.
- **Demisto Widgets API** — The Widgets API from Demisto — 3 operation(s) for widgets.

## MCP servers (1)

- **Demisto MCP Server**

## Agentic access (1)

- **Demisto Agentic Access** — 75 operations · 63 acting · 2 human-in-the-loop

## Security (2)

- **Demisto Authentication** — apiKey · 3 schemes
- **Demisto Domain Security** — TLSv1.3 · HSTS · DMARC

## Tags

Company, Security, SOAR, Incident Response, Threat Intelligence, Security Automation

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/demisto/). Scores are computed from the provider's own public artifacts under a published rubric.