Fix list_parsers() pagination (Issue #148)

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.27.2] - 2025-12-08
+### Updated
+- Parser list method to handle pagination properly
+  - Method auto paginates and returns all when no page size is provided.
+  - When page size is provided, method returns response with next page token.
+
 ## [0.27.1] - 2025-12-05
 ### Updated
 - Updated Chronicle client to expose API version param for following:

README.md

@@ -1221,13 +1221,20 @@ print(f"Parser ID: {parser_id}")
 Retrieve, list, copy, activate/deactivate, and delete parsers:
 
 ```python
-# List all parsers
+# List all parsers (returns complete list)
 parsers = chronicle.list_parsers()
 for parser in parsers:
     parser_id = parser.get("name", "").split("/")[-1]
     state = parser.get("state")
     print(f"Parser ID: {parser_id}, State: {state}")
 
+# Manual pagination: get raw API response with nextPageToken
+response = chronicle.list_parsers(page_size=50)
+parsers = response.get("parsers", [])
+next_token = response.get("nextPageToken")
+# Use next_token for subsequent calls:
+# response = chronicle.list_parsers(page_size=50, page_token=next_token)
+
 log_type = "WINDOWS_AD"
 
 # Get specific parser

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "secops"
-version = "0.27.1"
+version = "0.27.2"
 description = "Python SDK for wrapping the Google SecOps API for common use cases"
 readme = "README.md"
 requires-python = ">=3.7"

src/secops/chronicle/client.py

@@ -1870,20 +1870,26 @@ def get_parser(
     def list_parsers(
         self,
         log_type: str = "-",
-        page_size: int = 100,
-        page_token: str = None,
+        page_size: Optional[int] = None,
+        page_token: Optional[str] = None,
         filter: str = None,  # pylint: disable=redefined-builtin
-    ) -> List[Any]:
+    ) -> Union[List[Any], Dict[str, Any]]:
         """List parsers.
 
         Args:
             log_type: Log type to filter by
-            page_size: The maximum number of parsers to return
-            page_token: A page token, received from a previous ListParsers call
+            page_size: The maximum number of parsers to return per page.
+                If provided, returns raw API response with pagination info.
+                If None (default), auto-paginates and returns all parsers.
+            page_token: A page token, received from a previous ListParsers
+                call.
             filter: Optional filter expression
 
         Returns:
-            List of parser dictionaries
+            If page_size is None: List of all parsers
+                (auto-paginated)
+            If page_size is provided: List of parsers with next page token if
+                available.
 
         Raises:
             APIError: If the API request fails

src/secops/chronicle/parser.py

@@ -14,10 +14,10 @@
 #
 """Parser management functionality for Chronicle."""
 
-from typing import Dict, Any, List, Optional
-from secops.exceptions import APIError
 import base64
+from typing import Any, Dict, List, Optional, Union
 
+from secops.exceptions import APIError
 
 # Constants for size limits
 MAX_LOG_SIZE = 10 * 1024 * 1024  # 10MB per log
@@ -26,7 +26,9 @@
 
 
 def activate_parser(
-    client, log_type: str, id: str  # pylint: disable=redefined-builtin
+    client: "ChronicleClient",
+    log_type: str,
+    id: str,  # pylint: disable=redefined-builtin
 ) -> Dict[str, Any]:
     """Activate a custom parser.
 
@@ -42,8 +44,8 @@ def activate_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}:activate"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}:activate"
     )
     body = {}
     response = client.session.post(url, json=body)
@@ -55,7 +57,9 @@ def activate_parser(
 
 
 def activate_release_candidate_parser(
-    client, log_type: str, id: str  # pylint: disable=redefined-builtin
+    client: "ChronicleClient",
+    log_type: str,
+    id: str,  # pylint: disable=redefined-builtin
 ) -> Dict[str, Any]:
     """Activate the release candidate parser making it live for that customer.
 
@@ -71,8 +75,8 @@ def activate_release_candidate_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}:activateReleaseCandidateParser"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}:activateReleaseCandidateParser"
     )
     body = {}
     response = client.session.post(url, json=body)
@@ -84,7 +88,9 @@ def activate_release_candidate_parser(
 
 
 def copy_parser(
-    client, log_type: str, id: str  # pylint: disable=redefined-builtin
+    client: "ChronicleClient",
+    log_type: str,
+    id: str,  # pylint: disable=redefined-builtin
 ) -> Dict[str, Any]:
     """Makes a copy of a prebuilt parser.
 
@@ -100,8 +106,8 @@ def copy_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}:copy"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}:copy"
     )
     body = {}
     response = client.session.post(url, json=body)
@@ -113,7 +119,7 @@ def copy_parser(
 
 
 def create_parser(
-    client,
+    client: "ChronicleClient",
     log_type: str,
     parser_code: str,
     validated_on_empty_logs: bool = True,
@@ -148,7 +154,9 @@ def create_parser(
 
 
 def deactivate_parser(
-    client, log_type: str, id: str  # pylint: disable=redefined-builtin
+    client: "ChronicleClient",
+    log_type: str,
+    id: str,  # pylint: disable=redefined-builtin
 ) -> Dict[str, Any]:
     """Deactivate a custom parser.
 
@@ -164,8 +172,8 @@ def deactivate_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}:deactivate"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}:deactivate"
     )
     body = {}
     response = client.session.post(url, json=body)
@@ -177,7 +185,7 @@ def deactivate_parser(
 
 
 def delete_parser(
-    client,
+    client: "ChronicleClient",
     log_type: str,
     id: str,  # pylint: disable=redefined-builtin
     force: bool = False,
@@ -197,8 +205,8 @@ def delete_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}"
     )
     params = {"force": force}
     response = client.session.delete(url, params=params)
@@ -210,7 +218,9 @@ def delete_parser(
 
 
 def get_parser(
-    client, log_type: str, id: str  # pylint: disable=redefined-builtin
+    client: "ChronicleClient",
+    log_type: str,
+    id: str,  # pylint: disable=redefined-builtin
 ) -> Dict[str, Any]:
     """Get a Parser by ID.
 
@@ -226,8 +236,8 @@ def get_parser(
         APIError: If the API request fails
     """
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}"
-        f"/parsers/{id}"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}/parsers/{id}"
     )
     response = client.session.get(url)
 
@@ -238,23 +248,27 @@ def get_parser(
 
 
 def list_parsers(
-    client,
+    client: "ChronicleClient",
     log_type: str = "-",
-    page_size: int = 100,
-    page_token: str = None,
+    page_size: Optional[int] = None,
+    page_token: Optional[str] = None,
     filter: str = None,  # pylint: disable=redefined-builtin
-) -> List[Any]:
+) -> Union[List[Any], Dict[str, Any]]:
     """List parsers.
 
     Args:
         client: ChronicleClient instance
         log_type: Log type to filter by
-        page_size: The maximum number of parsers to return
-        page_token: A page token, received from a previous ListParsers call
+        page_size: The maximum number of parsers to return per page.
+            If provided, returns raw API response with pagination info.
+            If None (default), auto-paginates and returns all parsers.
+        page_token: A page token, received from a previous ListParsers call.
         filter: Optional filter expression
 
     Returns:
-        List of parser dictionaries
+        If page_size is None: List of all parsers.
+        If page_size is provided: List of parsers with next page token if
+            available.
 
     Raises:
         APIError: If the API request fails
@@ -268,11 +282,14 @@ def list_parsers(
             f"/logTypes/{log_type}/parsers"
         )
 
-        params = {
-            "pageSize": page_size,
-            "pageToken": page_token,
-            "filter": filter,
-        }
+        params = {}
+
+        if page_size:
+            params["pageSize"] = page_size
+        if page_token:
+            params["pageToken"] = page_token
+        if filter:
+            params["filter"] = filter
 
         response = client.session.get(url, params=params)
 
@@ -281,11 +298,14 @@ def list_parsers(
 
         data = response.json()
 
+        if page_size is not None:
+            return data
+
         if "parsers" in data:
             parsers.extend(data["parsers"])
 
-        if "next_page_token" in data:
-            params["pageToken"] = data["next_page_token"]
+        if "nextPageToken" in data:
+            page_token = data["nextPageToken"]
         else:
             more = False
 
@@ -379,7 +399,8 @@ def run_parser(
 
     # Build request
     url = (
-        f"{client.base_url}/{client.instance_id}/logTypes/{log_type}:runParser"
+        f"{client.base_url}/{client.instance_id}"
+        f"/logTypes/{log_type}:runParser"
     )
 
     parser = {

src/secops/cli/commands/parser.py

@@ -345,12 +345,12 @@ def handle_parser_run_command(args, chronicle):
         else:
             # If no parser code provided,
             # try to find an active parser for the log type
-            parsers = chronicle.list_parsers(
+            parser_list_response = chronicle.list_parsers(
                 args.log_type,
                 page_size=1,
-                page_token=None,
                 filter="STATE=ACTIVE",
             )
+            parsers = parser_list_response.get("parsers", [])
             if len(parsers) < 1:
                 raise SecOpsError(
                     "No parser file provided and an active parser could not "