Issue

Our CI/CD pipeline runs multiple panther_analysis_tool upload in sequence. The first upload succeeds, but subsequent uploads consistently fail with:

upload failed: {'statusCode': 400, 'headers': {}, 'multiValueHeaders': {}, 'body': 'another upload is in process, please try again later'}
Failed to upload to Panther: Exhausted retries attempting to perform bulk upload.

Why is this happening, and how do we fix it?

Resolution

1. Make sure you're on the latest version of PAT (pip install -U panther_analysis_tool).

2. Generate a Panther API token in the Panther Console. See Panther's docs on authenticating PAT with an API token.

3. Update your PAT commands to pass the API token:

panther_analysis_tool upload --path <path-to-your-detections> --api-token <your-api-token> --api-host https://api.<your-panther-instance-name>.runpanther.net/public/graphql

After switching, the "another upload is in process" errors typically disappear immediately.

Cause

This happens when the PAT command does not include an API token authentication. If PAT is authenticated with an API token, the regular upload command routes through Panther's asynchronous upload endpoint, which does not have this concurrency limitation.