The library that lived here was written by Fredrik Lundh and ended up in the Python standard library. You do not need to download anything.
xmlrpc.client and xmlrpc.server. On Python 2 it was xmlrpclib and SimpleXMLRPCServer. That rename is the only change most old code needs.from xmlrpc.client import ServerProxy
server = ServerProxy("https://example.com/rpc")
print(server.add(2, 3))
print(server.system.listMethods())Method calls on the proxy become remote calls. system.listMethods is a convention most servers support and the quickest way to see what is available.
from xmlrpc.server import SimpleXMLRPCServer
def add(a, b):
return a + b
server = SimpleXMLRPCServer(("localhost", 8000))
server.register_function(add)
server.register_introspection_functions()
server.serve_forever()Integers, floats, booleans, strings, dates, binary data, lists and dictionaries with string keys. That is the whole type system. No None unless both ends enable allow_none, and no custom classes.
XML parsing has a long history of denial of service attacks: entity expansion, deeply nested documents, external entity references. The standard library documentation says plainly that its XML modules are not secure against maliciously constructed data.
If you accept XML-RPC from anywhere untrusted, install defusedxml and use its hardened parser, run the service behind authentication, and set a request size limit. If the data is trusted and internal, the standard module is fine.
For a new project, usually not. A JSON API over HTTP is easier to debug, easier to call from a browser, and supported by every language without a library. XML-RPC is worth keeping when you are talking to something that already speaks it, and there is plenty of that about: Supervisor, older wiki and blog software, some scientific instruments and build systems.
Its virtue is that it is finished. The specification is short, it has not changed since 1999, and a client written twenty years ago still works.