Get API key details
ReadRead the key's authorization level and limits.
Permissions and limits
Account permissions
- A Hybrid Analysis API key (restricted keys can search; submissions need a default key)
Look up file hashes and sandbox reports, search the Hybrid Analysis database, and submit URLs for sandbox runs or quick scans.
Explore 12 workflow actions for Hybrid Analysis, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Read the key's authorization level and limits.
Read everything known about a file hash: verdict, threat score, family, tags, scanners and reports.
Read a file hash's verdict, threat score and scan dates.
Read a quick scan's results once its scanners finish.
Read a submission's state: IN_QUEUE, IN_PROGRESS, SUCCESS or ERROR.
Read a sandbox report: verdict, threat score, hashes, hosts, domains, signatures and more.
Read summaries of the last 250 public reports from the past day.
List the sandbox environments and their IDs.
Check a URL with reputation lookups and scanners; if not finished, check it with Get quick scan.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Turn an MD5, SHA1, SHA256 or SHA512 into SHA256s and their sandbox reports.
Search sandbox reports by file name or type, verdict, family, tag, host, domain, URL, date and more.
Run a URL in a sandbox environment; check it with Get report state.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in Hybrid Analysis. A saved workflow is not a completed provider action.