Sessions
Get Session PCAP
Returns raw PCAP bytes for a single session. The response is a binary PCAP file suitable for analysis with tools like Wireshark.
get/v3/sessions/{session_id}/frames
Path parameters
session_idstring required
The unique session identifier.
Query parameters
scope'workspace' | 'demo'
Controls the data scope for the query.
- workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
- demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
Response
PCAP file for the requested session.