---
title: "Search samples"
method: GET
path: "/search"
---

# Search samples

`GET /search`

Search sandbox analyses by hash, malware family, tag, or network indicator.

## Query parameters

- `query` string, required
- `limit` integer
- `offset` string

## Response `200`

Paginated search results.

- object
  - `data` SampleSummary[]
    - `id` string — Sample ID (e.g., 251219-tg9s9sfwst)
    - `status` 'pending' | 'running' | 'static_analysis' | 'reported' | 'failed' — Current processing status
    - `kind` 'file' | 'url' — Submission type
    - `filename` string — Original filename (file submissions only)
    - `url` string — Submitted URL (URL submissions only)
    - `submitted` string, date-time — ISO 8601 submission timestamp
    - `completed` string, date-time — ISO 8601 completion timestamp (only present when analysis is done)
    - `sha256` string — SHA-256 hash of the submitted file (file submissions only)
  - `next` string — Opaque cursor for the next page. Pass as the `offset` query parameter.

## Other responses

- `400` — Invalid query syntax.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)