# Containers API — Spectra Analyze

> Retrieve top-level container files from which requested samples were extracted during Spectra Analyze static analysis, supporting bulk hash lookups.

## List containers for every requested hash

```
POST /api/samples/containers/
```

Get a list of all top-level containers from which the requested sample has been extracted during analysis.

This is a bulk API, meaning that a single request can be used to simultaneously query containers for multiple file hashes. If a requested hash doesn’t have a container, it will not be included in the response.

### Request Format

**Request Parameters**

| NAME        | REQUIRED | DESCRIPTION                                                  | TYPE   |
| :---------- | :------- | :----------------------------------------------------------- | :----- |
| hash_values | Required | A list of one or more hash values for which to retrieve the top-level container hashes. The hashes in the request can be SHA1, SHA256, or MD5, but must all be of the same type. | string |

**Request Examples**

**cURL**

```bash
# Add --insecure before the URL if you are using a self-signed SSL certificate
curl -X POST 'https://appliance.example.com/api/samples/containers/' \
  --header 'Authorization: Token exampletoken' \
  --header 'Content-Type: application/json' \
  --data '{"hash_values":["9dc5e23c7ab2692b83f0690a736b123a1837ae56", "4b21a49eadac1bc01477eff778041fdb765b8139"]}'
```

**Python**

```python

# Change the token
token = "exampletoken"
# Change the hostname in the URL
url = "https://appliance.example.com/api/samples/containers/"

json = {
        "hash_values": ["examplehash1", "examplehash2"]
}

headers = {'Authorization': f'Token {token}'}

# Add verify=False in the request if you are using a self-signed SSL certificate
response = requests.post(url, headers=headers, json=json)
print(response.text)
```

### Response Format

**Response Examples**

```json
{
    "count": 1,
    "next": null,
    "previous": null,
    "results": [
        {
            "sha1": "68f04f6ecbf628029e4e0061392029edec2b0e43",
            "sha256": "cb7421b5c6af74c3159c361f3bb78bba8a488d8979d1250e106fa96cbf928789",
            "sha512": "689e93297dca84a0d63d7934d3fd233b7c90e5270693564e7ac2fe2c6b6a60d40e082446d7ec1aa04c4f954f5fff130eae2f0407e915a109fc854afbea902aac",
            "md5": "1021657335ba4838db07f5231723df3b",
            "containers": [
                "b3af773210970296f69733eba53e88d2bd449630",
                "ffaf7dfd50471b28b7e8533ea866ec06066a3c80",
                "1005def47073d5b7b19c99a8bd0cff153d0626aa",
                "c6a9457236ce673cecfdaa3b01f4dbf79a1e3b75",
                "997af5d888b8e95d985eafc36d8abb7269ddae51"
            ]
        }
    ]
}
```

**Response Fields**

| FIELD NAME | DESCRIPTION                                                  |
| :--------- | :----------------------------------------------------------- |
| count      | The number of hashes with results. Hashes without results are not included in the response. |
| results    | The list of results: for every hash with top-level containers, every object contains the `sha1`, `sha25`, `sha512` and `md5` hashes of the requested sample, and a list of container hashes inside the `containers` object |

**Response Status Codes**

| CODE | DESCRIPTION |
| :--- | :---------- |
| 200  | OK          |
| 400  | Bad Request |
| 404  | Not Found   |
