# Static Analysis Report API — Get Spectra Core Results

> Retrieve Spectra Core static analysis reports for samples on Spectra Analyze. GET /api/v2/samples/{hash}/ticore/ endpoint with field selection.

## Retrieve [Spectra Core](/General/AnalysisAndClassification/SpectraCoreAnalysis) analysis results for a local sample

```
GET /api/v2/samples/{hash_value}/ticore/
```

Get the full Spectra Core static analysis report for the requested sample. The requested sample must be present on the appliance.

If the optional `fields` parameter is not provided in the request, all available parts of the static analysis report are returned in the response. With this parameter, users can select which parts of the report they want to receive in the response.

### Request Format

**Request Parameters**

| NAME       | REQUIRED | DESCRIPTION                                                  | TYPE          |
| :--------- | :------- | :----------------------------------------------------------- | :------------ |
| hash_value | Required | Hash of the sample for which the analysis report should be returned. The sample must be present on the appliance. Supported hash types are SHA1, SHA256, SHA512, MD5. | path, string  |
| fields     | Optional | Comma-separated list of report fields to include in the response. Supported values: `sha1, sha256, sha512, md5, imphash, info, application, protection, security, behaviour, certificate, document, mobile, media, web, email, strings, interesting_strings, classification, indicators, tags, attack, story, signatures, browser, software_package, malware` | query, string |

**Request Examples**

**cURL**

```bash
# Add --insecure before the URL if you are using a self-signed SSL certificate
curl -X GET 'https://appliance.example.com/api/v2/samples/988881adc9fc3655077dc2d4d757d480b5ea0e11/ticore/?fields=sha256,story,interesting_strings' \
  --header 'Authorization: Token exampletoken'
```

**Python**

```python

# Change the values of token and hash_value
token = "exampletoken"
hash_value = "examplehash"
# Change the host name in the URL and the fields to be included in the response
url = f"https://appliance.example.com/api/v2/samples/{hash_value}/ticore/?fields=sha256,story,interesting_strings"

headers = {
    "Authorization": f"Token {token}"
}

# Add verify=False in the request if you are using a self-signed SSL certificate
response = requests.get(url, headers=headers)
print(response.text)
```

### Response Format

**Response Examples**

```json
{
  "sha1": "988881adc9fc3655077dc2d4d757d480b5ea0e11",
  "sha256": "aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f",
  "sha512": "e79b8ad22b34a54be999f4eadde2ee895c208d4b3d83f1954b61...", # shortened for clarity
  "md5": "14758f1afd44c09b7992073ccf00b43d",
  "imphash": # for PE files only
  "info": {...},
  "application": {...},
  "protection": {...},
  "security": {...},
  "behaviour": {...},
  "certificate": {...},
  "signatures": {...},
  "document": {...},
  "mobile": {...},
  "media": {...},
  "web": {...},
  "email": {...},
  "strings": [...],
  "interesting_strings": [...],
  "classification": {...},
  "indicators": [...],
  "attack": [...],
  "tags": [...],
  "story": {...},
}
```

**Response Fields**

| FIELD NAME          | TYPE   | DESCRIPTION                                                  |
| :------------------ | :----- | :----------------------------------------------------------- |
| sha1                | string | SHA1 hash of the sample                                      |
| sha256              | string | SHA256 hash of the sample                                    |
| sha512              | string | SHA512 hash of the sample                                    |
| md5                 | string | MD5 hash of the sample                                       |
| imphash             | string | Import hash of the sample. Retrieved only for PE files       |
| info                | object | Information about file type, size, embedded files, and hashes computed for the sample |
| application         | object | If the sample is an application, contains information about its structure and capabilities |
| protection          | object | Detected protection features and mechanisms such as cryptographic or compression algorithms |
| security            | object | Detected security-related features, such as exploits         |
| behaviour           | object | Detected behavior properties of the sample                   |
| certificate         | object | Certificate-related information extracted from the sample, such as issuer, thumbprint, signature |
| signatures          | object | Signature-related information extracted from the sample, such as issuer, thumbprint, signature |
| document            | object | If the sample is a document, contains information about its structure and capabilities |
| mobile              | object | If the sample is a mobile application, contains information about its structure and capabilities |
| media               | object | If the sample is a multimedia file, such as an image, contains information about its properties |
| web                 | object | If the sample is a web application or browser addon, contains information about its structure and capabilities |
| email               | object | If the sample is an email message, contains information about its metadata |
| strings             | array  | Strings extracted from the sample                            |
| interesting_strings | array  | URI strings extracted from the sample                        |
| classification      | object | Sample status and source of classification                   |
| indicators          | array  | Detected actions that the sample is capable of performing, and their descriptions |
| attack              | array  | Spectra Core indicators mapped to MITRE threat IDs and techniques |
| tags                | array  | Labels automatically generated by Spectra Core during analysis based on the sample’s metadata properties (“ticore”) or added by the users on the appliance (“user”) |
| story               | string | Natural language file behavior description                   |
| browser             | object | Browser-related data                                         |
| software_package    | object | Software package data                                        |
| malware             | object | Malware-related data                                         |

**Response Status Codes**

| CODE | DESCRIPTION |
| :--- | :---------- |
| 200  | OK          |
| 403  | Forbidden   |
| 404  | Not found   |
