# Full Report API — Retrieve Complete Analysis Reports

> Get complete analysis reports for samples on Spectra Analyze. POST /api/samples/v2/list/details/ returns static, dynamic, and cloud results.

## Retrieve a detailed analysis report for local samples

```
POST /api/samples/v2/list/details/
```

Retrieve all or selected parts of the analysis report - including static, dynamic, and cloud analysis results - for one or more samples in a single request, instead of having to send requests to multiple endpoints. Report parts that can be requested correspond to sidebar sections on the [Sample Details](..//Sample%20Details/index.md) page.

Sample hashes must be provided using the `hash_values` parameter in the request. The samples must be present on the Spectra Analyze appliance. Response speeds are highly variable based on the information available for each requested file.

The optional `fields` parameter can be included in the request to specify which parts of the report should be returned in the response. When this parameter is not provided in the request, all available report fields for the requested sample(s) are returned in the response.

If no data is available for a requested field, it is included in the response as an empty field.

### Request Format

**Request Parameters**

| NAME                              | REQUIRED | DESCRIPTION                                                  | TYPE                        |
| :-------------------------------- | :------- | :----------------------------------------------------------- | :-------------------------- |
| hash_values                       | Required | One or more hashes of samples for which the analysis report should be returned. The samples must be present on the appliance. Supported hash types are SHA1, SHA256, SHA512, MD5. All hashes in a request must be of the same type. | array                       |
| fields                            | Optional | Comma-separated list of additional report fields to include in the response. The default response contains this set of default fields:`rl_auxiliary_analysis, av_scanners, av_scanners_summary, cape, cisco_secure_malware_analytics, cuckoo, discussion, joe, fireeye, rl_cloud_sandbox, sources, sample_summary, ticore, tags, ticloud, vmray_tcbase` Additional supported values: `id, sha1, sha256, sha512, md5, category, file_type, file_subtype, identification_name, identification_version, file_size, extracted_file_count, local_first_seen, local_last_seen, classification_origin, classification_reason, classification_source, classification, riskscore, classification_result, ticore, tags, summary, discussion, ticloud, aliases, proposed_filename, networkthreatintelligence, domainthreatintelligence, av_scanners, av_scanners_summary` Network and domain threat intelligence results won’t be applied unless the parameter `include_networkthreatintelligence` is set to true. | array                       |
| include_networkthreatintelligence | Optional | Include or exclude network or domain threat intelligence. If this is set to true, parameters `networkthreatintelligence` and `domainthreatintelligence` have to be included in the `fields` parameter. Applies only to URLs, not files. | boolean (but inside quotes) |
| skip_reanalysis                   | Optional | Whether to reanalyze a file when fetching its report. False by default (if omitted, files will be reanalyzed when their reports are fetched). | boolean (but inside quotes) |

**Request Examples**

**cURL**

```bash
# Add --insecure before the URL if you are using a self-signed SSL certificate
curl -X POST 'https://appliance.example.com/api/samples/v2/list/details/' \
  --header 'Authorization: Token exampletoken' \
  --header 'Content-Type: application/json' \
  --data '{"hash_values":["6cadcefb80b7e757323aa46fba909d72"], "fields": ["classification_result", "sources", "av_scanners_summary"]}'
```

**Python**

```python

# Change the token
token = "exampletoken"
# Change the hostname in the URL
url = f"https://appliance.example.com/api/samples/v2/list/details/"

json = {
        "hash_values": ["examplehash1", "examplehash2"],
        "fields": ["sha256", "extracted_file_count"]
}

headers = {'Authorization': f'Token {token}'}

# Add verify=False in the request if you are using a self-signed SSL certificate
response = requests.post(url, headers=headers, json=json)
print(response.text)
```

### Response Format

**Response Examples**

```json
{
   "count": 1,
   "next": null,
   "previous": null,
   "results": [
      {
            "av_scanners_summary": {
               "scanner_count": 38,
               "scanner_match": 36,
               "scanner_percent": 94.73684210526315
            },
            "sources": {
               "ticloud_sources": { },
               "other_sources": []
            },
            "classification_result": "Win32.Backdoor.Prorat"
      }
   ]
}
```

**Response Fields**

| FIELD NAME                     | DESCRIPTION                                                  |
| :----------------------------- | :----------------------------------------------------------- |
| ticore                         | Corresponds to the `ticore` object from the [Spectra Core Report API](./static-analysis-report-api.md) |
| ticloud                        | Corresponds to the `cloud` object from the [Summary Report API](./report-summary-api.md) |
| rl_cloud_sandbox               | Contains dynamic analysis results from ReversingLabs Cloud Sandbox according to the integration configuration on the appliance |
| rl_auxiliary_analysis          | Contains dynamic analysis results from the RL Auxiliary Analysis service |
| joe                            | Contains dynamic analysis results from Joe Sandbox according to the integration configuration on the appliance |
| cisco_secure_malware_analytics | Contains dynamic analysis results from Cisco Secure Malware Analytics according to the integration configuration on the appliance |
| cuckoo                         | Contains dynamic analysis results from Cuckoo according to the integration configuration on the appliance |
| fireeye                        | Contains dynamic analysis results from FireEye according to the integration configuration on the appliance |
| cape                           | Contains dynamic analysis results from CAPE according to the integration configuration on the appliance |
| vmray_tcbase                   | Contains dynamic analysis results from VMRay according to the integration configuration on the appliance |
| sources                        | Groups sources of the file in the ReversingLabs system (Spectra Intelligence sources, external, other) |
| av_scanners                    | Lists detailed results from every AV scanner that scanned the file |
| sample_summary                 | Combines the default response and the `summary` object of the [Summary Report API](./report-summary-api.md) with the `aliases` field to return a more complete summary report |
| av_scanners_summary            | Lists the total number of AV scanners used to scan the file; the number and the percentage of AV scanners out of the total that matched the sample |
| tags                           | Lists labels automatically generated by [Spectra Core](/General/AnalysisAndClassification/SpectraCoreAnalysis) during analysis based on the sample’s metadata properties (“ticore”) or added by the users on the appliance (“user”) |
| discussion                     | Contains comments attached to the requested sample(s), if there are any |
| networkthreatintelligence      | Only for URLs                                                |
| domainthreatintelligence       | Only for URLs                                                |

**Response Status Codes**

| CODE | DESCRIPTION                                                  |
| :--- | :----------------------------------------------------------- |
| 200  | Returned on successful requests. Also returned for samples that don’t exist on the appliance, and for empty report fields. |
| 400  | Malformed hash or invalid field name.                        |
| 403  | Authentication credentials were not provided. / Invalid token. |
| 404  | Malformed endpoint.                                          |
