What this endpoint does

Creates a reusable analysis profile for your sandbox organization. Profiles define the execution environment for malware analysis — OS, locale, network routing, timeout, and browser preference. Use Sandbox: List Resources to discover valid OS tags (e.g., os:windows10-2004-x64) and locale tags. Network mode controls how the sample communicates: internet for direct connectivity, tor for anonymized routing, vpn with a geolocation tag for region-specific analysis, or sim200/sim404/simnx for simulated HTTP responses (useful for triggering malware fallback behaviors). Profile names must be unique — a 409 means the name is taken. Once created, reference the profile by ID or name when calling Sandbox: Submit Sample.

Response data

Returns the newly created profile with its system-assigned UUID, confirming the configuration the sandbox will use when this profile is selected for analysis. The profile is immediately available for use in sample submissions. Note that options and geolocation return null when not specified in the request.

200Profile created.

409Profile name already exists.