What this endpoint does

Downloads all analysis artifacts for a completed sample as an uncompressed TAR archive — behavioral reports, static analysis, network captures, extracted files, configurations, and screenshots bundled together. The sample must have reached status: reported — check with Sandbox: Get Sample first. Get your sampleID from Sandbox: Submit Sample or Sandbox: Search. For a compressed download, use Sandbox: Download Archive (ZIP) instead.

Response data

Returns raw binary TAR data with Content-Type application/octet-stream — pipe directly to a file (e.g., curl -o sample.tar). The archive is uncompressed and can be large (14 MB+ for a single sample). Contains the same artifacts available individually through the dynamic report, static report, and PCAP download endpoints, but bundled for offline analysis.