What this endpoint does

Downloads all analysis artifacts for a completed sample as a compressed ZIP archive — behavioral reports, static analysis, network captures, extracted files, configurations, and screenshots. The sample must have reached status: reported — check with Sandbox: Get Sample first. Get your sampleID from Sandbox: Submit Sample or Sandbox: Search. For an uncompressed download, use Sandbox: Download Archive (TAR). When you only need specific artifacts (e.g., just the PCAP or dynamic report), prefer the individual download endpoints to avoid transferring the full archive.

Response data

Returns raw binary ZIP data with Content-Type application/octet-stream — pipe directly to a file (e.g., curl -o sample.zip). Archives are compressed and significantly smaller than the TAR equivalent (~2.8 MB vs ~14 MB for a typical sample). Contains the same artifacts available individually through the dynamic report, static report, and PCAP download endpoints, bundled for offline analysis.