What this endpoint does

Retrieves the original file that was submitted for malware analysis in Recorded Future Sandbox. This is only applicable to samples submitted with kind "file" — URL-type submissions do not have a downloadable original file. The sample must have completed initial processing before the file becomes available for download. Use the Sandbox: Get Sample endpoint to check processing status before attempting download. Unlike downloads through the Sandbox web interface, files retrieved via the API are returned in their original form without additional zipping or encryption.

Response data

Returns the raw binary content of the originally submitted file as an application/octet-stream download. The file is returned exactly as it was submitted, preserving the original format and content. If the sample does not exist or is not yet available, a JSON error response is returned with an appropriate error code (NOT_FOUND or NOT_AVAILABLE).