What this endpoint does

Retrieves the URL scan report for a URL-type sample — raw Chromium DevTools Protocol (CDP) data showing every HTTP request/response, redirect chain, subresource load, cookie, TLS certificate, and console message from the browser session. Only available for samples that have a urlscan1 task (URL submissions). Check with Sandbox: Get Sample to confirm the task exists. For a visual snapshot of the page, use Sandbox: Get URL Scan Screenshot. For higher-level behavioral analysis (process trees, signatures), use Sandbox: Get Dynamic Report with behavioral1 instead.

Response data

Returns detailed web page analysis data from a headless Chromium browser session. The data.requests array contains every HTTP transaction with full request/response headers, timing, and initiator chains — useful for identifying redirects to malicious domains, drive-by downloads, or injected scripts. The page object gives the final landed URL, resolved IP, and HTTP status code. The lists object shows whether the URL or any contacted domains appear on known blocklists. The stats object aggregates resource types and protocols for a quick profile of what the page loaded. This is raw CDP data — significantly more detailed than the behavioral report's network section, but specific to the browser session.