What this endpoint does

Retrieves a PNG screenshot captured during URL scan analysis — a visual snapshot of what the browser rendered when visiting the submitted URL. Only available for URL-type submissions (kind: url or kind: fetch) that have a urlscan1 task. Check sample eligibility with Sandbox: Get Sample. File submissions return 404. For the full network activity data behind the page load, use Sandbox: Get URL Scan Report.

Response data

Returns a PNG image as application/octet-stream — save with a .png extension. The screenshot is 1600x1200 resolution, showing the page as rendered by headless Chromium. Useful for visual phishing detection, brand impersonation analysis, or documenting what a suspicious URL displayed at the time of analysis.