What this endpoint does

Lists malware analysis samples submitted to Recorded Future Sandbox, with control over the scope of results via the subset parameter: "owned" returns only samples the authenticated user can access (default), "org" returns all samples across the organization, and "public" returns samples visible to any user on the public cloud. This is useful for monitoring recent submissions, finding samples for further analysis via the Sandbox: Get Sample Overview endpoint, or building inventory dashboards. Results are paginated using a cursor-based approach.

Response data

Returns a data array of sample summaries, each containing the sample ID, analysis status (e.g., pending, running, reported, static_analysis), submission kind (file or URL), and timestamps. File submissions include the original filename and SHA-256 hash; URL submissions include the submitted URL. A next field provides a cursor timestamp for retrieving the next page of results — pass it as a query parameter to paginate through the collection.