What this endpoint does

Opens a persistent streaming connection that emits real-time state change events for all samples visible to your account. Use this for monitoring dashboards or automated pipelines that need to react when any sample completes or fails — for example, triggering IOC extraction when a sample reaches reported status. The connection stays open indefinitely until your client disconnects; there is no auto-close or timeout. Does not replay existing state — only events that occur after the connection is established are emitted. For tracking a single submission, use Sandbox: Stream Sample Events instead (it backfills current state and closes when done). For simple polling without streaming, use Sandbox: Get Sample.

Response data

Returns NDJSON (newline-delimited JSON) — one JSON object per line, each representing a state change for a sample. Each event includes the sample's current status, submission type, and task breakdown — effectively the same data as Sandbox: Get Sample but pushed to you as changes happen. Watch for status: "reported" events to trigger downstream processing. The stream never sends a termination signal — your client must handle connection lifecycle (timeouts, reconnects). Events may arrive with some delay; do not assume real-time latency guarantees.