What this endpoint does

Opens a streaming connection that delivers the current state of a specific sample followed by real-time updates as analysis progresses. The stream auto-closes when the sample reaches a terminal status (reported or failed) — unlike Sandbox: Stream All Events which stays open indefinitely. This is the recommended way to wait for analysis completion after calling Sandbox: Submit Sample, as it's more efficient than polling Sandbox: Get Sample. The first message is a snapshot of the current state (including backfill if already in progress); subsequent messages are state transitions. Status progression: pending → running → reported (or failed), with static_analysis appearing only for interactive-mode submissions.

Response data

Returns NDJSON (newline-delimited JSON) where each line is a complete sample state snapshot — not a diff, but the full current state including all tasks and their statuses. The first line immediately gives you the sample's current state even if you connect mid-analysis. Watch for the final line where status is reported or failed — that's your signal that analysis is complete and result endpoints are ready. Each event includes the task breakdown, so you can track individual behavioral/static/urlscan tasks as they complete independently. The stream auto-closes after the terminal event, so no client-side disconnect logic is needed for the happy path.