What this endpoint does

Submits a file or URL for sandbox malware analysis — the entry point for all sandbox workflows. Four submission modes via the kind field: file (upload binary via multipart form), url (analyze a webpage in a browser), fetch (download a remote file and analyze it), or import (re-analyze an existing sample). Uses multipart/form-data encoding. By default, the sandbox automatically selects analysis profiles and begins execution immediately. Set interactive: true to pause after static analysis — the sample enters static_analysis status, letting you inspect the Sandbox: Get Static Report and then call Sandbox: Select Profile to choose execution environments. For encrypted archives, provide the password field. Override default analysis settings (timeout, network mode, geolocation) via the defaults object, or map specific files to specific profiles using the profiles array. Discover available profiles with Sandbox: List Profiles and valid OS tags with Sandbox: List Resources.

Response data

Returns the assigned sample ID and initial pending status — save the id value, as it's needed for every subsequent operation on this sample. After submission, monitor progress with Sandbox: Stream Sample Events (preferred — auto-closes when done) or poll with Sandbox: Get Sample. Once status reaches reported, access results via Sandbox: Get Sample Overview for the consolidated verdict or Sandbox: Get Dynamic Report for per-task behavioral detail.