# Recorded Future Documentation

> Recorded Future API documentation

This file lists one part of the documentation. The full index is at https://docs.recordedfuture.com/llms.txt.

## API Documentation: Sandbox
- Environment
  - [List geolocations](https://docs.recordedfuture.com/reference/sandbox-list-geolocations.md): List available VPN exit points and regional tags for geographic routing in sandbox analysis.
  - [List resources](https://docs.recordedfuture.com/reference/sandbox-list-resources.md): List available sandbox VM images, platforms, and capacity limits for profile creation.
- Profiles
  - [List profiles](https://docs.recordedfuture.com/reference/sandbox-list-profiles.md): List all reusable analysis profiles configured for your organization.
  - [Create profile](https://docs.recordedfuture.com/reference/sandbox-create-profile.md): Create a reusable sandbox analysis profile defining OS, locale, network, timeout, and browser settings.
  - [Get profile](https://docs.recordedfuture.com/reference/sandbox-get-profile.md): Retrieve a single analysis profile by UUID or name.
  - [Update profile](https://docs.recordedfuture.com/reference/sandbox-update-profile.md): Fully replace an existing analysis profile configuration (omitted optional fields reset to defaults).
  - [Delete profile](https://docs.recordedfuture.com/reference/sandbox-delete-profile.md): Permanently remove an analysis profile without affecting previously analyzed samples.
- Submissions
  - [List samples](https://docs.recordedfuture.com/reference/sandbox-list-samples.md): List sandbox samples in reverse chronological order with optional ownership filtering.
  - [Submit a sample](https://docs.recordedfuture.com/reference/sandbox-submit-sample.md): Submit a file or URL for sandbox malware analysis via upload, fetch, or import modes.
  - [Get sample details](https://docs.recordedfuture.com/reference/sandbox-get-sample.md): Retrieve a sample's analysis tasks and current processing status.
  - [Search samples](https://docs.recordedfuture.com/reference/sandbox-search.md): Search sandbox analyses by hash, malware family, tag, or network indicator.
  - [Delete a sample](https://docs.recordedfuture.com/reference/sandbox-delete-sample.md): Permanently delete a sample and all associated analysis data.
  - [Set analysis profile](https://docs.recordedfuture.com/reference/sandbox-select-profile.md): Resume a paused interactive-mode submission by selecting analysis profiles for behavioral execution.
- Streaming
  - [Stream all sample events](https://docs.recordedfuture.com/reference/sandbox-stream-all-events.md): Stream real-time NDJSON state-change events for all visible samples without replaying existing state.
  - [Stream sample events](https://docs.recordedfuture.com/reference/sandbox-stream-sample-events.md): Stream a sample's current state and real-time updates, auto-closing when analysis reaches terminal status.
- Reports
  - [Get static analysis report](https://docs.recordedfuture.com/reference/sandbox-get-static-report.md): Retrieve the static analysis report with file metadata, hashes, PE structure, and YARA matches available before behavioral execution completes.
  - [Get dynamic analysis report](https://docs.recordedfuture.com/reference/sandbox-get-dynamic-report.md): Retrieve the full behavioral analysis report with process trees, network flows, signatures, and malware configurations.
  - [Get overview report](https://docs.recordedfuture.com/reference/sandbox-get-sample-overview.md): Retrieve the comprehensive overview report with malware config, signatures, IOCs, and MITRE ATT&CK mappings.
  - [Get sample summary](https://docs.recordedfuture.com/reference/sandbox-get-sample-summary.md): Retrieve a mid-level analysis summary with per-task threat scores, behavior tags, and signature counts.
  - [Get URL scan report](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-report.md): Retrieve the URL scan report with Chromium CDP data including HTTP requests, redirects, cookies, and certificates.
  - [Get URL scan screenshot](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-screenshot.md): Retrieve the PNG screenshot captured during URL scan analysis.
- Downloads
  - [Download original sample](https://docs.recordedfuture.com/reference/sandbox-download-sample.md): Download the originally submitted sample file as unencrypted binary.
  - [Download sample archive (TAR)](https://docs.recordedfuture.com/reference/sandbox-download-archive-tar.md): Download all analysis artifacts for a completed sample as an uncompressed TAR archive.
  - [Download sample archive (ZIP)](https://docs.recordedfuture.com/reference/sandbox-download-archive-zip.md): Download all analysis artifacts for a completed sample as a compressed ZIP archive.
- Task Artifacts
  - [Download task file](https://docs.recordedfuture.com/reference/sandbox-download-task-file.md): Download a specific file artifact dropped or extracted during behavioral execution.
  - [Get behavioral logs](https://docs.recordedfuture.com/reference/sandbox-get-task-logs.md): Download raw kernel/system monitor logs capturing every process, file, registry, and network event from a behavioral task.
  - [Download PCAP](https://docs.recordedfuture.com/reference/sandbox-download-pcap.md): Download the raw PCAP network capture from a behavioral task (unencrypted traffic only).
  - [Download PCAPNG](https://docs.recordedfuture.com/reference/sandbox-download-pcapng.md): Download the PCAPNG network capture from a behavioral task, including decrypted HTTPS via embedded TLS key logs.
- YARA Rules
  - [List YARA rules](https://docs.recordedfuture.com/reference/sandbox-list-yara-rules.md): List all custom YARA rule filenames accessible by your account.
  - [Create YARA rule](https://docs.recordedfuture.com/reference/sandbox-create-yara-rule.md): Add a custom YARA rule compiled and validated server-side for automatic matching in future analyses.
  - [Get YARA rule](https://docs.recordedfuture.com/reference/sandbox-get-yara-rule.md): Retrieve a YARA rule's source code, compilation status, and any warnings.
  - [Update YARA rule](https://docs.recordedfuture.com/reference/sandbox-update-yara-rule.md): Update a YARA rule's source code and optionally rename it, with server-side recompilation.
  - [Delete YARA rule](https://docs.recordedfuture.com/reference/sandbox-delete-yara-rule.md): Permanently remove a YARA rule while preserving existing match results.