API - Callback

This page includes the following topics:

About the callback API

The callback API can be used together with the files and urls APIs.

  1. The API should be at the URL that is specified by the callback_url field from the files or urls APIs.

  2. The API sends a POST request with the following structure:

    1. The request HEADERS receive its value from callback_headers supplied in the files or urls APIs. In JSON format: {<KEY>: <VALUE>}

    2. The API body will contain the following fields in JSON format:

      Field name

      Field description

      scan_id

      The id of the scan in the system.

      name

      The name of the file, or the path of the URL.

      type

      "File" or "URL" accordingly.

      path

      The path to the file in the system’s storage, or the path to the URL.

      verdict

      The verdict of the scan:

      • "MAL" - for malicious

      • "CLN" - for clean

      evidence

      A list of evidence found for the verdict.

      params

      Additional params to be sent to the callback URL received from callback_params from the files or urls API.

Example

The response from the callback will be:

inherit
{
  "verdict": "MAL",
  "scan_id": "123456",
  "name": "FILE.pdf",
  "evidence": [
    {
      "Data": {
        "Name": "cfg_trigger",
        "Description": "",
        "module_name": "DeviceHarddiskVolume1Program FilesAdobeAcrobat Reader DCReaderAXE8SharedExpat.dll",
        "module_md5": "000000b5bf63c7d1925599218c6a2a7b",
        "os_and_software": "Win7x86|Acrobat Reader 15"
      }
    },
    {
      "Data": {
        "module_name": "DeviceHarddiskVolume1Program FilesAdobeAcrobat Reader DCReaderAXE8SharedExpat.dll",
        "module_md5": "000000b5bf63c7d1925599218c6a2a7b",
        "os_and_software": "Win7x86|Acrobat Reader 15"
      },
      "Name": "cfg_trigger",
      "Description": null
    }
  ],
  "params": "{}",
  "path": "https://FILE_PATH_IN_SERVER.pdf",
  "type": "File"
}

API Response Codes

Response code

Response body

Response meaning

200

{"scan_id": 123456}

The file or URL was received. The corresponding scan ID is in the body.

403

Client Error: Forbidden for url

User not authenticated - probably a token issue.

50x

 

Internal server error.