Liberty91LTD ReversingLabs Spectra Analyze (A1000) API
This is reference documentation. The agent-invokable lookup skill is /lookup-reversinglabs; the runtime CLI is tools/clis/reversinglabs.py. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct a query the SDK does not expose directly.
Base URL
Default: https://a1000.reversinglabs.com. Override with REVERSINGLABS_HOST for on-prem or alternate-tenant appliances. The path prefix is /api/.
Authentication
Token-based. Two paths:
- Username + password (configured pattern):
POST /api-token-auth/with form-encodedusernameandpassword. The endpoint returns{"token": "<value>"}. The SDK does this automatically atA1000(...)init when givenusername=andpassword=. - Token directly: pass
token=to the SDK or set the header manually.
All subsequent requests carry: Authorization: Token <token_value> (note: Token, not Bearer, not Basic).
# Manual token exchange
TOKEN=$(curl -s -X POST "https://a1000.reversinglabs.com/api-token-auth/" \
-d "username=$REVERSINGLABS_USER&password=$REVERSINGLABS_PASSWORD" | jq -r .token)
# Subsequent call
curl -s "https://a1000.reversinglabs.com/api/samples/v3/<hash>/classification/" \
-H "Authorization: Token $TOKEN"
If the env vars are unset, inform the user to run /cti-setup or ./scripts/setup.sh.
Rate limits
No per-minute/day quota is publicly documented for A1000. The API returns HTTP 429 with a Retry-After: <seconds> header when limits are exceeded. The SDK polls submission endpoints at 2-second intervals for up to 10 retries before raising.
Capability map
| Group | Notable endpoint(s) | SDK methods |
|---|---|---|
| Tokens | POST /api-token-auth/ |
(init flow) |
| Submission | POST /api/uploads/ |
submit_file_from_path, submit_file_from_handle, submit_url, submit_file_and_get_*, submit_url_and_get_report |
| Processing status | GET /api/samples/status/ |
file_analysis_status, check_submitted_url_status |
| Reports | POST /api/samples/v2/list/, POST /api/samples/v2/list/details/ |
get_summary_report_v2, get_detailed_report_v2, get_titanium_core_report_v2, get_submitted_url_report |
| Dynamic analysis | POST/GET /api/rl_dynamic_analysis/... |
create_dynamic_analysis_report, check_dynamic_analysis_report_status, download_dynamic_analysis_report |
| PDF reports | POST/GET /api/pdf_report/... |
create_pdf_report, check_pdf_report_creation, download_pdf_report |
| Classification | GET /api/samples/v3/<hash>/classification/ |
get_classification_v3, set_classification, delete_classification |
| Reanalysis | POST /api/samples/v2/reanalyze_bulk/ |
reanalyze_samples_v2 |
| Extracted files | GET /api/samples/v2/<hash>/extracted-files/ |
list_extracted_files_v2, list_extracted_files_v2_aggregated, download_extracted_files |
| Sample admin | GET /api/samples/<hash>/download/, DELETE /api/samples/v2/delete/ |
download_sample, delete_samples, check_sample_removal_status_v2 |
| User tags | GET/POST/DELETE /api/tag/<hash>/ |
get_user_tags, post_user_tags, delete_user_tags |
| YARA rulesets | /api/yara/v2/... |
get_yara_rulesets_on_the_appliance_v2, get_yara_ruleset_contents, get_yara_ruleset_matches_v2, create_or_update_yara_ruleset, delete_yara_ruleset, enable_or_disable_yara_ruleset |
| YARA retro-hunt | /api/yara/retro/... |
start_or_stop_yara_local_retro_scan, get_yara_local_retro_scan_status, start_or_stop_yara_cloud_retro_scan, get_yara_cloud_retro_scan_status |
| YARA repo (GitHub sources) | /api/yara/repositories/... |
get_yara_repositories, create_yara_repository, update_yara_repository, delete_yara_repository |
| Advanced search | POST /api/samples/v2/advanced_search/ |
advanced_search_v3, advanced_search_v3_aggregated |
| Containers | POST /api/samples/containers/ |
list_containers_for_hashes |
| Network threat intel | /api/network-threat-intel/... |
network_url_report, network_domain_report, network_ip_addr_report, network_ip_to_domain[_aggregated], network_urls_from_ip[_aggregated], network_files_from_ip[_aggregated] |
Key endpoints — examples
Hash classification
curl -s "https://a1000.reversinglabs.com/api/samples/v3/<hash>/classification/?localOnly=false&av_scanners=true" \
-H "Authorization: Token $TOKEN"
Response highlights: classification (malicious/suspicious/goodware/unknown), riskscore (0–10), classification_origin, av_scanners.scanner_match.
Detailed report
curl -s -X POST "https://a1000.reversinglabs.com/api/samples/v2/list/details/" \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d '{"hash_values": ["<hash>"], "fields": ["classification","riskscore","attack","tags","ticore","networkthreatintelligence"]}'
Useful response fields:
| Field | Content |
|---|---|
classification |
Verdict |
classification_result |
Threat-name string (e.g. Win32.Backdoor.Prorat) |
riskscore |
0–10 |
ticore |
TitaniumCore static analysis: format, headers, imports, strings, anomalies |
av_scanners / av_scanners_summary |
Per-engine + aggregate AV results |
tags |
Analyst + system tags |
ticloud |
Spectra Intelligence (TitaniumCloud) reputation when available |
attack |
MITRE ATT&CK tactics + techniques (objects with tactic_id, technique_id, technique_name) |
rl_cloud_sandbox |
Dynamic analysis output |
cape / cuckoo / joe / vmray_tcbase / fireeye / cisco_secure_malware_analytics |
Sandbox results per engine if configured |
networkthreatintelligence |
Network indicators extracted from the sample |
domainthreatintelligence |
Domain-level intel from network activity |
extracted_file_count |
Number of embedded/extracted files |
sources / aliases |
Sample provenance + filenames |
Advanced search
curl -s -X POST "https://a1000.reversinglabs.com/api/samples/v2/advanced_search/" \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d '{"query": "threatname:Lockbit classification:malicious", "ticloud": false, "page": 1, "records_per_page": 100}'
Searchable fields include: classification, av-detection, type (sampletype), positives, firstseen, lastseen, threatname, sampletype, filecount, size, sha1, sha256, md5, tlsh, ssdeep, imphash, tag, family. Combine with implicit AND. Comparison operators: >, >=, <, <=, ranges with :>2025-01-01.
Network threat intelligence
# IP reputation
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/ip/8.8.8.8/report/" \
-H "Authorization: Token $TOKEN"
# Files seen on an IP
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/ip/8.8.8.8/downloaded_files/?extended=true" \
-H "Authorization: Token $TOKEN"
# Domain reputation
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/domain/example.com/" \
-H "Authorization: Token $TOKEN"
# URL reputation
curl -s -X POST "https://a1000.reversinglabs.com/api/network-threat-intel/url/" \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com/path"}'
Containers + extracted files (parent / child pivot)
# What containers spawned this hash?
curl -s -X POST "https://a1000.reversinglabs.com/api/samples/containers/" \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d '{"hash_values": ["<child-hash>"]}'
# What files came out of this hash?
curl -s "https://a1000.reversinglabs.com/api/samples/v2/<parent-hash>/extracted-files/?page_size=100&page=1" \
-H "Authorization: Token $TOKEN"
Spectra Intelligence vs Spectra Analyze
Spectra Intelligence (formerly TitaniumCloud) is a separate cloud product with separate credentials, exposed via from ReversingLabs.SDK.ticloud import .... A1000 can query it as enrichment:
get_classification_v3(..., local_only=False)advanced_search_v3(..., ticloud=True)ticloudfield in detailed reports
These flags use the appliance's own TitaniumCloud license — they do not require additional credentials from the calling user. To query Spectra Intelligence directly (e.g. RHA1FunctionalSimilarity for fuzzy-hash sample search), separate TICLOUD_USER / TICLOUD_PASSWORD would be required and a separate skill would be needed; that is out of scope here.
Response shape
The lookup skill emits a normalised envelope. See skills/lookup-reversinglabs/SKILL.md § Response format.