reversinglabs-api

ReversingLabs Spectra Analyze (A1000) API

This is reference documentation. The agent-invokable lookup skill is /lookup-reversinglabs; the runtime CLI is tools/clis/reversinglabs.py. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct a query the SDK does not expose directly.

Base URL

Default: https://a1000.reversinglabs.com. Override with REVERSINGLABS_HOST for on-prem or alternate-tenant appliances. The path prefix is /api/.

Authentication

Token-based. Two paths:

1. Username + password (configured pattern): POST /api-token-auth/ with form-encoded username and password. The endpoint returns {"token": "<value>"}. The SDK does this automatically at A1000(...) init when given username= and password=.
2. Token directly: pass token= to the SDK or set the header manually.

All subsequent requests carry: Authorization: Token <token_value> (note: Token, not Bearer, not Basic).

# Manual token exchange
TOKEN=$(curl -s -X POST "https://a1000.reversinglabs.com/api-token-auth/" \
  -d "username=$REVERSINGLABS_USER&password=$REVERSINGLABS_PASSWORD" | jq -r .token)

# Subsequent call
curl -s "https://a1000.reversinglabs.com/api/samples/v3/<hash>/classification/" \
  -H "Authorization: Token $TOKEN"

If the env vars are unset, inform the user to run /cti-setup or ./scripts/setup.sh.

Rate limits

No per-minute/day quota is publicly documented for A1000. The API returns HTTP 429 with a Retry-After: <seconds> header when limits are exceeded. The SDK polls submission endpoints at 2-second intervals for up to 10 retries before raising.

Capability map

Group	Notable endpoint(s)	SDK methods
Tokens	POST /api-token-auth/	(init flow)
Submission	POST /api/uploads/	submit_file_from_path, submit_file_from_handle, submit_url, submit_file_and_get_*, submit_url_and_get_report
Processing status	GET /api/samples/status/	file_analysis_status, check_submitted_url_status
Reports	POST /api/samples/v2/list/, POST /api/samples/v2/list/details/	get_summary_report_v2, get_detailed_report_v2, get_titanium_core_report_v2, get_submitted_url_report
Dynamic analysis	POST/GET /api/rl_dynamic_analysis/...	create_dynamic_analysis_report, check_dynamic_analysis_report_status, download_dynamic_analysis_report
PDF reports	POST/GET /api/pdf_report/...	create_pdf_report, check_pdf_report_creation, download_pdf_report
Classification	GET /api/samples/v3/<hash>/classification/	get_classification_v3, set_classification, delete_classification
Reanalysis	POST /api/samples/v2/reanalyze_bulk/	reanalyze_samples_v2
Extracted files	GET /api/samples/v2/<hash>/extracted-files/	list_extracted_files_v2, list_extracted_files_v2_aggregated, download_extracted_files
Sample admin	GET /api/samples/<hash>/download/, DELETE /api/samples/v2/delete/	download_sample, delete_samples, check_sample_removal_status_v2
User tags	GET/POST/DELETE /api/tag/<hash>/	get_user_tags, post_user_tags, delete_user_tags
YARA rulesets	/api/yara/v2/...	get_yara_rulesets_on_the_appliance_v2, get_yara_ruleset_contents, get_yara_ruleset_matches_v2, create_or_update_yara_ruleset, delete_yara_ruleset, enable_or_disable_yara_ruleset
YARA retro-hunt	/api/yara/retro/...	start_or_stop_yara_local_retro_scan, get_yara_local_retro_scan_status, start_or_stop_yara_cloud_retro_scan, get_yara_cloud_retro_scan_status
YARA repo (GitHub sources)	/api/yara/repositories/...	get_yara_repositories, create_yara_repository, update_yara_repository, delete_yara_repository
Advanced search	POST /api/samples/v2/advanced_search/	advanced_search_v3, advanced_search_v3_aggregated
Containers	POST /api/samples/containers/	list_containers_for_hashes
Network threat intel	/api/network-threat-intel/...	network_url_report, network_domain_report, network_ip_addr_report, network_ip_to_domain[_aggregated], network_urls_from_ip[_aggregated], network_files_from_ip[_aggregated]