---
title: "List impacted snapshots for a specific threat hunt"
method: GET
path: "/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/snapshots"
tags: ["Threat Hunting"]
---

# List impacted snapshots for a specific threat hunt

`GET /threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/snapshots`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/snapshots`
- Auth: API key in header `Authorization`

Displays a list of impacted snapshots for the selected device ID and resource type for a specific threat hunt.

## Path parameters

- `threatHuntID` integer, required
- `deviceID` integer, required

## Query parameters

- `resourceType` 'VMware' | 'EC2' | 'AzureVM' | 'OneDrive' | 'SharePoint' | 'ExchangeOnline', required
- `pageToken` string

## Response `200`

Success

- ThreatHuntListImpactedSnapshotsResponse
  - `threatHuntID` integer: The identifier to uniquely identify threat hunt.
  - `deviceID` integer: Unique identifier for a device.
  - `resourceType` string: Name of resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.
  - `totalSnapshots` integer: Count of total snapshots for this resource.
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of results.
  - `snapshots` object[]
    - `snapshotID` string: The unique ID of the snapshot. Example - Mjk4OC1GcmkgTm92IDIyIDExOjEzOjU5IDIwMTk=.
    - `snapshotName` string: Name of the snapshot. Example - Nov 21 2019, 14:39:34.
    - `size` integer: The size of the snapshot in bytes.
    - `isQuarantined` boolean: This field will indicate if snapshot is quarantined or not.
    - `totalFilesScanned` integer: Count of total files present in the snapshot.
    - `totalFileHashesFound` integer: Count of files matched against custom file hashes.
    - `totalPredefinedFileHashesFound` integer: Count of files matched against predefined Threat-Intel file hashes.
    - `totalFileExtensionsFound` integer: Count of files matched against custom file extensions.
    - `totalPredefinedFileExtensionsFound` integer: Count of files matched against predefined Threat-Intel file extensions.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)