---
title: "Downloads Threat Watch snapshot report"
method: GET
path: "/threathunting/v1/threatwatch/reports/{snapshotID}"
tags: ["Threat Watch"]
---

# Downloads Threat Watch snapshot report

`GET /threathunting/v1/threatwatch/reports/{snapshotID}`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/reports/{snapshotID}`
- Auth: API key in header `Authorization`

Allows download of Threat Watch report for only impacted snapshots. Requires snapshotID (path), deviceID (query), and resourceType (query) to identify the resource.

## Path parameters

- `snapshotID` string, required

## Query parameters

- `deviceID` integer, required
- `resourceType` 'vmware' | 'ec2' | 'azurevm' | 'onedrive' | 'sharepoint' | 'exchangeonline', required

## Response `200`

Success

- ThreatWatchReportResponse
  - `downloadLink` string: Download the Threat Watch snapshot report using this URL.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)