--- title: "ListMalwareDetectionWorkflows lists all workflows in the namespace." method: GET path: "/v1/namespaces/{tenant_meta.namespace}/malware-detection-workflows" tags: ["MalwareDetectionWorkflowService"] --- # ListMalwareDetectionWorkflows lists all workflows in the namespace. `GET /v1/namespaces/{tenant_meta.namespace}/malware-detection-workflows` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/malware-detection-workflows` - Auth: none declared ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListMalwareDetectionWorkflowsResponse: Response returned for requests to list malware detection workflows. - `count_response` V1CountResponse: Response to a list count request. - `count` integer: Number of objects matching the given list parameters. - `group_response` V1GroupResponse: Response to a list group request. - `groups` object: Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListMalwareDetectionWorkflowsResponseList: List of malware detection workflows. - `objects` V1MalwareDetectionWorkflow[]: Malware detection workflow records. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionWorkflowSpec, required: MalwareDetectionWorkflow specifications. - `auto_promote` boolean: When true, a MALICIOUS assessment from this workflow is auto-promoted to the malware feed on creation, bypassing human review. - `capture_iocs` V1IOCType[]: IoC types this workflow is expected to capture across all signal groups; acts as a workflow-level default. - `disabled` boolean: When true, malware detection is disabled for this workflow. - `infer_mal` boolean: When true, only the primary registry mirror is checked and shortcut verdicts produce MALICIOUS; when false all mirrors are searched and shortcut verdicts produce UNKNOWN. - `is_default` boolean: When true, this workflow is selected by default when no explicit workflow is requested. - `signal_groups` V1MalwareSignalGroup[]: Execution order of signal groups; groups are run in the order they appear in this list. - `name` string: Name that uniquely identifies this group within the workflow. - `signals` V1MalwareDetectionSignal[]: Ordered list of signals in this group. - `account` V1MalwareDetectionAccountSignal: MalwareDetectionAccountSignal fetches publisher account information from the registry. - `binary_strings` V1MalwareDetectionBinaryStringsSignal: MalwareDetectionBinaryStringsSignal extracts strings from binary files and passes them to an LLM for analysis. - … - `capture_iocs` V1IOCType[]: IoC types this signal is expected to capture; order reflects capture priority. - `code_diff` V1MalwareDetectionCodeDiffSignal: MalwareDetectionCodeDiffSignal produces an LLM-assisted diff analysis against the previous package version. - … - `code_diff_popular` V1MalwareDetectionCodeDiffPopularSignal: MalwareDetectionCodeDiffPopularSignal produces an LLM-assisted diff analysis for popular packages with a wider baseline. - … - `code_diff_prescreen` V1MalwareDetectionCodeDiffPrescreenSignal: MalwareDetectionCodeDiffPrescreenSignal classifies a version-to-version diff without calling a model, so the pre-screen path can skip the LLM when every change is documentation or a dependency bump. - … - `critique` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - … - `dependencies` V1MalwareDetectionDependenciesSignal: MalwareDetectionDependenciesSignal collects transitive dependency information for the package. - `depends_on` string[]: Names of signals that must complete before this signal runs; execution order follows the declaration order of this list. - `download_stats` V1MalwareDetectionDownloadStatsSignal: MalwareDetectionDownloadStatsSignal fetches download statistics to assess package popularity. - `github` V1MalwareDetectionGitHubSignal: MalwareDetectionGitHubSignal retrieves GitHub repository signals and analyzes them via an LLM. - … - `install_hooks` V1MalwareDetectionInstallHooksSignal: MalwareDetectionInstallHooksSignal inspects package install hooks (preinstall, postinstall scripts). - `ioc_ingestor` V1MalwareDetectionIoCIngestorSignal: MalwareDetectionIoCIngestorSignal runs IoC and YARA short-circuit checks before the full analysis. - … - `is_terminal` boolean: When true, this signal produces the terminal verdict for the group. - `keep_temp_files` boolean: When true, temporary files written by this signal producer are not deleted after execution; useful for debugging. - `llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - … - `llm_file_summary` V1MalwareDetectionLLMFileSummarySignal: MalwareDetectionLLMFileSummarySignal uses an LLM to produce a per-file summary of package contents. - … - `malware_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - … - `metadata` V1MalwareDetectionMetadataSignal: MalwareDetectionMetadataSignal extracts package registry metadata via an LLM. - … - `name` string: Name that uniquely identifies this signal instance within the workflow. - `output_template` string: Go template that overrides the default go output template for this signal. When set, the scanner uses this template instead of the built-in template to render the signal's structured output into text before passing it to the LLM decision signal. Template variables must match the signal producer's output model; unrecognised variables are treated as empty strings. - `package_files` V1MalwareDetectionPackageFilesSignal: MalwareDetectionPackageFilesSignal reads and lists files from the package archive for downstream signals. - … - `package_versions` V1MalwareDetectionPackageVersionsSignal: MalwareDetectionPackageVersionsSignal gathers version history of the package from the registry. - … - `prescreen_llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - … - `second_stage_analysis` V1MalwareDetectionSecondStageAnalysisSignal: MalwareDetectionSecondStageAnalysisSignal downloads and LLM-analyzes files referenced by suspicious code paths. - … - `sens_api_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - … - `typosquatting` V1MalwareDetectionTyposquattingSignal: MalwareDetectionTyposquattingSignal detects potential typosquatting by comparing the package name to known packages. - … - `yara_malware_detection` V1MalwareDetectionYaraSignal: MalwareDetectionYaraSignal scans package files with YARA rules to identify malware patterns. - … - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the workflow record. - `response` V1ListResponse: Response to a list request. - `next_page_id` string: The UUID of last message retrieved. - `next_page_token` integer: Pagination token that can be used to retrieve the next page of results. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/malware-detection-workflows/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)