---
title: "Free loss-leader: exact known-bad hash lookup."
method: GET
path: "/v1/known-bad/{sha256}"
---

# Free loss-leader: exact known-bad hash lookup.

`GET /v1/known-bad/{sha256}`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/known-bad/{sha256}`
- Auth: none declared

## Path parameters

- `sha256` string, required

## Response `200`

Whether the hash matches a known-bad indicator.

- KnownBad
  - `matched` boolean, nullable: true=known-bad; false=checked clean; null=could not check (fail-closed).
  - `match_type` 'exact_hash' | 'fuzzy_hash' | 'embedded_ioc' | 'known_publisher' | 'malicious_package': How the known-bad match was made. `malicious_package` means the package identity (name + version) is listed as malware in the OSV/OpenSSF corpus, which is scoped to the affected versions: a project compromised in one release is not condemned in its later clean ones.
  - `sources` string[]

## Other responses

- `400`: Malformed hash.
- `429`: Rate limited (detection-oracle bound).

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)