---
title: "Submit a sample"
method: POST
path: "/samples"
---

# Submit a sample

`POST /samples`

## Request

- Base URL: `https://sandbox.recordedfuture.com/api/v0`
- URL: `https://sandbox.recordedfuture.com/api/v0/samples`
- Auth: API key in header `Authorization`

Submit a file or URL for sandbox malware analysis via upload, fetch, or import modes.

## Request body `multipart/form-data`

- object
  - `kind` 'file' | 'url' | 'fetch' | 'import', required: Submission type: `file` (upload), `url` (analyze URL), `fetch` (download and analyze), or `import` (re-analyze existing sample).
  - `file` string, binary: The file to upload. Required when `kind` is `file`.
  - `url` string: The URL to analyze or fetch. Required when `kind` is `url` or `fetch`.
  - `interactive` boolean: If true, pauses after static analysis for manual profile selection via POST /samples/{sampleID}/profile.
  - `password` string: Decryption password for archive files (zip/rar/etc).
  - `profiles` object[]: Explicit file-to-profile mappings for analysis.
    - `profile` string: Profile ID or name to use.
    - `pick` string: For archives, the filename within the archive this profile applies to.
  - `user_tags` string[]: Custom identification strings (max 1kB total).
  - `target` string: Custom filename override or URL destination.
  - `_json` string: Alternative: pass all parameters as a JSON string in this field instead of individual form fields.
  - `defaults` object: Default analysis parameters for automatic mode.
    - `timeout` integer: Analysis duration in seconds (max 3600).
    - `network` string: Network mode: empty string (default), `drop`, `internet`, `tor`, `sim200`, `sim404`, `simnx`, or `vpn`.
    - `geolocation` string: Geographic region for VPN analysis. Required when network is `vpn`.

## Response `200`

Sample accepted for analysis.

- object
  - `id` string: Assigned sample ID
  - `status` 'pending': Initial status (always 'pending')
  - `kind` 'file' | 'url': Submission type
  - `filename` string: Original filename (file submissions only)
  - `url` string: Submitted URL (URL submissions only)
  - `private` boolean: Whether the sample is private
  - `submitted` string, date-time: ISO 8601 submission timestamp

## Other responses

- `400`: Bad request (e.g., missing required fields).

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti/revisions/39ea918b1dca?raw)