Perform response action on an artifact

post

https://{sandfly-api-host}/v4/responseaction/artifact/{id}/{action}

Initiates a response action against an existing artifact. For process actions (process_kill, process_suspend, process_resume, process_retrieve), the artifact must contain process data with a SHA-512 hash. For file_retrieve, the artifact must contain a file path (from file, cron, or at job engines). Requires the responder role. Can be disabled server-wide with SF_DISABLE_RESPONSES and at the node level with SF_NODE_DISABLE_RESPONSES.

Returns a ResponseActionResponse in both the queued (HTTP 202) and cached-fulfillment (HTTP 200, retrieve actions only) cases.

Responses

200Retrieve action fulfilled immediately from a previously cached blob (matched by SHA-512 hash). No scan was dispatched; an action log entry was recorded as successful and references the existing blob via the order's data_hash field.

202Action queued for execution.

400Invalid action type, artifact does not contain the required data (process or file path), host is inactive, or host no longer exists.

403User does not have the responder role, or response actions are disabled on the server (SF_DISABLE_RESPONSES=true).

404Artifact ID does not exist.

defaultUnexpected error