Perform response action on a process result

post

https://{sandfly-api-host}/v4/responseaction/result/{id}/{action}

Initiates a response action from an existing result. For process actions (process_kill, process_suspend, process_resume, process_retrieve), the result must contain process data with a SHA-512 hash. For file_retrieve, the result must contain a file path (from file, cron, or at job engines). Requires the responder role. Can be disabled server-wide with SF_DISABLE_RESPONSES and at the node level with SF_NODE_DISABLE_RESPONSES.

Returns a ResponseActionResponse in both the queued (HTTP 202) and cached-fulfillment (HTTP 200, retrieve actions only) cases.

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Retrieve action fulfilled immediately from a previously cached blob (matched by SHA-512 hash). No scan was dispatched; an action log entry was recorded as successful and references the existing blob via the order's data_hash field.

202Action queued for execution.

400Invalid action type, result does not contain the required data (process or file path), host is inactive, or host no longer exists.

403User does not have the responder role, or response actions are disabled on the server (SF_DISABLE_RESPONSES=true).

404Result ID does not exist.

defaultUnexpected error