---
updatedAt: 2026-06-24T21:48:09.000Z
agentTools:
  projectIndex: https://docs.sandflysecurity.com/llms.txt
---

# Get LLM analyses

Get list of all LLM analyses. The returned list will be in reverse chronological order of modification date. If a hostid or resultid query parameter is supplies, the results will be limited to that result and/or host ID (if both are provided, they are treated as "or").

# OpenAPI definition

```json
{
  "openapi": "3.0.1",
  "info": {
    "contact": {
      "email": "info@sandflysecurity.com"
    },
    "description": "Sandfly Security Server API",
    "license": {
      "name": "Sandfly Security, Ltd.",
      "url": "https://www.sandflysecurity.com"
    },
    "title": "Sandfly API",
    "version": "5.8.0"
  },
  "servers": [
    {
      "url": "https://{sandfly-api-host}/v4"
    }
  ],
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "paths": {
    "/llmanalysis": {
      "get": {
        "summary": "Get LLM analyses",
        "description": "Get list of all LLM analyses. The returned list will be in reverse chronological order of modification date. If a hostid or resultid query parameter is supplies, the results will be limited to that result and/or host ID (if both are provided, they are treated as \"or\").",
        "operationId": "getLlmAnalyses",
        "tags": [
          "LLM Analysis"
        ],
        "parameters": [
          {
            "description": "number of analyses per page",
            "in": "query",
            "name": "size",
            "required": false,
            "schema": {
              "type": "integer",
              "default": 100
            }
          },
          {
            "description": "page number of analyses to retrieve",
            "in": "query",
            "name": "page",
            "required": false,
            "schema": {
              "type": "integer",
              "default": 1
            }
          },
          {
            "description": "Host sequence ID to limit list to",
            "in": "query",
            "name": "hostid",
            "required": false,
            "schema": {
              "type": "integer"
            }
          },
          {
            "description": "Result ID to limit list to",
            "in": "query",
            "name": "resultid",
            "required": false,
            "schema": {
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "allOf": [
                    {
                      "$ref": "#/components/schemas/ScrollingResponse"
                    }
                  ],
                  "properties": {
                    "data": {
                      "description": "List of LLM analyses",
                      "items": {
                        "$ref": "#/components/schemas/LlmAnalysisSummary"
                      },
                      "type": "array"
                    }
                  },
                  "required": [
                    "data"
                  ],
                  "type": "object"
                }
              }
            },
            "description": "LLM analyses retrieved."
          },
          "400": {
            "description": "Page or size query parameter is invalid.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StandardResponse"
                }
              }
            }
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StandardResponse"
                }
              }
            },
            "description": "Unexpected error"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "DeletedData": {
        "enum": [
          "[deleted]"
        ]
      },
      "LlmAnalysisState": {
        "type": "string",
        "enum": [
          "pending",
          "pending_followup",
          "ready",
          "error"
        ],
        "description": "Represents the state of an LLM analysis. New analysis requests begin in the 'pending' state, which should then transition to either 'ready' or 'error' after the model response is received. If a user adds an additional question to the chat, the state will be 'pending-followup', followed again by 'ready' or 'error'."
      },
      "LlmAnalysisMode": {
        "type": "string",
        "enum": [
          "host",
          "results"
        ],
        "description": "Represents the mode of an LLM analysis. 'host' indicates the analysis was started on a host; 'results' indicates the analysis was started on one or more results."
      },
      "LlmAnalysisResult": {
        "type": "object",
        "description": "A result associated with an LLM analysis.",
        "properties": {
          "result_id": {
            "type": "integer",
            "format": "int64",
            "description": "Result ID."
          },
          "sandfly": {
            "type": "string",
            "description": "Name of the Sandfly for this result. May be '[deleted]' if the result no longer exists."
          },
          "status": {
            "description": "Status of the result. May be '[deleted]' if the result no longer exists.",
            "oneOf": [
              {
                "$ref": "#/components/schemas/ResultStatus"
              }
            ]
          },
          "key_data": {
            "type": "string",
            "description": "Key data element of the result. May be '[deleted]' if the result no longer exists."
          },
          "sandfly_engine": {
            "description": "Engine of the sandfly for the result. May be '[deleted]' if the result no longer exists.",
            "$ref": "#/components/schemas/SandflyEngineType"
          },
          "sandfly_tags": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Tags of the sandfly for this result."
          },
          "seen_count": {
            "type": "integer",
            "description": "Seen count for result. Will be 0 if result is deleted."
          },
          "superseded": {
            "type": "boolean",
            "description": "Superseded flag for result. Will always be true if result is deleted."
          },
          "first_seen": {
            "type": "string",
            "description": "First seen timestamp of result. May be '[deleted]' if the result no longer exists."
          },
          "last_seen": {
            "type": "string",
            "description": "Last seen timestamp of result. May be '[deleted]' if the result no longer exists."
          }
        },
        "required": [
          "result_id",
          "sandfly",
          "status",
          "key_data",
          "sandfly_engine",
          "sandfly_tags",
          "seen_count",
          "superseded",
          "first_seen",
          "last_seen"
        ]
      },
      "LlmAnalysisResultDeleted": {
        "type": "object",
        "description": "A result associated with an LLM analysis.",
        "properties": {
          "result_id": {
            "type": "integer",
            "format": "int64",
            "description": "Result ID."
          },
          "sandfly": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "status": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "key_data": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "sandfly_engine": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "sandfly_tags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "seen_count": {
            "enum": [
              0
            ]
          },
          "superseded": {
            "enum": [
              true
            ]
          },
          "first_seen": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "last_seen": {
            "$ref": "#/components/schemas/DeletedData"
          }
        },
        "required": [
          "result_id",
          "sandfly",
          "status",
          "key_data",
          "sandfly_engine",
          "sandfly_tags",
          "seen_count",
          "superseded",
          "first_seen",
          "last_seen"
        ]
      },
      "LlmAnalysisHost": {
        "type": "object",
        "description": "A host related to the LLM analysis.",
        "properties": {
          "host_sequence_id": {
            "type": "integer",
            "description": "Host sequence ID."
          },
          "target_address": {
            "type": "string",
            "description": "Target address (e.g., IP or hostname) of the host. May be '[deleted]' if the host no longer exists."
          },
          "node_name": {
            "type": "string",
            "description": "OS node name (hostname) of the host. May be '[deleted]' if the result no longer exists."
          },
          "os_release_pretty_name": {
            "type": "string",
            "description": "OS release name."
          }
        },
        "required": [
          "host_sequence_id",
          "target_address",
          "node_name",
          "os_release_pretty_name"
        ]
      },
      "LlmAnalysisHostDeleted": {
        "type": "object",
        "description": "A host related to the LLM analysis.",
        "properties": {
          "host_sequence_id": {
            "type": "integer",
            "description": "Host sequence ID."
          },
          "target_address": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "node_name": {
            "$ref": "#/components/schemas/DeletedData"
          },
          "os_release_pretty_name": {
            "$ref": "#/components/schemas/DeletedData"
          }
        },
        "required": [
          "host_sequence_id",
          "target_address",
          "node_name",
          "os_release_pretty_name"
        ]
      },
      "LlmAnalysisSummary": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "description": "Unique identifier for the LLM analysis."
          },
          "state": {
            "$ref": "#/components/schemas/LlmAnalysisState"
          },
          "mode": {
            "$ref": "#/components/schemas/LlmAnalysisMode"
          },
          "hosts": {
            "type": "array",
            "items": {
              "oneOf": [
                {
                  "$ref": "#/components/schemas/LlmAnalysisHost"
                },
                {
                  "$ref": "#/components/schemas/LlmAnalysisHostDeleted"
                }
              ]
            },
            "description": "List of hosts involved in the analysis."
          },
          "results": {
            "type": "array",
            "items": {
              "oneOf": [
                {
                  "$ref": "#/components/schemas/LlmAnalysisResult"
                },
                {
                  "$ref": "#/components/schemas/LlmAnalysisResultDeleted"
                }
              ],
              "discriminator": {
                "propertyName": "statis",
                "mapping": {
                  "alert": "#/components/schemas/LlmAnalysisResult",
                  "error": "#/components/schemas/LlmAnalysisResult",
                  "pass": "#/components/schemas/LlmAnalysisResult",
                  "[deleted]": "#/components/schemas/LlmAnalysisResultDeleted"
                }
              }
            },
            "description": "List of results involved in the analysis, if any."
          },
          "userid": {
            "type": "string",
            "description": "User ID (Sandfly login) of the user who initiated the analysis."
          },
          "username": {
            "type": "string",
            "description": "Full name of the user who initiated the analysis."
          },
          "brief": {
            "type": "string",
            "description": "Brief one-sentence summary of LLM analysis, if available. Will be an empty string if the first response is not yet available, or if no brief was found."
          },
          "model": {
            "type": "string",
            "description": "Model name this analysis was started with."
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "description": "Timestamp when the analysis was created."
          },
          "modified_at": {
            "type": "string",
            "format": "date-time",
            "description": "Timestamp when the analysis was last modified."
          }
        },
        "required": [
          "id",
          "state",
          "mode",
          "hosts",
          "results",
          "userid",
          "username",
          "model",
          "brief",
          "created_at",
          "modified_at"
        ]
      },
      "ResultStatus": {
        "type": "string",
        "enum": [
          "alert",
          "pass",
          "error"
        ]
      },
      "SandflyEngineType": {
        "type": "string",
        "enum": [
          "sandfly_engine_cloaked_direntry",
          "sandfly_engine_dir",
          "sandfly_engine_file",
          "sandfly_engine_process",
          "sandfly_engine_user",
          "sandfly_engine_utmp",
          "sandfly_engine_wtmp",
          "sandfly_engine_btmp",
          "sandfly_engine_lastlog",
          "sandfly_engine_cron",
          "sandfly_engine_at_jobs",
          "sandfly_engine_log_tampering_lastlog_wtmp_missing_record",
          "sandfly_engine_log_tampering_lastlog_history_missing_record",
          "sandfly_engine_os_identify",
          "sandfly_engine_process_masquerade_binary_renamed",
          "sandfly_engine_process_masquerade_binary_mismatched",
          "sandfly_engine_process_masquerade_mixed_case",
          "sandfly_engine_process_binary_time_identical",
          "sandfly_engine_user_password_hash_duplicates",
          "sandfly_engine_user_password_auditor",
          "sandfly_engine_error",
          "sandfly_engine_systemd",
          "sandfly_engine_systemd_session",
          "sandfly_engine_kmodules"
        ]
      },
      "ScrollingResponse": {
        "properties": {
          "more_results": {
            "description": "Indicates if there are more results to be returned.",
            "type": "boolean"
          },
          "total": {
            "description": "Total number of records in this page.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "total",
          "more_results"
        ],
        "type": "object"
      },
      "StandardResponse": {
        "allOf": [
          {
            "$ref": "#/components/schemas/StandardResponseStatus"
          }
        ],
        "properties": {
          "data": {
            "description": "Data that can go along with the status.",
            "type": "string"
          }
        },
        "required": [
          "data"
        ],
        "type": "object"
      },
      "StandardResponseStatus": {
        "properties": {
          "detail": {
            "description": "Extended explanation of status.",
            "type": "string"
          },
          "formattedDetail": {
            "description": "Optional additional details about the status (typically an error) that, if present and not an empty string, should be displayed as pre-formatted, monospaced text.",
            "type": "string"
          },
          "status": {
            "description": "HTTP status code.",
            "format": "int32",
            "maximum": 599,
            "minimum": 100,
            "type": "integer"
          },
          "title": {
            "description": "Short description of status.",
            "type": "string"
          }
        },
        "required": [
          "status",
          "title",
          "detail"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "bearerAuth": {
        "bearerFormat": "JWT",
        "scheme": "bearer",
        "type": "http"
      }
    }
  }
}
```