Returns a malware file analysis report in JSON format based on format 2.0. This is supported from version 9.1.3 and later.
GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0
Returns a malware file analysis report in JSON format where you can view concise, normal or extended details of the submission result. This is supported from version 10.0.1 and later.
GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=concise GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=normal GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=extended
Required headers:
X-FeApi-Token: [API-Token] X-FeClient-Token: [Client-Token]
Options
address—The IP address of the appliance running the Web Services API.
uuid—Provided by your appliance during the submission process, this key identifies the unique file submitted for analysis.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.
Response
The response includes the analysis results, focusing on the combination of status and verdict for the submitted object.
status: Indicates the current state of the submission analysis. Refer to this field only when the analysis is still in progress. During this stage, the status is displayed as "queued".
queued: Analysis is waiting for available resources.
Note
For completed or failed analyses, or any other status information, refer to the Generic Status table in the Submission analysis status section.
verdict: The security assessment of the analyzed object.
malicious: The object contains known or behavioral malware.
riskware: The object is potentially unwanted or contains security risks.
non-malicious: No malicious behavior or signatures were detected.
Submission analysis status
The following table provides detailed descriptions for the generic statuses returned by the IVX engine during the submission.
Generic Status | Description |
|---|---|
Success | Indicates successful execution of the file. A verdict of Malicious, Riskware, or Clean/Non-malicious is expected. |
File Empty | The submitted file, the object pointed to by a URL, or the contents extracted from an archive are empty. |
Download Empty | Indicates a download failure, such as an embedded object failing to download or a URL target being unreachable. |
Submit Error | Submission failure caused by stopped services, malformed requests, or improper parameters. Primarily applicable to sensor-based submissions. |
Overlimit Error | The submitted archive exceeds configured limits, such as maximum file count or recursive archive levels. |
ISO Create Error | Failure occurred during the creation of the analysis image. |
Duplicate | A previous analysis result for this object is already available. |
Submit Whitelist | The file, user, or URL is whitelisted or explicitly allowed by existing policy. |
Submit Disabled | The file type is unsupported, no matching analysis profile was found, or the file is too large for the current configuration. |
Invalid | Indicates an invalid file or a bad request/response from FENET. |
Submit Timeout | The file was not picked up for analysis within 24 hours or a component failed to respond in time. |
File Unknown | The submitted file type is unknown to the system. |
Force Terminate | The file analysis was forcefully terminated during execution. |
File Limit | The submitted file exceeds the maximum size allowed for analysis. |
Download Limit | The size of the file being downloaded via URL exceeds the allowed limit. |
Static Analysis Only | The file was identified as clean by the pre-filter. (Applicable only to PDF, HTM, and XLS files) . |
Aborted | The submission was manually or systematically aborted. |
VM Failed | An error occurred during analysis where the Virtual Machine failed to initialize, crashed, or the analysis engine died. |
Download Failed | Failure during the prefetch stage due to malformed URLs, too many redirects, or unsupported protocols. |
Download Could Not Resolve Proxy | Failure to resolve the proxy for download. |
Download Could Not Resolve Host | Failure to resolve the host for download. |
Download Could Not Connect | Unable to connect to the URL for download. |
Download Access Denied | Client configured access policy to deny download requests. |
Download Timeout | The download operation timed out. |
Download 404 Not Found | Download failure due to a "File Not Found" (404) error. |
Bypass | Specific to EX appliances when an email is bypassed for any reason (not applicable for VX). |
Password Protected(failed) | Archive extraction failed because the password was incorrect. |
Extraction Failed | The system failed to extract the archive or the provided password was incorrect. |
Failed | Internal system component failure (e.g., Database error, File Access error) resulting in an inconclusive analysis. |
Unknown | Analysis behavior is uncertain or non-deterministic. |
Example request
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/ce45e629-8702-4ec4-9c1f-71b009ecc5113831?format=v2.0
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=concise
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=normal
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=extended
Request headers:
X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx X-FeClient-Token: BigDataInc
Results response
After the submission results request is received, the appliance forwards the malware object data back to the remote server.
Note
If you make a results request before the analysis is complete, you will receive a response with no analysis data.
HTTP/1.1 [Response Code] [Response Message] Date: [Date]
Body:
[Result Data]
Response fields
Response Code—A standard HTML response code.
200—Request successful.
401—Request unsuccessful due to incorrect session token.
404—Request unsuccessful due to incorrect submission key.
Response Message—A standard HTML response message.
OK—Request successful.
Unauthorized—Request unsuccessful due to incorrect session token.
Not Found—Request unsuccessful due to incorrect submission key.
Date—Standard HTML date format.
Results Data—The analysis data of the submitted malware object.
Example response
JSON:
[Result Data]
{
"uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077",
"type": "pdf",
"verdict": "NON-MALICIOUS",
"status": "SUCCESS",
"generic_status": "Success",
"name": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
"md5": "c81f8ffae7333cdc0e1bc8dc7e6947c5",
"signature_name": "Binary.pdftext",
"sha256": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
"size": 43499,
"submission_time": "2026-05-19T06:17:50.456396",
"complete_time": "2026-05-19T06:19:12.309889",
"submitter_name": "admin",
"compute_node": "vx6100-prod-117",
"sub_properties": {
"is_sensor_sub": false,
"analysis_type": "2",
"force": "true",
"priority": "2"
},
"extracted_objects": [
{
"uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077",
"type": "pdf",
"verdict": "NON-MALICIOUS",
"status": "SUCCESS",
"generic_status": "Success",
"name": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
"md5": "c81f8ffae7333cdc0e1bc8dc7e6947c5",
"sha256": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
"size": 43499,
"submission_time": "2026-05-19T06:18:02.07339",
"complete_time": "2026-05-19T06:19:12.309889",
"anomaly_types": []
},
{
"uuid": "865389b9-7f86-4cff-8e4a-34f9356feb86",
"type": "pdftext",
"verdict": "NON-MALICIOUS",
"status": "STATIC_ANALYSIS_ONLY",
"generic_status": "Static Analysis Only",
"name": "218633.pdftext",
"md5": "4810c17c32b743184f71637899ca507e",
"sha256": "a6380b9ecf80fdd44a32301bdfea9175c7e00831dd7159223f21b42c80a38d0e",
"size": 72,
"submission_time": "2026-05-19T06:18:02.07339",
"complete_time": "2026-05-19T06:18:14.194464",
"anomaly_types": [],
"parent_uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077"
}
]
}cURL code sample: submission results request
The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.
Note
In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.
a. cURL code sample (applicable from version 9.1.3 and later)
curl -qgsSkH "Content-Type: multipart/form-data" --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -F "https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/c5495313-cb78-4f8e-85f1-b60aac4372d2?format=v2.0"
b. cURL code sample (applicable from version 10.0.1 and later)
curl -qgsSkH "Content-Type: multipart/form-data" --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -F "https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/c5495313-cb78-4f8e-85f1-b60aac4372d2?format=v2.0&info_level=concise"
The cURL sample performs the following tasks:
-q—This option specifies that thecurlrcconfig file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.-S—When used with the-soption, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.-H—This option allows you to specify a custom header with the--headerswitch.Content-Type: multipart/form-data—This option encodes the data as a multipart form.--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in theauth.txtfile. Replace the token in the sample with the token received in response to your authentication request.
Results
The requested submission returns a JSON-formatted malware analysis report.