Submission results request based on format 2.0

Prev Next

Returns a malware file analysis report in JSON format based on format 2.0. This is supported from version 9.1.3 and later.

GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0

Returns a malware file analysis report in JSON format where you can view concise, normal or extended details of the submission result. This is supported from version 10.0.1 and later.

GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=concise 
GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=normal
GET https://<address>/wsapis/mvx/[v2.0.0]/submissions/result/[uuid]?format=v2.0&info_level=extended

Required headers:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Options

  • address—The IP address of the appliance running the Web Services API.

  • uuid—Provided by your appliance during the submission process, this key identifies the unique file submitted for analysis.

  • API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.

  • Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.

Response

The response includes the analysis results, focusing on the combination of status and verdict for the submitted object.

  • status: Indicates the current state of the submission analysis. Refer to this field only when the analysis is still in progress. During this stage, the status is displayed as "queued".

    • queued: Analysis is waiting for available resources.

    Note

    For completed or failed analyses, or any other status information, refer to the Generic Status table in the Submission analysis status section.

  • verdict: The security assessment of the analyzed object.

    • malicious: The object contains known or behavioral malware.

    • riskware: The object is potentially unwanted or contains security risks.

    • non-malicious: No malicious behavior or signatures were detected.

Submission analysis status

The following table provides detailed descriptions for the generic statuses returned by the IVX engine during the submission.

Generic Status

Description

Success

Indicates successful execution of the file. A verdict of Malicious, Riskware, or Clean/Non-malicious is expected.

File Empty

The submitted file, the object pointed to by a URL, or the contents extracted from an archive are empty.

Download Empty

Indicates a download failure, such as an embedded object failing to download or a URL target being unreachable.

Submit Error

Submission failure caused by stopped services, malformed requests, or improper parameters. Primarily applicable to sensor-based submissions.

Overlimit Error

The submitted archive exceeds configured limits, such as maximum file count or recursive archive levels.

ISO Create Error

Failure occurred during the creation of the analysis image.

Duplicate

A previous analysis result for this object is already available.

Submit Whitelist

The file, user, or URL is whitelisted or explicitly allowed by existing policy.

Submit Disabled

The file type is unsupported, no matching analysis profile was found, or the file is too large for the current configuration.

Invalid

Indicates an invalid file or a bad request/response from FENET.

Submit Timeout

The file was not picked up for analysis within 24 hours or a component failed to respond in time.

File Unknown

The submitted file type is unknown to the system.

Force Terminate

The file analysis was forcefully terminated during execution.

File Limit

The submitted file exceeds the maximum size allowed for analysis.

Download Limit

The size of the file being downloaded via URL exceeds the allowed limit.

Static Analysis Only

The file was identified as clean by the pre-filter. (Applicable only to PDF, HTM, and XLS files) .

Aborted

The submission was manually or systematically aborted.

VM Failed

An error occurred during analysis where the Virtual Machine failed to initialize, crashed, or the analysis engine died.

Download Failed

Failure during the prefetch stage due to malformed URLs, too many redirects, or unsupported protocols.

Download Could Not Resolve Proxy

Failure to resolve the proxy for download.

Download Could Not Resolve Host

Failure to resolve the host for download.

Download Could Not Connect

Unable to connect to the URL for download.

Download Access Denied

Client configured access policy to deny download requests.

Download Timeout

The download operation timed out.

Download 404 Not Found

Download failure due to a "File Not Found" (404) error.

Bypass

Specific to EX appliances when an email is bypassed for any reason (not applicable for VX).

Password Protected(failed)

Archive extraction failed because the password was incorrect.

Extraction Failed

The system failed to extract the archive or the provided password was incorrect.

Failed

Internal system component failure (e.g., Database error, File Access error) resulting in an inconclusive analysis.

Unknown

Analysis behavior is uncertain or non-deterministic.

Example request

GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/ce45e629-8702-4ec4-9c1f-71b009ecc5113831?format=v2.0
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=concise 
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=normal
GET https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/8e2fab83-8b28-4311-96d2-02e60a0c3ad6?format=v2.0&info_level=extended

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: BigDataInc

Results response

After the submission results request is received, the appliance forwards the malware object data back to the remote server.

Note

If you make a results request before the analysis is complete, you will receive a response with no analysis data.

HTTP/1.1 [Response Code] [Response Message]
Date: [Date]

Body:

[Result Data]
Response fields
  • Response Code—A standard HTML response code.

    • 200—Request successful.

    • 401—Request unsuccessful due to incorrect session token.

    • 404—Request unsuccessful due to incorrect submission key.

  • Response Message—A standard HTML response message.

    • OK—Request successful.

    • Unauthorized—Request unsuccessful due to incorrect session token.

    • Not Found—Request unsuccessful due to incorrect submission key.

  • Date—Standard HTML date format.

  • Results Data—The analysis data of the submitted malware object.

Example response

JSON:

[Result Data]
{
  "uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077",
  "type": "pdf",
  "verdict": "NON-MALICIOUS",
  "status": "SUCCESS",
  "generic_status": "Success",
  "name": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
  "md5": "c81f8ffae7333cdc0e1bc8dc7e6947c5",
  "signature_name": "Binary.pdftext",
  "sha256": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
  "size": 43499,
  "submission_time": "2026-05-19T06:17:50.456396",
  "complete_time": "2026-05-19T06:19:12.309889",
  "submitter_name": "admin",
  "compute_node": "vx6100-prod-117",
  "sub_properties": {
    "is_sensor_sub": false,
    "analysis_type": "2",
    "force": "true",
    "priority": "2"
  },
  "extracted_objects": [
    {
      "uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077",
      "type": "pdf",
      "verdict": "NON-MALICIOUS",
      "status": "SUCCESS",
      "generic_status": "Success",
      "name": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
      "md5": "c81f8ffae7333cdc0e1bc8dc7e6947c5",
      "sha256": "ae0a59f71fa7874dcf62e21b32cbafcb3de67e04505bf747b54287e646bea8f7",
      "size": 43499,
      "submission_time": "2026-05-19T06:18:02.07339",
      "complete_time": "2026-05-19T06:19:12.309889",
      "anomaly_types": []
    },
    {
      "uuid": "865389b9-7f86-4cff-8e4a-34f9356feb86",
      "type": "pdftext",
      "verdict": "NON-MALICIOUS",
      "status": "STATIC_ANALYSIS_ONLY",
      "generic_status": "Static Analysis Only",
      "name": "218633.pdftext",
      "md5": "4810c17c32b743184f71637899ca507e",
      "sha256": "a6380b9ecf80fdd44a32301bdfea9175c7e00831dd7159223f21b42c80a38d0e",
      "size": 72,
      "submission_time": "2026-05-19T06:18:02.07339",
      "complete_time": "2026-05-19T06:18:14.194464",
      "anomaly_types": [],
      "parent_uuid": "f3e82dec-69b7-417f-a3db-dc9530d75077"
    }
  ]
}

cURL code sample: submission results request

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

a. cURL code sample (applicable from version 9.1.3 and later)

curl -qgsSkH "Content-Type: multipart/form-data" 
--no-progress-bar 
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
-F "https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/c5495313-cb78-4f8e-85f1-b60aac4372d2?format=v2.0"

b. cURL code sample (applicable from version 10.0.1 and later)

curl -qgsSkH "Content-Type: multipart/form-data" 
--no-progress-bar 
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
-F "https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/c5495313-cb78-4f8e-85f1-b60aac4372d2?format=v2.0&info_level=concise"

The cURL sample performs the following tasks:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • -H—This option allows you to specify a custom header with the --header switch.

  • Content-Type: multipart/form-data—This option encodes the data as a multipart form.

  • --no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in response to your authentication request.

Results

The requested submission returns a JSON-formatted malware analysis report.