ReversingLabs Spectra Analyze (A1000) API

This is reference documentation. The agent-invokable lookup skill is /lookup-reversinglabs; the runtime CLI is tools/clis/reversinglabs.py. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct a query the SDK does not expose directly.

Base URL

Default: https://a1000.reversinglabs.com. Override with REVERSINGLABS_HOST for on-prem or alternate-tenant appliances. The path prefix is /api/.

Authentication

Token-based. Two paths:

1. Username + password (configured pattern): POST /api-token-auth/ with form-encoded username and password. The endpoint returns {"token": "<value>"}. The SDK does this automatically at A1000(...) init when given username= and password=.
2. Token directly: pass token= to the SDK or set the header manually.

All subsequent requests carry: Authorization: Token <token_value> (note: Token, not Bearer, not Basic).

# Manual token exchange
TOKEN=$(curl -s -X POST "https://a1000.reversinglabs.com/api-token-auth/" \
  -d "username=$REVERSINGLABS_USER&password=$REVERSINGLABS_PASSWORD" | jq -r .token)

# Subsequent call
curl -s "https://a1000.reversinglabs.com/api/samples/v3/<hash>/classification/" \
  -H "Authorization: Token $TOKEN"

If the env vars are unset, inform the user to run /cti-setup or ./scripts/setup.sh.

Rate limits

No per-minute/day quota is publicly documented for A1000. The API returns HTTP 429 with a Retry-After: <seconds> header when limits are exceeded. The SDK polls submission endpoints at 2-second intervals for up to 10 retries before raising.

Capability map

Key endpoints — examples

Hash classification

curl -s "https://a1000.reversinglabs.com/api/samples/v3/<hash>/classification/?localOnly=false&av_scanners=true" \
  -H "Authorization: Token $TOKEN"

Response highlights: classification (malicious/suspicious/goodware/unknown), riskscore (0–10), classification_origin, av_scanners.scanner_match.

Detailed report

curl -s -X POST "https://a1000.reversinglabs.com/api/samples/v2/list/details/" \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"hash_values": ["<hash>"], "fields": ["classification","riskscore","attack","tags","ticore","networkthreatintelligence"]}'

Useful response fields:

Advanced search

curl -s -X POST "https://a1000.reversinglabs.com/api/samples/v2/advanced_search/" \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "threatname:Lockbit classification:malicious", "ticloud": false, "page": 1, "records_per_page": 100}'

Searchable fields include: classification, av-detection, type (sampletype), positives, firstseen, lastseen, threatname, sampletype, filecount, size, sha1, sha256, md5, tlsh, ssdeep, imphash, tag, family. Combine with implicit AND. Comparison operators: >, >=, <, <=, ranges with :>2025-01-01.

Network threat intelligence

# IP reputation
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/ip/8.8.8.8/report/" \
  -H "Authorization: Token $TOKEN"

# Files seen on an IP
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/ip/8.8.8.8/downloaded_files/?extended=true" \
  -H "Authorization: Token $TOKEN"

# Domain reputation
curl -s "https://a1000.reversinglabs.com/api/network-threat-intel/domain/example.com/" \
  -H "Authorization: Token $TOKEN"

# URL reputation
curl -s -X POST "https://a1000.reversinglabs.com/api/network-threat-intel/url/" \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/path"}'

Containers + extracted files (parent / child pivot)

# What containers spawned this hash?
curl -s -X POST "https://a1000.reversinglabs.com/api/samples/containers/" \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"hash_values": ["<child-hash>"]}'

# What files came out of this hash?
curl -s "https://a1000.reversinglabs.com/api/samples/v2/<parent-hash>/extracted-files/?page_size=100&page=1" \
  -H "Authorization: Token $TOKEN"

Spectra Intelligence vs Spectra Analyze

Spectra Intelligence (formerly TitaniumCloud) is a separate cloud product with separate credentials, exposed via from ReversingLabs.SDK.ticloud import .... A1000 can query it as enrichment:

• get_classification_v3(..., local_only=False)
• advanced_search_v3(..., ticloud=True)
• ticloud field in detailed reports

These flags use the appliance's own TitaniumCloud license — they do not require additional credentials from the calling user. To query Spectra Intelligence directly (e.g. RHA1FunctionalSimilarity for fuzzy-hash sample search), separate TICLOUD_USER / TICLOUD_PASSWORD would be required and a separate skill would be needed; that is out of scope here.

Response shape

The lookup skill emits a normalised envelope. See skills/lookup-reversinglabs/SKILL.md § Response format.