ThreatEntry

  • ThreatEntry defines an individual threat using either a hash, a URL, or a digest, but only one field should be populated at a time.

  • The hash field represents a SHA256 hash prefix in binary format (base64-encoded for JSON).

  • The url field simply contains a URL string to specify the threat.

  • The digest field holds the SHA256 digest of an executable, supporting both binary and hex formats (base64-encoded for JSON).

An individual threat; for example, a malicious URL or its hash representation. Only one of these fields should be set.

JSON representation 
{
  "hash": string,
  "url": string,
  "digest": string
}
Fields
hash

string (bytes format)

A hash prefix, consisting of the most significant 4-32 bytes of a SHA256 hash. This field is in binary format. For JSON requests, hashes are base64-encoded.

A base64-encoded string.
url

string

A URL.
digest

string (bytes format)

The digest of an executable in SHA256 format. The API supports both binary and hex digests. For JSON requests, digests are base64-encoded.

A base64-encoded string.