REST & WebSocket API
Programmatically submit files for malware analysis and stream real-time threat telemetry.
Request (Body)
{ "username": "admin", "password": "password" }
Response (200 OK)
{
"token": "jwt_token"
}
Retrieve all workspaces accessible to the authenticated user via Supabase RBAC.
Response (200 OK)
[{
"id": "wksp_123",
"name": "SOC Team Alpha",
"role": "admin"
}]
Upload a malware sample for analysis. The backend streams
the file directly to MinIO, computes static hashes (MD5, SHA1, SHA256), creates a MongoDB job record, and triggers the asynchronous analysis pipeline via Celery/Kubernetes jobs.
Request (multipart/form-data)
curl -X POST http://api.acros.io/upload \
-H "Authorization: Bearer $TOKEN" \
-F "file=@malware_sample.exe" \
-F "workspace_id=wksp_123" \
-F "engine=firecracker"
Response (201 Created)
{
"job_id": "job_a8f3c2d1...",
"file_id": "file_892nf...",
"filename": "suspicious.exe",
"sha256": "e3b0c442...",
"status": "pending",
"engine_selected": "firecracker"
}
Retrieve the complete analysis report for a given job.
Includes static metadata, YARA matches, MITRE mappings, IOCs, Intelligence Layer results, attack timeline, and
AI summary.
Response (200 OK)
{
"job_id": "job_a8f3c2d1...",
"status": "completed",
"metadata": { "sha256": "...", "size": 4096, "type": "PE32" },
"static_results": { "entropy": 7.2, "imports": [...] },
"runtime_results": { "processes": [...], "network": [...] },
"mitre_mappings": [
{ "id": "T1059", "name": "Command and Scripting Interpreter" }
],
"yara_matches": [{ "rule": "MALWARE_CobaltStrike", "namespace": "community" }],
"iocs": [{ "type": "ip", "value": "185.11.23.4", "reputation": "malicious" }],
"intelligence_layer": { "attack_timeline": [...] },
"analyst_report": { "executive_summary": "...", "risk_score": 92 }
}
List all analysis jobs with pagination and filtering.
Query Parameters
?workspace_id=wksp_123
?status=completed
?limit=50
?skip=0
Response (200 OK)
{
"total": 124,
"jobs": [ { "job_id": "...", "status": "completed", ... } ]
}
Download the final analyst report.
Query Parameters
?format=pdf // Options: pdf, json, markdown
Subscribes to the Redis PubSub channel and pushes live
telemetry events as the sandbox executes.
Connection
const ws = new WebSocket("wss://api.acros.io/ws/jobs/abc/telemetry");
ws.onmessage = (event) => console.log(event.data);
Payload Format
{
"type": "PROCESS_CREATE",
"severity": "high",
"data": {
"executable": "cmd.exe",
"cmdline": "cmd.exe /c start evil.bat"
}
}
Retrieve the Neo4j attack graph for a specific job, formatted for React Flow rendering.
Response (200 OK)
{
"nodes": [ { "id": "proc_1", "label": "Process", "name": "cmd.exe" } ],
"edges": [ { "source": "proc_1", "target": "net_1", "type": "CONNECTS_TO" } ]
}
Search historical telemetry and extracted IOCs across all past jobs.
Query Parameters
?ioc_value=185.11.23.4
?mitre_id=T1059
?hash=e3b0c442...
Retrieve aggregated dashboard statistics for a workspace.
Response (200 OK)
{
"total_jobs": 1420,
"malware_detected": 843,
"clean_files": 577,
"risk_distribution": { "critical": 120, "high": 400, "medium": 323 }
}
List identified threats across all analyzed samples.
Query Parameters
?severity=critical,high
?family=cobaltstrike
?limit=50
Configure SIEM/SOAR webhooks for automatic event pushing.
Request Body
{
"url": "https://siem.internal/api/ingest",
"events": ["job.completed", "threat.critical_detected"],
"secret": "whsec_..."
}
Verify service dependencies.
Response (200 OK)
{
"status": "healthy",
"version": "1.0.0",
"dependencies": {
"mongodb": "connected",
"redis": "connected",
"neo4j": "connected",
"minio": "connected"
}
}
Prometheus-compatible metrics endpoint for infrastructure monitoring.
# HELP acros_jobs_processed_total Total number of jobs processed
# TYPE acros_jobs_processed_total counter
acros_jobs_processed_total{status="completed"} 4321
# HELP acros_malware_detected_total Total malware detected
# TYPE acros_malware_detected_total counter
acros_malware_detected_total{family="ransomware"} 124
# HELP http_requests_total Total HTTP requests
http_requests_total{method="POST",path="/upload",status="201"} 450
Error Codes
| Status Code |
Description |
| 400 Bad Request |
Missing or invalid parameters, or unsupported file type. |
| 401 Unauthorized |
Invalid, expired, or missing JWT authentication token. |
| 403 Forbidden |
Insufficient RBAC permissions to access the requested resource or workspace. |
| 404 Not Found |
The requested job_id, report, or resource does not exist. |
| 413 Payload Too Large |
The uploaded artifact exceeds the configured file size limit. |
| 429 Rate Limited |
Too many requests. Please respect the X-RateLimit headers and back off. |
| 500 Internal Error |
An unexpected failure in the sandbox engine, Neo4j, or pipeline components. |