Request	Value
Method	GET
URL	https://api.metadefender.com/v4/feed/false-positives

Summary

Newly discovered files which are considered possible false positives. An infected scan result is considered to be false positive if 2 or less engines detected the file as being infected. The feed is updated on a daily basis and contains files that are detected in the previous day. This feed contains data about all engines.

Data is paginated, each page returns 1000 entries.

This endpoint is only available to OPSWAT partners participating in the malware exchange program. If you are an antivirus vendor, or have a malware feed and want to participate in the program, please contact us at malware-sharing@opswat.com.

Request

Query Parameters

	Description	Required	Default	Example
?page	The page number. This is a number starting from 1 up to as many pages as there are samples in a day	NO	1	?page=1

Header Parameters

	Description	Allowed Values	Required
apikey	Gives rights to use the endpoint (API Authentication Mechanisms)	apikey	YES

Response

HTTP Status Codes

Please refer to Status Codes for more information.

Body

Example of a successful request:

{
    "data": [
        {
            "data_id": "WlRFNE1EY3hPRk5LWW5ONE1WUlJXQVN5bHgyekxtSUU",
            "file_type_category": "E",
            "file_type_extension": "exe",
            "md5": "FDB5440D03C08C6E34AFB9F6900DB337",
            "sha1": "C33CF5FA63F443BB5D4431679098C560D384E9DF",
            "sha256": "CC2117469A1B041755075F6914C603DF7CBB162B7E36C54FBF8280CDAC4A73AB",
            "scan_all_result_a": "Infected",
            "scan_all_result_i": 1,
            "start_time": "2019-02-26T23:58:27.095Z",
            "detected_by": [
                "AegisLab"
            ],
            "download": "https://api.metadefender.com/v3/file/CC2117469A1B041755075F6914C603DF7CBB162B7E36C54FBF8280CDAC4A73AB/download",
            "link": "https://metadefender.opswat.com/#!/results/file/WlRFNE1EY3hPRk5LWW5ONE1WUlJXQVN5bHgyekxtSUU/regular/analysis"
        },
        {
            "data_id": "bTE2MTIwN3Ixbnk2SHg4N2VTeUIwTG1uSlVF",
            "file_type_category": "E",
            "file_type_extension": "exe",
            "md5": "3FC40DDA406A05DC36B76B88CA04A217",
            "sha1": "08EB722BBAFC7F5D5E66EACE9A746CB7CE4C8A85",
            "sha256": "C5AE85FCE64684AEC7CFEC71C59450E6B38843CC1BE62AD9428D7614CE250AB7",
            "scan_all_result_a": "Infected",
            "scan_all_result_i": 1,
            "start_time": "2019-02-26T23:49:32.073Z",
            "detected_by": [
                "Zillya!",
                "AegisLab"
            ],
            "download": "https://api.metadefender.com/v3/file/C5AE85FCE64684AEC7CFEC71C59450E6B38843CC1BE62AD9428D7614CE250AB7/download",
            "link": "https://metadefender.opswat.com/#!/results/file/bTE2MTIwN3Ixbnk2SHg4N2VTeUIwTG1uSlVF/regular/analysis"
        },
	    ...
  ]
}

Example of a failed request:

{
    "error": {
        "code": 401007,
        "messages": [
            "You are not authorized"
        ]
    }
}

Descriptions of responses:

file_type_category	The category of the file, computed by OPSWAT. Possible values: E - executables D - documents A - archives G - graphical format T - text P - pdf format M - audio or video format N - Android apk file
file_type_extension	The extension of the file, computed by OPSWAT
link	The link to the scan results in the frontend
md5	The md5 of the file
sha1	The sha1 of the file
sha256	The sha256 of the file
scan_all_result_a	Scan result description
scan_all_result_i	Scan result code
detected_by	An array of engines who detected this file as being infected
download	The API endpoint from where to download the file
start_time	The start time of the scan

Errors

Please refer to Errors for more information.

Sample code (Node.js)

var http = require("https");
 
var options = {
  "method": "GET",
  "hostname": [
    "api",
    "metadefender",
    "com"
  ],
  "path": [
    "v4",
    "feed",
    "false-positives"
  ],
  "headers": {
    "apikey": process.env.APIKEY
  }
};
 
var req = http.request(options, function (res) {
  var chunks = [];
 
  res.on("data", function (chunk) {
    chunks.push(chunk);
  });
 
  res.on("end", function () {
    var body = Buffer.concat(chunks);
    console.log(body.toString());
  });
});
 
req.end();

Sample code (cURL)

curl -X GET \
  https://api.metadefender.com/v4/feed/false-positives \
  -H "apikey: ${APIKEY}" 

7.2 False positives feed

Summary

Request

Query Parameters

Header Parameters

Response

HTTP Status Codes

Body

Example of a successful request:

Example of a failed request:

Descriptions of responses:

Errors

Sample code (Node.js)

Sample code (cURL)

Search results