Report document

GET /public/v2/reports/{report_id} returns the full report: everything the analysis environment recorded during one browser visit. This page explains its sections, the fields analysts use most, and what each is good for. Start with the report overview for triage; reach for the full document when you need evidence.

The document is large and grows as new evidence types are captured. Read the fields you need and ignore the rest; see versioning.

Layout

{
  "report_id": "…", "date": "…", "status": "done", "tags": [],
  "url": {}, "ip": {}, "final": {},
  "submit": {}, "settings": {},
  "detection": {}, "stats": {},
  "summary": [], "http": [], "javascript": {}, "artifacts": {}
}

Key	What it holds
report_id	The report UUID.
date	When the analysis ran (RFC 3339). Cite it with the report ID.
status	done for a completed analysis.
tags	Tags applied by urlquery, mostly by detection rules, such as a phishing-kit family.
url, ip	The submitted URL and the IP address it resolved to.
final	The page the browser ended on: its URL, title, and the final DOM.
submit	How the report was submitted: URL, submitter IP location, and the submitter's own tags.
settings	How the analysis ran: visibility, device, user agent, referrer, cookies, and exit node.
detection	Every alert raised, grouped by source. See detections.
stats.alert_count	Alert totals per source.
summary	One entry per host contacted, with request and data counts and technologies.
http	Every HTTP transaction the browser made, in order.
javascript	Scripts that loaded or were written into the page, and console output.
artifacts	Files and other objects extracted from the traffic: archives, PDFs, Windows shortcuts, Telegram bot tokens, and clipboard writes.

Two older keys may still appear in some reports: files, replaced by artifacts.files, and sensors, replaced by detection. Use the replacements.

Common objects

Several sections reuse the same shapes.

URL, for example url, final.url, http[].url:

Field	Example	Notes
schema	https
addr	login.example.com/verify?id=1	The URL without the scheme.
fqdn	login.example.com	Full host name.
domain	example.com	Registrable domain: the best field for grouping infrastructure.
tld	com

IP, for example ip, http[].ip: addr, port, asn, as (the AS name), country, country_code.

Content hashes, on response bodies, scripts, the DOM, and extracted files: md5, sha1, sha256, sha512, ssdeep, and tlshash, plus size, mime_type, and magic (the detected file type). Exact hashes identify identical content; ssdeep and tlshash are fuzzy hashes for near-identical content.

Prevalence, on response bodies, scripts, and the DOM: first_seen, last_seen, and times_seen across urlquery reports. A body seen thousands of times is common library code; one seen a handful of times is distinctive and worth pivoting on.

Captured content is downloaded separately

The document holds hashes and metadata, not file contents. Body fields such as data are empty. Download a body with GET /public/v2/reports/{report_id}/resources/{hash}/content, using a hash from the document. resource_available tells you whether the content is stored; when it is false, only the metadata exists. See data retention.

final

The page the visitor ended up on after redirects.

Field	Use it to
final.url	See where the browser landed. A final domain different from url.domain means the visit was redirected.
final.title	Recognize impersonated brands and lure pages quickly.
final.dom	Identify the rendered page. Its sha256 and dom_hash (a hash of the page's element structure) find reports with the same page or the same page template.

submit and settings

submit records how the report was created: submit.url, submit.ip (location of the submitter, not of the target), and submit.tags, which the submitter chose. Owner details are only visible to the submitter and their team.

settings records how the browser ran, which matters when results differ between reports of the same URL:

Field	Meaning
access	Visibility: public, restricted, or private.
device_type	The emulated device, for example desktop.
useragent, referer	The user agent and referrer sent. Phishing kits often cloak content based on these.
cookies	Cookies supplied at submission, by domain.
exit_node	The network exit recorded for the analysis. Many sites change behavior by the visitor's country, so compare it with ip locations when results differ.
expires_at	When the report is scheduled to expire.

summary

One entry per host (fqdn) the browser contacted. Read it first to see the shape of a visit without walking every transaction.

Field	Meaning
fqdn, ip	The host and the IP it was reached at.
request_count	Requests made to the host.
sent_data, received_data	Bytes sent and received. Large uploads to an unexpected host can indicate exfiltration.
alert_count	Alerts on this host's transactions.
domain_rank	Popularity rank of the domain among the top million sites. A missing or low rank with a brand-like name is a warning sign.
domain_registered	Registration date, when known. Recently registered domains are a common phishing signal.
first_seen, last_seen	When the host was first and last seen in passive DNS, when known.
fingerprints	Technologies detected on the host, such as a web server, CMS, or framework.

http

Every HTTP transaction, in the order the browser made them. This is where most pivots start.

Field	Meaning
url, ip	Where the request went and which server answered.
is_navigation_request	true for page navigations, as opposed to images, scripts, and other resources.
resource_type	What the browser loaded, for example a document, script, or image.
requested_by	What triggered the request.
date, timestamp, time_used, timings	When the request happened and how long each phase took.
security_state	secure, insecure, or broken TLS.
security_info	TLS details: protocol, cipher_suite, and the server certificate under cert (subject, issuer, validity, and fingerprint.sha256).
request	method, headers, cookies, raw, and post_data for submitted form data.
response	status_code, status_text, headers, cookies with their attributes, technology fingerprints, and data: the body's hashes, type, size, prevalence, and resource_available.
alerts	Alerts raised on this transaction, by source.

Redirects. There is no separate redirect field. A redirect is a transaction with a 3xx status_code and a Location response header; the next transaction is the target. Pages can also redirect with JavaScript or a meta refresh, which shows as a new navigation request.

Form submissions. request.post_data on a POST shows what the page sent. Credential-harvesting pages often post to a different host than the one that served the form.

Strong pivots. A certificate fingerprint.sha256, a response body sha256 with a low times_seen, a distinctive cookie name, or an uncommon fqdn. Search for them with the search syntax or pivot in the Host Profile API.

javascript

Key	Contents
script	Every script that loaded: external scripts with their url and ip, and inline scripts (is_inline). Each has content hashes, prevalence, and alerts.
write	Content injected with document.write, a common obfuscation step.
eval	Code passed to eval, recorded in older reports.
console	Browser console messages: level, text, filename, line_number, column_number. Errors here can reveal broken or tampered kits and the endpoints they tried to reach.

Script content is downloaded like other resources, by its sha256.

artifacts

Objects extracted from the traffic. Each has the URL and IP it came from, content hashes, and its own alerts.

Key	Contents
files	Downloaded files with type and size. Archives list their contents in archive, with each entry's path, file name, modification time, and hashes.
pdfs	PDF documents with meta (author, title, producer, creator, page count) and extracted_urls with the page each link was on.
windows_shortcuts	Windows .lnk files with header details and string_data, including command_line_arguments: often the actual payload command.
telegram	Telegram bot tokens found in page code, whether each is_revoked, and, when resolved, the bot and its chat: names, chat ID, member counts, and administrators. Phishing kits commonly exfiltrate stolen credentials to Telegram.
clipboard	Text the page wrote to the clipboard, with its source. "Paste this command" lures show up here.

Extracted files, PDFs, shortcuts, and tokens are strong indicators: they rarely appear on legitimate pages and are specific to a campaign.

What you may not see

The document is filtered for your account before it is returned:

• Owner details in submit are visible only to the submitter and their team.
• Alerts from private detection rules are visible only to the rule's owner, or their team when the rule is shared with it.
• Some alert sources and some JavaScript alert details depend on your account's permissions.

Two reports of the same URL can differ because the analysis settings differed or because the site changed its behavior. Compare settings, date, and final before drawing conclusions.