Data retention
Reports and the content captured with them are kept for a limited time. This page explains how long, what is stored at all, and why some content is not available even in a recent report.
How long reports are kept
How long a report is kept depends on its visibility:
| Visibility | Kept for |
|---|---|
public | 400 days |
restricted | 200 days |
private | 60 days |
The scheduled expiry is in the report as settings.expires_at. Analyses of content urlquery treats as unwanted, such as known junk pages, are kept for a much shorter time.
Expired reports and their captured content are removed, so do not rely on a report staying available after its expiry date. Plan for this: if a report supports a finding you need to keep, save the report JSON, the screenshot, and the resources you rely on in your own case system.
What content is stored
The report document records every HTTP transaction, but only some bodies are stored:
| Content | Stored |
|---|---|
| Screenshot | Yes, as PNG. |
| Final DOM | Yes. |
| JavaScript | Yes: external and inline scripts, and content written with document.write. |
| Text responses | Yes: HTML, plain text, JSON, XML, and shell scripts. |
| Extracted artifacts | Yes: downloaded files, Windows shortcuts, and bodies containing Telegram bot tokens. |
| Images, fonts, video, and other binary responses | No, unless they are an extracted file. Their hashes and metadata are still in the report. |
For each HTTP transaction, response.data.resource_available tells you whether its body can be downloaded. Hashes are recorded for every body, stored or not, so you can still search for and pivot on content that was not kept.
Why a resource can be missing
A download can return 404 even though the report lists the resource:
- the content type is one that is not stored;
- the report or its content has expired;
- storing the content failed during the analysis.
Check resource_available before you try to download, and use the hash to find the same content in other reports.
Deleting a report
Deleting a report removes it from listings and search immediately. Its stored content is removed later, when it would have expired.
Shared content, such as a script or image that several reports captured, is kept as long as any report that references it.