Sublime Security BinExplode API

openapi: 3.2.0
info:
  contact:
    email: support@sublime.security
  title: Multi-Tenancy API (BETA) Bin Explode API
  version: '1.0'
servers:
- url: '{scheme}://{server}'
  variables:
    scheme:
      default: https
      enum:
      - http
      - https
    server:
      default: platform.sublime.security
      description: Base URL of your Sublime deployment
security:
- bearerAuth: []
tags:
- name: BinExplode
paths:
  /v0/binexplode/scan:
    post:
      description: Starts a task to explode a binary. Returns a task ID to track and ultimately retrieve results. Results expire after 1 hour. Max original file size of 37 mb (base 64 encoded 49 mb)
      operationId: postScan
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostScanInput'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Handler_typesTaskAccepted'
          description: OK
      summary: Upload a binary to be binexploded
      tags:
      - BinExplode
  /v0/binexplode/scan/{id}:
    get:
      description: Retrieve the results of a completed binexplode scan.
      operationId: getScan
      parameters:
      - description: Task ID
        in: path
        name: id
        required: true
        schema:
          description: Task ID
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Handler_typesGetScanResultResponse'
          description: OK
      summary: Get results of a binexplode scan
      tags:
      - BinExplode
components:
  schemas:
    StrelkaResponse:
      properties:
        depth:
          description: depth in explosion, starts at 0
          format: int32
          type: integer
        file_extension:
          description: file extension if known. Using YARA and MIME rules (see .flavors) may provide more accurate detections.
          type: string
        file_name:
          description: name of the file, or a placeholder. For files exploded from an archive this will be the actual name, but for extracted text, octet stream etc, it will be assigned by the parent to something arbitrary.
          type: string
        flavors:
          $ref: '#/components/schemas/StrelkaFlavors'
        node_id:
          description: ID representing this file in the tree
          type: string
        parent_node_id:
          description: ID of parent, or not present for the root
          type: string
        scan:
          $ref: '#/components/schemas/StrelkaScan'
        size:
          description: file size in bytes
          format: int32
          type: integer
        source:
          description: Scanner which 'exploded' this file
          type: string
      type: object
    StrelkaHTMLSpan:
      properties:
        style:
          type: string
      type: object
    StrelkaKeyVal:
      properties:
        key:
          type: string
        value:
          type: string
      type: object
    StrelkaHash:
      description: Multiple hash algorithms
      properties:
        md5:
          type: string
        sha1:
          type: string
        sha256:
          type: string
        ssdeep:
          type: string
      type: object
    StrelkaICSAttachment:
      properties:
        decode_error:
          description: Extraction error message
          type: string
        extracted:
          description: Whether file was extracted
          type: boolean
        filename:
          description: Original filename
          type: string
        mime_type:
          description: MIME type
          type: string
        size:
          description: File size in bytes
          type: string
        type:
          description: Attachment type
          enum:
          - binary
          - base64_binary
          - uri
          - other
          type: string
        uri:
          description: URI for external references
          type: string
      type: object
    Mdm_serviceRewriteDetails:
      description: Information about an original URL that was unfurled from rewrite detection
      properties:
        encoders:
          description: List of detected URL rewrite encoders while unraveling the URL
          items:
            enum:
            - adobe
            - appspot
            - aws_ses
            - azurecomm
            - azure_safelink
            - barracuda
            - bing_open_redirect
            - branch_io
            - checkpoint
            - cisco
            - cloudflare
            - convertkit
            - deref_mail
            - doubleclick
            - edgepilot
            - esvalabs
            - exactag
            - exclaimer
            - facebook
            - fireeye
            - fortimail
            - generic_desturl
            - generic_logout_redirect
            - go_acoustic
            - google_amp
            - google_amp_project
            - google_adservices
            - google_meet_redirect
            - google_notifications
            - google_open_redirect
            - google_tag_manager
            - google_travel_redirect
            - google_translate_open_redirect
            - google_user_content
            - href_li
            - indeed_open_redirect
            - inky
            - instagram
            - mailgun
            - mailjet
            - mandrill
            - messagegears
            - microsoft
            - microsoft_dynamics
            - microsoft_oauth_redirect
            - monday_tracker
            - postmark
            - ppcprotect
            - proofpoint
            - pylonlinks
            - securence
            - sophos
            - sqclick
            - squarespace
            - sublime
            - titanhq
            - topsec
            - trend_micro
            - vtiger
            - wix
            - yahoo
            - youtube_set_sid
            type: string
          type: array
        original:
          description: Original URL without any unraveling URL rewrites
          type: string
      required:
      - original
      type: object
    Handler_typesTaskAccepted:
      properties:
        task_id:
          description: Task ID. Use the /v0/tasks/:id endpoint to check the task status.
          format: uuid
          type: string
      required:
      - task_id
      type: object
    StrelkaYARAMatch:
      properties:
        meta:
          additionalProperties:
            type: string
          type: object
        name:
          type: string
      type: object
    StrelkaEmbeddedHTMLScript:
      properties:
        language:
          description: Language of script, e.g. 'javascript'
          type:
          - string
          - 'null'
        scripts:
          type:
          - string
          - 'null'
        type:
          type:
          - string
          - 'null'
      type: object
    Mdm_serviceDomain:
      description: Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender
      properties:
        domain:
          description: The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
          format: hostname
          type: string
        punycode:
          description: Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com
          type: string
        root_domain:
          description: The root domain, including the TLD
          format: hostname
          type: string
        sld:
          description: Second-level domain, e.g. 'windows' for the domain 'windows.net'
          type: string
        subdomain:
          description: Subdomain, e.g. 'drive' for the domain 'drive.google.com'
          type: string
        tld:
          description: The domain's top-level domain. E.g. the TLD of google.com is 'com'
          type: string
        valid:
          description: Whether the domain is valid
          type: boolean
      required:
      - domain
      type: object
    StrelkaPPTX:
      description: Extracts details for a powerpoint (pptx) document, and explodes the text for further scanning.
      properties:
        author:
          type:
          - string
          - 'null'
        category:
          type:
          - string
          - 'null'
        comments:
          type:
          - string
          - 'null'
        created:
          format: date-time
          type:
          - string
          - 'null'
        image_count:
          format: int32
          type:
          - integer
          - 'null'
        invalid_urls:
          description: URLs which could not be parsed
          items:
            type: string
          type: array
        keywords:
          type:
          - string
          - 'null'
        last_modified_by:
          type:
          - string
          - 'null'
        last_printed:
          format: date-time
          type:
          - string
          - 'null'
        modified:
          format: date-time
          type:
          - string
          - 'null'
        revision:
          format: int32
          type:
          - integer
          - 'null'
        slide_count:
          format: int32
          type:
          - integer
          - 'null'
        subject:
          type:
          - string
          - 'null'
        title:
          type:
          - string
          - 'null'
        urls:
          description: Detected URLs
          items:
            $ref: '#/components/schemas/Mdm_serviceURL'
          type: array
        word_count:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaPDF:
      description: Unpacks a PDF for further processing. Reports total files.
      properties:
        invalid_urls:
          description: URLs which could not be parsed
          items:
            type: string
          type: array
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        urls:
          description: Detected URLs
          items:
            $ref: '#/components/schemas/Mdm_serviceURL'
          type: array
      type: object
    StrelkaZip:
      description: Unpacks ZIP files. Reports total files.
      properties:
        all_paths:
          description: All member paths included in the zip (files and folders)
          items:
            type: string
          type: array
        attempted_files:
          description: File names, including path, which the scanner attempted to open (cuts off at a limit)
          items:
            type: string
          type: array
        encrypted:
          description: True if known to be encrypted. scan.encrypted_zip can contain details if password is bypassed.
          type: boolean
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    Handler_typesGetTaskResponse:
      description: Generic information about the scan task execution, such as status or errors.
      properties:
        created_at:
          description: Task creation time
          format: date-time
          type: string
        error:
          description: Task error
          type: string
        id:
          description: Task ID
          format: uuid
          type: string
        state:
          description: Task status
          enum:
          - pending
          - started
          - succeeded
          - failed
          - retrying
          type: string
      required:
      - id
      - state
      type: object
    StrelkaMachO:
      description: Unpacks and inspects Mach Objects (executables, libraries, etc)
      properties:
        commands:
          description: All commands within
          items:
            type: string
          type: array
        has_code_signature:
          type: boolean
        header:
          properties:
            cpu:
              description: Details about the CPU/arch the binary is intended for
              properties:
                primary:
                  description: Primary type, e.g. x86_64
                  type: string
                sub:
                  description: Human description (may include ',', 'and', etc)
                  type: string
              type: object
            file:
              description: Typo of Macho
              enum:
              - BUNDLE
              - CORE
              - DSYM
              - DYLIB
              - DYLIB_STUB
              - DYLINKER
              - EXECUTE
              - FVMLIB
              - KEXT_BUNDLE
              - OBJECT
              - PRELOAD
              type: string
            flags:
              description: Flag List from header
              items:
                type: string
              type: array
          type: object
        load_dylinker_name:
          description: Dylinker command name used
          type: string
        nx:
          description: Binary has NX (non-executable stack) protection
          type: boolean
        pie:
          description: Binary is position independent
          type: boolean
        source_version:
          description: 5 part source version
          type: string
        symbols:
          description: Details about symbols within binary
          properties:
            imported:
              description: Imported symbols
              items:
                type: string
              type: array
            libraries:
              description: Imported libraries
              items:
                type: string
              type: array
          type: object
        total_binaries:
          description: Number of binaries registered
          format: int32
          type: integer
        total_commands:
          description: Number of load commands
          format: int32
          type: integer
        total_libraries:
          description: Number of libraries/Dylib commands
          format: int32
          type: integer
        total_relocations:
          description: Number of relocations
          format: int32
          type: integer
        total_sections:
          description: Number of sections
          format: int32
          type: integer
        total_segments:
          description: Number of segments
          format: int32
          type: integer
        total_symbols:
          description: Number of symbols
          format: int32
          type: integer
      type: object
    StrelkaJpegGif:
      description: Extracts contents past the GIF trailer for further processing. Empty if there's no data based trailer.
      properties:
        trailer_index:
          format: int32
          type: integer
      type: object
    Mdm_serviceIP:
      description: X-Originating-IP header, which identifies the originating IP address of the sender client
      properties:
        ip:
          description: The IP in canonical form
          type: string
        translation:
          $ref: '#/components/schemas/Mdm_serviceIPTranslation'
        version:
          description: The version of IP (i.e., 4 or 6), null for backward compatibility.
          format: int32
          type:
          - integer
          - 'null'
      required:
      - ip
      type: object
    Mdm_serviceMailbox:
      description: Organizer mailbox with email and display name
      properties:
        display_name:
          description: Display name
          type: string
        email:
          $ref: '#/components/schemas/Mdm_serviceEmailAddress'
      required:
      - email
      type: object
    PostScanInput:
      properties:
        file_contents:
          description: Base64 encoded raw contents of file
          type: string
        file_name:
          description: Name of file, can be anything but must be provided
          type: string
      required:
      - file_contents
      - file_name
      type: object
    StrelkaVBA:
      description: Examines VBA macros in Ole files, and unpacks macro code for further analysis.
      properties:
        auto_exec:
          description: All keywords associated with auto exec macros
          items:
            type: string
          type: array
        base64:
          description: Decoded base64 strings
          items:
            type: string
          type: array
        dridex:
          description: Decoded dridex strings
          items:
            type: string
          type: array
        hex:
          description: Decoded hex strings
          items:
            type: string
          type: array
        ioc:
          description: String values of indicators, such as 'cmd.exe'
          items:
            type: string
          type: array
        suspicious:
          description: Reported descriptions of suspicious behavior, e.g. 'Run' or 'Hex Strings'
          items:
            type: string
          type: array
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
        vba_obfuscated:
          description: Decoded vba obfuscated strings
          items:
            type: string
          type: array
      type: object
    StrelkaQR:
      description: Checks for QR codes and evaluates them
      properties:
        data:
          description: Raw UTF8 Data
          type:
          - string
          - 'null'
        type:
          description: Type of content, if known
          enum:
          - email
          - mobile
          - app
          - geo
          - wifi
          - url
          - undefined
          type: string
        url:
          $ref: '#/components/schemas/Mdm_serviceURL'
      type: object
    Mdm_serviceIPTranslation:
      properties:
        original:
          description: The IP in its original format if it is an IPv4-mapped-IPv6 source address
          type:
          - string
          - 'null'
        v4_to_v6:
          description: Whether 'Original' is IPv4-mapped-IPv6
          type: boolean
      type: object
    StrelkaFlavors:
      description: matched yara and mime for file type identification
      properties:
        external:
          description: Flavors marked by scanners exploding a file
          items:
            type: string
          type: array
        mime:
          description: Detected MIME type using the libmagic unix utility.
          type: string
        yara:
          description: Matched YARA rules, for current definitions see [here](https://github.com/sublime-security/strelka/blob/main/build/configs/taste.yara)
          items:
            enum:
            - _7zip_file
            - arj_file
            - browser_manifest
            - cab_file
            - cpio_file
            - encrypted_zip
            - encrypted_word_document
            - iso_file
            - mhtml_file
            - rar_file
            - tar_file
            - xar_file
            - zip_file
            - mp3_file
            - pkcs7_file
            - x509_der_file
            - x509_pem_file
            - bzip2_file
            - gzip_file
            - lzma_file
            - xz_file
            - zlib_file
            - doc_subheader_file
            - mso_file
            - olecf_file
            - ooxml_file
            - pdf_file
            - poi_hpbf_file
            - rtf_file
            - vbframe_file
            - wordml_file
            - xfdf_file
            - email_file
            - tnef_file
            - base64_pe
            - pgp_file
            - elf_file
            - lnk_file
            - macho_file
            - mz_file
            - bmp_file
            - cmap_file
            - gif_file
            - jpeg_file
            - postscript_file
            - png_file
            - psd_file
            - psd_image_file
            - svg_file
            - xicc_file
            - xmp_file
            - jar_manifest_file
            - bplist_file
            - fws_file
            - cws_file
            - zws_file
            - debian_package_file
            - rpm_file
            - upx_file
            - batch_file
            - javascript_file
            - vb_file
            - hta_file
            - html_file
            - ini_file
            - json_file
            - php_file
            - plist_file
            - soap_file
            - xml_file
            - avi_file
            - wmv_file
            type: string
          type: array
      type: object
    StrelkaRar:
      description: Unpacks rar files. Reports totals
      properties:
        host_os:
          type:
          - string
          - 'null'
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaPDFObjHash:
      description: Generates PDF Object Hash of the given PDF file
      properties:
        hash_string:
          description: Hash string used to generate the object hash for the PDF
          type: string
        object_hash:
          description: Object hash of the PDF. This is the hash of the object types present in the document.
          type: string
      type: object
    StrelkaYARA:
      description: Reports YARA results from custom installed YARA rules.
      properties:
        flags:
          items:
            type: string
          type: array
        matches:
          items:
            $ref: '#/components/schemas/StrelkaYARAMatch'
          type: array
      type: object
    StrelkaEncryptedDoc:
      description: Unpacks encrypted doc files by trying to break the password. Does not report totals
      properties:
        cracked_password:
          description: If the doc was successfully opened, this is the password for the doc.
          type:
          - string
          - 'null'
      type: object
    StrelkaEncryptedZip:
      description: Unpacks encrypted ZIP files by trying to break the password. Reports total files even if the zip could not be cracked.
      properties:
        cracked_password:
          description: If the ZIP was successfully opened, this is the password for the zip.
          type:
          - string
          - 'null'
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaTar:
      description: Unpacks tar files. Reports totals
      properties:
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaICS:
      description: Parses iCalendar files and extracts events, attachments, and metadata
      properties:
        calendars:
          description: Parsed calendar objects
          items:
            $ref: '#/components/schemas/StrelkaICSCalendar'
          type: array
        flags:
          description: Warning/error flags from parsing
          items:
            type: string
          type: array
        parse_error:
          description: Error message if parsing failed
          type:
          - string
          - 'null'
        total:
          $ref: '#/components/schemas/StrelkaICSTotal'
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
        total_files:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaBZip2:
      description: Unpacks bzip2 files. Reports size
      properties:
        size:
          description: Size of uncompressed file within.
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaICSComponent:
      properties:
        attachments:
          description: File attachments
          items:
            $ref: '#/components/schemas/StrelkaICSAttachment'
          type: array
        attendees:
          description: Event attendees
          items:
            $ref: '#/components/schemas/StrelkaICSAttendee'
          type: array
        class:
          description: Classification
          type: string
        created:
          description: Creation date/time
          type: string
        description:
          description: Detailed description
          type: string
        dtend:
          description: End date/time
          type: string
        dtstamp:
          description: Creation timestamp
          type: string
        dtstart:
          description: Start date/time
          type: string
        duration:
          description: Duration in human-readable format
          type: string
        last_modified:
          description: Last modification date/time
          type: string
        location:
          description: Event location
          type: string
        organizers:
          description: Event organizers
          items:
            $ref: '#/components/schemas/StrelkaICSOrganizer'
          type: array
        priority:
          description: Priority level (0-9)
          type: string
        sequence:
          description: Revision sequence
          type: string
        status:
          description: Event status
          type: string
        summary:
          description: Brief description
          type: string
        transp:
          description: Transparency
          type: string
        type:
          description: Component type
          enum:
          - VEVENT
          - VTODO
          - VJOURNAL
          - VTIMEZONE
          - VALARM
          type: string
        uid:
          description: Unique identifier
          type: string
        urls:
          description: Referenced URLs
          items:
            $ref: '#/components/schemas/Mdm_serviceURL'
          type: array
      type: object
    StrelkaScan:
      description: Contains results of all available bin explode scanners. Some scanners explode embedded binaries more than offer scan/analysis. Some of these have total_extracted & total_unextracted (the count of any files remaining after limits are hit). Some exploding scanners have limited analyses, besides the insight into the count of embedded files (see ZIP). RawOCR is an example which explodes, but does not report totals & explodes content which isn't truly an embedded file.
      properties:
        bzip2:
          $ref: '#/components/schemas/StrelkaBZip2'
        docx:
          $ref: '#/components/schemas/StrelkaDocX'
        encrypted_doc:
          $ref: '#/components/schemas/StrelkaEncryptedDoc'
        encrypted_zip:
          $ref: '#/components/schemas/StrelkaEncryptedZip'
        entropy:
          $ref: '#/components/schemas/StrelkaEntropy'
        exiftool:
          $ref: '#/components/schemas/StrelkaExifTool'
        gif:
          $ref: '#/components/schemas/StrelkaJpegGif'
        gzip:
          $ref: '#/components/schemas/StrelkaGZip'
        hash:
          $ref: '#/components/schemas/StrelkaHash'
        html:
          $ref: '#/components/schemas/StrelkaHTML'
        ics:
          $ref: '#/components/schemas/StrelkaICS'
        javascript:
          $ref: '#/components/schemas/StrelkaJavascript'
        jpeg:
          $ref: '#/components/schemas/StrelkaJpegGif'
        libarchive:
          $ref: '#/components/schemas/StrelkaLibArchive'
        lnk:
          $ref: '#/components/schemas/StrelkaLNK'
        macho:
          $ref: '#/components/schemas/StrelkaMachO'
        ocr:
          $ref: '#/components/schemas/StrelkaOCR'
        ole:
          $ref: '#/components/schemas/StrelkaOle'
        pdf:
          $ref: '#/components/schemas/StrelkaPDF'
        pdf_obj_hash:
          $ref: '#/components/schemas/StrelkaPDFObjHash'
        pptx:
          $ref: '#/components/schemas/StrelkaPPTX'
        qr:
          $ref: '#/components/schemas/StrelkaQR'
        rar:
          $ref: '#/components/schemas/StrelkaRar'
        rtf:
          $ref: '#/components/schemas/StrelkaRTF'
        strings:
          $ref: '#/components/schemas/StrelkaStrings'
        tar:
          $ref: '#/components/schemas/StrelkaTar'
        url:
          $ref: '#/components/schemas/StrelkaURL'
        vba:
          $ref: '#/components/schemas/StrelkaVBA'
        xml:
          $ref: '#/components/schemas/StrelkaXML'
        yara:
          $ref: '#/components/schemas/StrelkaYARA'
        zip:
          $ref: '#/components/schemas/StrelkaZip'
        zlib:
          $ref: '#/components/schemas/StrelkaZLib'
      type: object
    StrelkaOle:
      description: Unpacks valid OLE files. Reports total files.
      properties:
        total_extracted:
          format: int32
          type:
          - integer
          - 'null'
      type: object
    StrelkaICSOrganizer:
      properties:
        mailbox:
          $ref: '#/components/schemas/Mdm_serviceMailbox'
      type: object
    StrelkaEntropy:
      description: Shannon entropy of file
      properties:
        entropy:
          description: Shannon entropy (log base 2). A higher number means higher entropy.
          format: double
          type:
          - number
          - 'null'
      type: object
    StrelkaICSTotal:
      description: Summary counts for calendar components
      properties:
        alarms:
          description: Total VALARM components
          format: int32
          type: integer
        attachments:
          description: Total ATTACH properties
          format: int32
          type: integer
        attendees:
          description: Total attendees across all components
          format: int32
          type: integer
        components:
          description: Total calendar components
          format: int32
          type: integer
        events:
          description: Total VEVENT components
          format: int32
          type: integer
        extracted_files:
          description: Successfully extracted files
          format: int32
          type: integer
        journals:
          description: Total VJOURNAL components
          format: int32
          type: integer
        organizers:
          description: Total organizers across all components
          format: int32
          type: integer
        timezones:
          description: Total VTIMEZONE components
          format: int32
          type: integer
        todos:
          description: Total VTODO components
          format: int32
          type: integer
        urls:
          description: Total URL properties
          format: int32
          type: integer
      type: object
    StrelkaStrings:
      description: Simply finds and extracts any strings from.
      properties:
        raw:
          description: If the entire input is a string, mirror the input as a single string.
          type: string
        strings:
          description: All detected strings.
          items:
            type: string
          type: array
      type: object
    StrelkaDocX:
      description: Extracts details for a document, and explodes the text for further scanning.
      properties:
        author:
          type:
          - string
          - 'null'
        category:
          type:
          - string
          - 'null'
        comments:
          type:
          - string
          - 'null'
        created:
          format: date-time
          type:
          - string
          - 'null'
        font_colors:
          description: all non black (#000000) detected font colors. represented as web colors (hex) without '#' prefix.
          items:
            type: string
          type: array
        image_count:
          format: int32
          type:
          - integer
          - 'null'
        keywords:
          type:
          - string
          - 'null'
        last_printed:
          format: date-time
          type:
          - string
          - 'null'
        modifi

# --- truncated at 32 KB (42 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/sublime-security/refs/heads/main/openapi/sublime-security-binexplode-api-openapi.yml