Get Host Artifact Content

post

https://api.greynoise.io/v3/workspaces/{workspace_id}/host-artifact/content

Fetch the contents of a single file observed on one of your deployed
sensors, identified by its path within the workspace. The most
recently observed version of the file at that path is returned.

Small files are returned inline as base64 (type: "inline"); larger
files are returned as a short-lived presigned download URL
(type: "link"). Exactly one of contents or url is populated.

This endpoint requires the Tactics file-content entitlement, which is
separate from the entitlement gating the rest of the Tactics
endpoints.

Responses

200OK - file content returned.

400Bad request - a path parameter, query parameter, or request body was invalid. Validation errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.

401Unauthorized. Please check your API key.

403Forbidden - the workspace is not entitled to Tactics (or, for the host artifact content endpoint, not entitled to file contents), or the authenticated user does not have access to the requested workspace. Contact [email protected] to enable Tactics for your workspace.

404Not found - no detection or file matched the request. Returned as a plain-text message by the Tactics backend.

500Unexpected error while serving the request. Errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.