List Tactics Detection Files

post

https://api.greynoise.io/v3/workspaces/{workspace_id}/tactics/{detection_id}/files

List the files observed during a detection's session, with each file's
path, size, type, and hashes.

Set mutations_only=true to restrict the response to files the session
actually created or modified, rather than every file it touched.

This endpoint returns metadata only - it never carries file bytes.
Retrieve a file's contents with the host artifact content endpoint,
which is gated on its own entitlement.

This endpoint takes no request body.

Responses

200OK - files returned. null is returned rather than an empty array when the detection ID is unknown, or when mutations_only=true and the session modified no files.

400Bad request - a path parameter, query parameter, or request body was invalid. Validation errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.

401Unauthorized. Please check your API key.

403Forbidden - the workspace is not entitled to Tactics (or, for the host artifact content endpoint, not entitled to file contents), or the authenticated user does not have access to the requested workspace. Contact [email protected] to enable Tactics for your workspace.

500Unexpected error while serving the request. Errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.