← API network SECURITY / MD5 / SHA1 / SHA256

Direct Platform 0.0.2 / General Availability api.dakidarts.comDirect gateway

File Hash Analyzer API

A SQLite-backed malware hash intelligence service for MD5, SHA-1 and SHA-256 lookups, batch analysis, community reports, family search and database statistics.

Preview examples View on RapidAPI OpenAPI 3.1 ↗ GitHub repository ↗ Release feed ↗

Direct PlatformFI

api.dakidarts.com0.0.2General Availability25ms p9512 documented endpoints

DIRECT NATIVE API

Call File Hash Analyzer API through the Dakidarts gateway.

0 of 12 endpoints have an upstream URL configured. Other routes return 503 before billing; only send live requests to configured routes. The gateway injects upstream credentials for you.

Live checkout opens after an API route has an upstream URL. Preview examples are available below.

Base URLhttps://api.dakidarts.com/file-hash-analyzer

AuthenticationX-API-Key: dk_live_...

Default reference pathGET /analyze

Commercial modelPay-as-you-go / $0.0050 per call

01 / ACCESS

One key, one gateway

Use a Dakidarts API key with read or write scopes and control which APIs that key can reach.

02 / BILLING

Metered by the call

Wallet credits, plan quotas and organization invoices are settled per request with transparent response headers.

03 / RELIABILITY

Observable by default

Latency, upstream status and execution mode are logged so integration issues are visible before they spread.

RAPIDAPI SPOTLIGHTRapidAPI Marketplace

Also available through RapidAPI.

Keep the direct Dakidarts gateway as your primary route, or use the RapidAPI listing when marketplace billing and key management fit your stack better.

View on RapidAPI Plans, keys and usage stay inside RapidAPI.

CAPABILITIES

Built to disappear into the product.

The best API is the one your team can integrate, observe and then stop thinking about.

Batch analysis for up to 500 hashes

Designed as a composable building block for product teams, internal tooling and automation.

RESTful single-hash lookup and paginated search

Designed as a composable building block for product teams, internal tooling and automation.

Optional MalwareBazaar sync requires its configured API key

Designed as a composable building block for product teams, internal tooling and automation.

PLATFORM FACTS

The shape of the surface.

Selected facts about coverage, delivery and production readiness.

01Local hash database seeded from MalwareBazaar

02Single and batch hash analysis with safe/malicious/unknown verdicts

03Search, recent entries, family summaries and crowd reports

FAQ

Answers before you integrate.

Access, billing and integration details for File Hash Analyzer API.

Which file hashes are supported? +

MD5, SHA-1, SHA-256 and related file-hash utilities; see the endpoint reference for the exact surface.

What is it used for? +

File identification, integrity checks and reputation-oriented workflows.

Can I upload a file? +

The API works with hashes; avoid uploading sensitive files unless the endpoint explicitly supports it.

How do I get access? +

Subscribe on the Dakidarts dashboard, then use an API key with this API in scope.

Are hashes reversible? +

No. Cryptographic hashes are one-way identifiers.

SUBSCRIPTION PLANS

Choose a quota that matches the workload.

Plans are shown for reference. Live checkout opens after an API route has an upstream URL.

WALLET-ACCESS

Pay-as-you-go access

$0.00 / month

Wallet credits per call
$0.0050 / call overage
120 req/min

INTEGRATION PATH

From first request to production.

Start with a Dakidarts key, call the gateway, then monitor usage from the dashboard.

Create a Dakidarts key

Choose the API scope, then copy the key into your server environment.

Call the gateway

Send requests to https://api.dakidarts.com/file-hash-analyzer with your key and JSON body.

Watch usage

Track calls, latency and spend from the API dashboard and wallet.

ENDPOINT REFERENCE

Endpoint reference & metered costs.

These routes include contracts imported from the product implementation. 0 of 12 endpoints have an upstream URL configured. Other routes return 503 before billing; saved examples are previews only. Configure an upstream URL in API Studio to enable those routes.

GROUP / 01

Operations

Operations endpoints sourced from the File Hash Analyzer API implementation.

2 endpoints

GET / Info SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns the service name, version, and the full endpoint listing. Useful as a "hello world" probe.

`GET /`

Returns the service name, version, and the full endpoint listing. Useful as a "hello world" probe.

Response data

{
  "name": "File Hash Analyzer API",
  "version": "0.0.2",
  "description": "...",
  "documentation": "...",
  "endpoints": [ { "method": "GET", "path": "/analyze", "summary": "Analyze one hash" }, ... ]
}

Source contract imported from file hash analyzer/app.py. Handler: info. Reference: docs/endpoints.md.

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/ -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GET /health Health SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` **Description:** Returns service health status, database row count, last MalwareBazaar sync time, and whether a MalwareBazaar API key is configured.

2️⃣ `/health` — Health Check

Method: GET Description: Returns service health status, database row count, last MalwareBazaar sync time, and whether a MalwareBazaar API key is configured.

Response (200 OK)

{
  "success": true,
  "data": {
    "status": "ok",
    "service": "File Hash Analyzer",
    "version": "0.0.2",
    "db": {"status": "ok", "total_hashes": 1117364},
    "malwarebazaar": {"api_key_configured": true, "note": "free key at https://auth.abuse.ch/"},
    "uptime_s": 3621.45,
    "last_sync": "2026-08-26T23:34:00+00:00"
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2"}
}

Source contract imported from file hash analyzer/app.py. Handler: health. Reference: RAPID_README.md.

SAMPLE RESPONSE

{
  "data": {
    "db": {
      "status": "ok",
      "total_hashes": 1117364
    },
    "status": "ok",
    "service": "File Hash Analyzer",
    "version": "0.0.2",
    "uptime_s": 3621.45,
    "last_sync": "2026-08-26T23:34:00+00:00",
    "malwarebazaar": {
      "note": "free key at https://auth.abuse.ch/",
      "api_key_configured": true
    }
  },
  "meta": {
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/health -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 02

Analysis

Analysis endpoints sourced from the File Hash Analyzer API implementation.

2 endpoints

GET /analyze Analyze SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` or `POST` **Description:** Query the database for a hash to check if it's known malicious, safe, or unknown. Supports MD5, SHA1, and SHA256. If you query with an MD5 or SHA1, the full SHA256 record is returned with `matched_by` indicating how it was resolved.

3️⃣ `/analyze` — Analyze a Hash

Method: GET or POST Description: Query the database for a hash to check if it's known malicious, safe, or unknown. Supports MD5, SHA1, and SHA256. If you query with an MD5 or SHA1, the full SHA256 record is returned with matched_by indicating how it was resolved.

Request Parameters (GET)

Parameter	Type	Required	Description
hash	string	Yes	Hash to check (MD5, SHA1, or SHA256)
algorithm	string	No	`md5`, `sha1`, or `sha256`. Auto-detected if omitted

Request Body (POST)

{
  "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
  "algorithm": "sha256"
}

Response (200 OK) — Malicious hit

{
  "success": true,
  "data": {
    "found": true,
    "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "query_algorithm": "sha256",
    "verdict": "malicious",
    "confidence": 0.98,
    "tags": "mirai,botnet,iot",
    "source": "MalwareBazaar",
    "votes": 12,
    "md5": null,
    "sha1": null,
    "file_type": "elf",
    "first_seen": "2026-01-15",
    "created_at": "2026-08-26T12:00:00+00:00"
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Response (200 OK) — Not found

{
  "success": true,
  "data": {
    "found": false,
    "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "query_algorithm": "sha256",
    "verdict": "unknown",
    "confidence": null,
    "tags": [],
    "source": null,
    "votes": 0,
    "md5": null,
    "sha1": null,
    "file_type": null,
    "first_seen": null,
    "created_at": null
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

400 → Invalid hash or unsupported algorithm
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: analyze. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`hash`	query	string	Yes	Hash to check (MD5, SHA1, or SHA256)
`algorithm`	query	string	No	`md5`, `sha1`, or `sha256`. Auto-detected if omitted

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/analyze -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /analyze Analyze SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

3️⃣ `/analyze` — Analyze a Hash

Request Parameters (GET)

Parameter	Type	Required	Description
hash	string	Yes	Hash to check (MD5, SHA1, or SHA256)
algorithm	string	No	`md5`, `sha1`, or `sha256`. Auto-detected if omitted

Request Body (POST)

{
  "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
  "algorithm": "sha256"
}

Response (200 OK) — Malicious hit

{
  "success": true,
  "data": {
    "found": true,
    "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "query_algorithm": "sha256",
    "verdict": "malicious",
    "confidence": 0.98,
    "tags": "mirai,botnet,iot",
    "source": "MalwareBazaar",
    "votes": 12,
    "md5": null,
    "sha1": null,
    "file_type": "elf",
    "first_seen": "2026-01-15",
    "created_at": "2026-08-26T12:00:00+00:00"
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Response (200 OK) — Not found

{
  "success": true,
  "data": {
    "found": false,
    "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "query_algorithm": "sha256",
    "verdict": "unknown",
    "confidence": null,
    "tags": [],
    "source": null,
    "votes": 0,
    "md5": null,
    "sha1": null,
    "file_type": null,
    "first_seen": null,
    "created_at": null
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

400 → Invalid hash or unsupported algorithm
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: analyze. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`hash`	body	string	Yes	Hash to check (MD5, SHA1, or SHA256)
`algorithm`	body	string	No	`md5`, `sha1`, or `sha256`. Auto-detected if omitted

SAMPLE RESPONSE

{
  "data": {
    "md5": null,
    "sha1": null,
    "tags": "mirai,botnet,iot",
    "found": true,
    "votes": 12,
    "source": "MalwareBazaar",
    "verdict": "malicious",
    "file_type": "elf",
    "confidence": 0.98,
    "created_at": "2026-08-26T12:00:00+00:00",
    "first_seen": "2026-01-15",
    "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "query_algorithm": "sha256"
  },
  "meta": {
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/file-hash-analyzer/analyze -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"hash": "example", "algorithm": "example"}'

GROUP / 03

Batch operations

Batch operations endpoints sourced from the File Hash Analyzer API implementation.

2 endpoints

POST /analyze/batch Analyze Batch SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `POST` **Description:** Analyze up to 500 hashes in a single request. Returns individual results for each hash plus a summary with found/not-found/invalid counts.

4️⃣ `/analyze/batch` — Analyze Multiple Hashes

Method: POST Description: Analyze up to 500 hashes in a single request. Returns individual results for each hash plus a summary with found/not-found/invalid counts.

Request Body

Parameter	Type	Required	Description
hashes	array	Yes	Array of hash strings (MD5/SHA1/SHA256). Max 500.

{
  "hashes": [
    "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "d41d8cd98f00b204e9800998ecf8427e"
  ]
}

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "found": true,
        "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "query_algorithm": "sha256",
        "verdict": "malicious",
        "confidence": 0.98,
        "tags": "mirai,botnet",
        "source": "MalwareBazaar",
        "votes": 12,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": "2026-08-26T12:00:00+00:00"
      },
      {
        "found": false,
        "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "query_algorithm": "sha256",
        "verdict": "unknown",
        "confidence": null, "tags": [], "source": null, "votes": 0,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": null
      },
      {
        "found": false,
        "query_hash": "d41d8cd98f00b204e9800998ecf8427e",
        "query_algorithm": "md5",
        "verdict": "invalid",
        "error": "Unsupported or undetectable hash algorithm",
        "confidence": null, "tags": [], "source": null, "votes": 0,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null, "created_at": null
      }
    ],
    "summary": {
      "total": 3,
      "found": 1,
      "not_found": 1,
      "invalid": 1
    }
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2", "duration_ms": 1.38}
}

Errors

400 → Empty hash list or batch limit exceeded
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: analyze_batch. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`hashes`	body	array	Yes	Array of hash strings (MD5/SHA1/SHA256). Max 500.

SAMPLE RESPONSE

{
  "data": {
    "results": [
      {
        "md5": null,
        "sha1": null,
        "tags": "mirai,botnet",
        "found": true,
        "votes": 12,
        "source": "MalwareBazaar",
        "verdict": "malicious",
        "file_type": null,
        "confidence": 0.98,
        "created_at": "2026-08-26T12:00:00+00:00",
        "first_seen": null,
        "query_hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "query_algorithm": "sha256"
      },
      {
        "md5": null,
        "sha1": null,
        "tags": [],
        "found": false,
        "votes": 0,
        "source": null,
        "verdict": "unknown",
        "file_type": null,
        "confidence": null,
        "created_at": null,
        "first_seen": null,
        "query_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "query_algorithm": "sha256"
      },
      {
        "md5": null,
        "sha1": null,
        "tags": [],
        "error": "Unsupported or undetectable hash algorithm",
        "found": false,
        "votes": 0,
        "source": null,
        "verdict": "invalid",
        "file_type": null,
        "confidence": null,
        "created_at": null,
        "first_seen": null,
        "query_hash": "d41d8cd98f00b204e9800998ecf8427e",
        "query_algorithm": "md5"
      }
    ],
    "summary": {
      "found": 1,
      "total": 3,
      "invalid": 1,
      "not_found": 1
    }
  },
  "meta": {
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2",
    "duration_ms": 1.38
  },
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/file-hash-analyzer/analyze/batch -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"hashes": "example"}'

POST /report/batch Report Batch SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `POST` **Description:** Submit up to 100 verdict reports in a single request. Each report follows the same rules as `/report`. Returns per-hash status (created/updated/error) and a summary.

7️⃣ `/report/batch` — Report Multiple Hashes

Method: POST Description: Submit up to 100 verdict reports in a single request. Each report follows the same rules as /report. Returns per-hash status (created/updated/error) and a summary.

Request Body

Parameter	Type	Required	Description
reports	array	Yes	Array of report objects (max 100)

Each report object:

Field	Type	Required	Description
hash	string	Yes	Hash to report
verdict	string	Yes	`malicious`, `safe`, or `unknown`
tags	array	No	Tag strings
source	string	No	Source attribution
algorithm	string	No	Force hash algo
file_type	string	No	File type label
first_seen	string	No	ISO date

{
  "reports": [
    {
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "verdict": "malicious",
      "tags": ["emotet"],
      "source": "ScannerX"
    },
    {
      "hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "verdict": "safe",
      "tags": ["known-good"],
      "source": "WhitelistDB"
    }
  ]
}

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {"hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702", "status": "updated"},
      {"hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "status": "created"}
    ],
    "summary": {"total": 2, "errors": 0}
  },
  "meta": {"request_id": "a1b2c3d4e5f6", "api_version": "0.0.2"}
}

Errors

400 → Empty reports list or batch limit exceeded
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: report_batch. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`reports`	body	array	Yes	Array of up to 100 report objects. Each item uses the same `hash`, `verdict`, and optional metadata fields as `POST /report`.

SAMPLE REQUEST

{
  "reports": [
    {
      "hash": "d41d8cd98f00b204e9800998ecf8427e",
      "verdict": "malicious"
    }
  ]
}

SAMPLE RESPONSE

{
  "data": {
    "results": [
      {
        "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "status": "updated"
      },
      {
        "hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "status": "created"
      }
    ],
    "summary": {
      "total": 2,
      "errors": 0
    }
  },
  "meta": {
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/file-hash-analyzer/report/batch -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"reports": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "verdict": "malicious"}]}'

GROUP / 04

Cryptography

Cryptography endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

GET /hash/{hash_value} Lookup Rest SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` **Description:** RESTful single-hash lookup. Same as `/analyze` but the hash goes in the URL path instead of a query parameter. Useful for URL-based integrations and gateway routing.

5️⃣ `/hash/<hash>` — RESTful Hash Lookup

Method: GET Description: RESTful single-hash lookup. Same as /analyze but the hash goes in the URL path instead of a query parameter. Useful for URL-based integrations and gateway routing.

Request Parameters

Parameter	Type	Required	Description
hash (path)	string	Yes	The hash to look up (MD5/SHA1/SHA256)

Request Example

GET https://file-hash-analyzer-api.p.rapidapi.com/hash/f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702

Response: Same shape as /analyze above.

Source contract imported from file hash analyzer/app.py. Handler: lookup_rest. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`hash_value`	path	string	Yes	MD5, SHA-1, or SHA-256 hash to look up in the URL path.

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/hash/44d88612fea8a8f36de82e1278abb02f -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 05

Report

Report endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

POST /report Report SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `POST` **Description:** Crowdsource a hash, adding a new entry or updating an existing one. If the hash already exists, tags are merged and the vote count increments.

6️⃣ `/report` — Report a Hash

Method: POST Description: Crowdsource a hash, adding a new entry or updating an existing one. If the hash already exists, tags are merged and the vote count increments.

Request Body

Parameter	Type	Required	Description
hash	string	Yes	Hash to report (MD5/SHA1/SHA256)
verdict	string	Yes	`malicious`, `safe`, or `unknown`
algorithm	string	No	Force hash algo. Auto-detected if omitted.
tags	array	No	Array of tag strings (family names, behaviors)
source	string	No	Source attribution string
file_type	string	No	File type label
first_seen	string	No	ISO date when first observed
md5	string	No	MD5 hash (32 hex chars)
sha1	string	No	SHA1 hash (40 hex chars)

{
  "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
  "verdict": "malicious",
  "tags": ["emotet", "banker", "trojan"],
  "source": "InternalSOC",
  "file_type": "peexe",
  "first_seen": "2026-08-01",
  "md5": "abc12345678901234567890123456789",
  "sha1": "def4567890123456789012345678901234567890"
}

Response Examples

201 Created (new entry added)

{
  "success": true,
  "data": {
    "status": "created",
    "entry": {
      "id": 1117365,
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "algorithm": "sha256",
      "verdict": "malicious",
      "tags": "banker,emotet,trojan",
      "source": "InternalSOC",
      "votes": 1,
      "md5": "abc12345678901234567890123456789",
      "sha1": "def4567890123456789012345678901234567890",
      "file_type": "peexe",
      "first_seen": "2026-08-01",
      "created_at": "2026-08-26T23:45:00+00:00"
    }
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

200 OK (existing entry updated)

{
  "success": true,
  "data": {
    "status": "updated",
    "entry": {
      "id": 42,
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "algorithm": "sha256",
      "verdict": "malicious",
      "tags": "banker,emotet,trojan",
      "source": "InternalSOC",
      "votes": 13,
      "md5": "abc12345678901234567890123456789",
      "sha1": "def4567890123456789012345678901234567890",
      "file_type": "peexe",
      "first_seen": "2026-08-01",
      "created_at": "2026-08-26T12:00:00+00:00"
    }
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

400 → Invalid hash, unsupported algorithm, or invalid verdict
409 → Hash already exists (integrity conflict)
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: report. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`hash`	body	string	Yes	Hash to report (MD5/SHA1/SHA256)
`verdict`	body	string	Yes	`malicious`, `safe`, or `unknown`
`algorithm`	body	string	No	Force hash algo. Auto-detected if omitted.
`tags`	body	array	No	Array of tag strings (family names, behaviors)
`source`	body	string	No	Source attribution string
`file_type`	body	string	No	File type label
`first_seen`	body	string	No	ISO date when first observed
`md5`	body	string	No	MD5 hash (32 hex chars)
`sha1`	body	string	No	SHA1 hash (40 hex chars)

SAMPLE RESPONSE

{
  "data": {
    "entry": {
      "id": 1117365,
      "md5": "abc12345678901234567890123456789",
      "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
      "sha1": "def4567890123456789012345678901234567890",
      "tags": "banker,emotet,trojan",
      "votes": 1,
      "source": "InternalSOC",
      "verdict": "malicious",
      "algorithm": "sha256",
      "file_type": "peexe",
      "created_at": "2026-08-26T23:45:00+00:00",
      "first_seen": "2026-08-01"
    },
    "status": "created"
  },
  "meta": {
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/file-hash-analyzer/report -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"hash": "example", "verdict": "example", "algorithm": "example", "tags": "example", "source": "example", "file_type": "example", "first_seen": "example", "md5": "example", "sha1": "example"}'

GROUP / 06

Search

Search endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

GET /search Search SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` **Description:** Search by family/tag name, hex prefix, verdict, or source. Paginated (max 100 per page). If `q` is 6+ hex characters, searches as a hash prefix. Otherwise searches as a family/tag keyword using full-text search. Results are ordered by most recently added.

8️⃣ `/search` — Search Database

Method: GET Description: Search by family/tag name, hex prefix, verdict, or source. Paginated (max 100 per page). If q is 6+ hex characters, searches as a hash prefix. Otherwise searches as a family/tag keyword using full-text search. Results are ordered by most recently added.

Request Parameters

Parameter	Type	Required	Description
q	string	No	Search query: tag/family name OR hex prefix (6+ hex chars)
verdict	string	No	Filter: `malicious`, `safe`, or `unknown`
source	string	No	Filter by source substring
page	int	No	Page number (default 1)
per_page	int	No	Results per page, 1-100 (default 20)

Request Examples

GET https://file-hash-analyzer-api.p.rapidapi.com/search?q=emotet&verdict=malicious
GET https://file-hash-analyzer-api.p.rapidapi.com/search?q=000000&per_page=10
GET https://file-hash-analyzer-api.p.rapidapi.com/search?verdict=safe&page=2&per_page=50

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "id": 1,
        "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "algorithm": "sha256",
        "verdict": "malicious",
        "tags": "emotet,banker,trojan",
        "source": "MalwareBazaar",
        "votes": 12,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": "2026-01-15",
        "created_at": "2026-08-26T12:00:00+00:00"
      }
    ]
  },
  "meta": {
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2",
    "page": 1,
    "per_page": 20,
    "total": 412,
    "pages": 21
  }
}

Errors

400 → Invalid page/per_page value
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: search. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`q`	query	string	No	Search query: tag/family name OR hex prefix (6+ hex chars)
`verdict`	query	string	No	Filter: `malicious`, `safe`, or `unknown`
`source`	query	string	No	Filter by source substring
`page`	query	integer	No	Page number (default 1)
`per_page`	query	integer	No	Results per page, 1-100 (default 20)

SAMPLE RESPONSE

{
  "data": {
    "results": [
      {
        "id": 1,
        "md5": null,
        "hash": "f50e1120cc6cb993c6f6ba8c734df7855df0cd37cf634d407abffbb9f0660702",
        "sha1": null,
        "tags": "emotet,banker,trojan",
        "votes": 12,
        "source": "MalwareBazaar",
        "verdict": "malicious",
        "algorithm": "sha256",
        "file_type": null,
        "created_at": "2026-08-26T12:00:00+00:00",
        "first_seen": "2026-01-15"
      }
    ]
  },
  "meta": {
    "page": 1,
    "pages": 21,
    "total": 412,
    "per_page": 20,
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X GET 'https://api.dakidarts.com/file-hash-analyzer/search?page=1&per_page=20' -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 07

Recent

Recent endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

GET /recent Recent SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` **Description:** Browse the most recently added/updated hashes, ordered by creation time descending. Optionally filter by verdict.

9️⃣ `/recent` — Recently Added Entries

Method: GET Description: Browse the most recently added/updated hashes, ordered by creation time descending. Optionally filter by verdict.

Request Parameters

Parameter	Type	Required	Description
page	int	No	Page number (default 1)
per_page	int	No	Results per page, 1-100 (default 20)
verdict	string	No	Filter: `malicious`, `safe`, or `unknown`

Request Examples

GET https://file-hash-analyzer-api.p.rapidapi.com/recent?per_page=10
GET https://file-hash-analyzer-api.p.rapidapi.com/recent?verdict=malicious&page=2

Response (200 OK)

{
  "success": true,
  "data": {
    "results": [
      {
        "id": 1117364,
        "hash": "abc123def456...",
        "algorithm": "sha256",
        "verdict": "malicious",
        "tags": "mirai,botnet",
        "source": "MalwareBazaar",
        "votes": 1,
        "md5": null, "sha1": null, "file_type": null,
        "first_seen": null,
        "created_at": "2026-08-26T23:34:00+00:00"
      }
    ]
  },
  "meta": {
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2",
    "page": 1,
    "per_page": 10,
    "total": 1117364,
    "pages": 111737
  }
}

Errors

400 → Invalid page/per_page value or verdict
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: recent. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`page`	query	integer	No	Page number (default 1)
`per_page`	query	integer	No	Results per page, 1-100 (default 20)
`verdict`	query	string	No	Filter: `malicious`, `safe`, or `unknown`

SAMPLE RESPONSE

{
  "data": {
    "results": [
      {
        "id": 1117364,
        "md5": null,
        "hash": "abc123def456...",
        "sha1": null,
        "tags": "mirai,botnet",
        "votes": 1,
        "source": "MalwareBazaar",
        "verdict": "malicious",
        "algorithm": "sha256",
        "file_type": null,
        "created_at": "2026-08-26T23:34:00+00:00",
        "first_seen": null
      }
    ]
  },
  "meta": {
    "page": 1,
    "pages": 111737,
    "total": 1117364,
    "per_page": 10,
    "request_id": "a1b2c3d4e5f6",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X GET 'https://api.dakidarts.com/file-hash-analyzer/recent?page=1&per_page=20' -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 08

Families

Families endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

GET /families Families SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

**Method:** `GET` **Description:** Returns a breakdown of malware families (tags) sorted by prevalence. Shows total count plus malicious/safe/unknown sub-counts per family.

🔟 `/families` — Malware Family Breakdown

Method: GET Description: Returns a breakdown of malware families (tags) sorted by prevalence. Shows total count plus malicious/safe/unknown sub-counts per family.

Request Parameters

Parameter	Type	Required	Description
limit	int	No	Max families to return, 1-100 (default 20)

Request Example

GET https://file-hash-analyzer-api.p.rapidapi.com/families?limit=10

Response (200 OK)

{
  "success": true,
  "data": {
    "families": [
      {"family": "mirai", "count": 4210, "malicious": 4200, "safe": 0, "unknown": 10},
      {"family": "heodo", "count": 3800, "malicious": 3790, "safe": 5, "unknown": 5},
      {"family": "emotet", "count": 2560, "malicious": 2555, "safe": 0, "unknown": 5},
      {"family": "agenttesla", "count": 1890, "malicious": 1885, "safe": 0, "unknown": 5},
      {"family": "formbook", "count": 1620, "malicious": 1615, "safe": 0, "unknown": 5}
    ],
    "total_families": 2161
  },
  "meta": {"request_id": "d9ab522232f2", "api_version": "0.0.2"}
}

Errors

400 → Invalid limit value
500 → Internal server error

Source contract imported from file hash analyzer/app.py. Handler: families. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`limit`	query	integer	No	Max families to return, 1-100 (default 20)

SAMPLE RESPONSE

{
  "data": {
    "families": [
      {
        "safe": 0,
        "count": 4210,
        "family": "mirai",
        "unknown": 10,
        "malicious": 4200
      },
      {
        "safe": 5,
        "count": 3800,
        "family": "heodo",
        "unknown": 5,
        "malicious": 3790
      },
      {
        "safe": 0,
        "count": 2560,
        "family": "emotet",
        "unknown": 5,
        "malicious": 2555
      },
      {
        "safe": 0,
        "count": 1890,
        "family": "agenttesla",
        "unknown": 5,
        "malicious": 1885
      },
      {
        "safe": 0,
        "count": 1620,
        "family": "formbook",
        "unknown": 5,
        "malicious": 1615
      }
    ],
    "total_families": 2161
  },
  "meta": {
    "request_id": "d9ab522232f2",
    "api_version": "0.0.2"
  },
  "success": true
}

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/families -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 09

Stats

Stats endpoints sourced from the File Hash Analyzer API implementation.

1 endpoint

GET /stats Stats SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Database-level statistics.

`GET /stats`

Database-level statistics.

Response data

{
  "total": 15432,
  "malicious": 14900,
  "safe": 400,
  "unknown": 132,
  "top_tags": [["emotet", 412], ["agenttesla", 300]],
  "top_malicious_tags": [["emotet", 410]],
  "top_sources": [["MalwareBazaar", 14800], ["crowd", 632]],
  "last_sync": "2026-08-08T12:00:00.000Z"
}

Source contract imported from file hash analyzer/app.py. Handler: stats. Reference: docs/endpoints.md.

SAMPLE RESPONSE

{
  "safe": 400,
  "total": 15432,
  "unknown": 132,
  "top_tags": [
    [
      "emotet",
      412
    ],
    [
      "agenttesla",
      300
    ]
  ],
  "last_sync": "2026-08-08T12:00:00.000Z",
  "malicious": 14900,
  "top_sources": [
    [
      "MalwareBazaar",
      14800
    ],
    [
      "crowd",
      632
    ]
  ],
  "top_malicious_tags": [
    [
      "emotet",
      410
    ]
  ]
}

QUICK CURL

curl -X GET https://api.dakidarts.com/file-hash-analyzer/stats -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

INTERACTIVE SANDBOX

Explore a response before you integrate.

Edit a JSON request to validate its syntax and preview the published sample response. This stays in your browser; it never calls the live API or uses credits.

The preview checks JSON syntax and shows the saved example response; it does not execute request values.

MOCK RESPONSE

TYPESCRIPT CONTRACT

INTEGRATION SDK

Use the product where it lives.

These are integration templates, not runnable sample calls. Configure an endpoint upstream in API Studio, then replace the placeholder path. Saved samples stay preview-only.

REST/JSON

# Replace with a connected GET route and include any required parameters.
curl -X GET "https://api.dakidarts.com/file-hash-analyzer/v1/your-connected-endpoint" \
  -H "X-API-Key: dk_live_..." \
  -H "Accept: application/json"

# Replace with a connected GET route and include any required parameters.
import requests

headers = {"X-API-Key": "dk_live_..."}
response = requests.get("https://api.dakidarts.com/file-hash-analyzer/v1/your-connected-endpoint", headers=headers)
print(response.json())

// Replace with a connected GET route and include any required parameters.
const res = await fetch("https://api.dakidarts.com/file-hash-analyzer/v1/your-connected-endpoint", {
  headers: { "X-API-Key": "dk_live_..." }
});
const data = await res.json();
console.log(data);

<?php
// Replace with a connected GET route and include any required parameters.
$ch = curl_init("https://api.dakidarts.com/file-hash-analyzer/v1/your-connected-endpoint");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-API-Key: dk_live_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);

Explore more Security and adjacent APIs.

Full catalog

File Hash Analyzer API

Call File Hash Analyzer API through the Dakidarts gateway.

One key, one gateway

Metered by the call

Observable by default

Also available through RapidAPI.

Built to disappear into the product.

Batch analysis for up to 500 hashes

RESTful single-hash lookup and paginated search

Optional MalwareBazaar sync requires its configured API key

The shape of the surface.

Answers before you integrate.

Choose a quota that matches the workload.

Pay-as-you-go access

From first request to production.

Create a Dakidarts key

Call the gateway

Watch usage

Endpoint reference & metered costs.

Operations

GET /

2️⃣ /health — Health Check

Analysis

3️⃣ /analyze — Analyze a Hash

3️⃣ /analyze — Analyze a Hash

Batch operations

4️⃣ /analyze/batch — Analyze Multiple Hashes

7️⃣ /report/batch — Report Multiple Hashes

Cryptography

5️⃣ /hash/<hash> — RESTful Hash Lookup

Report

6️⃣ /report — Report a Hash

Search

8️⃣ /search — Search Database

Recent

9️⃣ /recent — Recently Added Entries

Families

🔟 /families — Malware Family Breakdown

Stats

GET /stats

Explore a response before you integrate.

Use the product where it lives.

Explore more Security and adjacent APIs.

IP Reputation Checker API

Malware & Phishing URL Scanner API

Dark Web Exposure API

`GET /`

2️⃣ `/health` — Health Check

3️⃣ `/analyze` — Analyze a Hash

3️⃣ `/analyze` — Analyze a Hash

4️⃣ `/analyze/batch` — Analyze Multiple Hashes

7️⃣ `/report/batch` — Report Multiple Hashes

5️⃣ `/hash/<hash>` — RESTful Hash Lookup

6️⃣ `/report` — Report a Hash

8️⃣ `/search` — Search Database

9️⃣ `/recent` — Recently Added Entries

🔟 `/families` — Malware Family Breakdown

`GET /stats`