Skip to main content

List Functions

GET /functions
Returns a collection of functions in the system.
start
integer
default:"0"
Starting index for pagination
limit
integer
default:"0"
Maximum number of functions to return (0 for all)
status
string
Response status
data
object
Dictionary of functions keyed by function_id
{
  "status": "successful",
  "data": {
    "1": {
      "function_id": 1,
      "sample_id": 1,
      "offset": 4096,
      "function_name": "sub_1000",
      "num_instructions": 250,
      "pichash": "abcdef0123456789"
    }
  }
}

Get Function

GET /functions/{function_id}
Returns detailed information about a specific function.
function_id
integer
required
ID of the function to retrieve
with_xcfg
boolean
default:"false"
Include extended control flow graph data
status
string
Response status
data
object
Function details including:
  • Basic metadata (function_id, sample_id, offset)
  • Hashes (PicHash, MinHash)
  • Statistics (num_instructions, num_blocks)
  • Optionally extended CFG data
{
  "status": "successful",
  "data": {
    "function_id": 1,
    "sample_id": 1,
    "offset": 4096,
    "function_name": "sub_1000",
    "num_instructions": 250,
    "num_blocks": 15,
    "pichash": "abcdef0123456789",
    "minhash": [123, 456, 789],
    "function_labels": ["crypto", "encryption"]
  }
}

Get Multiple Functions

POST /functions
Returns information for multiple functions specified by their IDs.
with_label_only
boolean
default:"false"
Only return functions that have labels
function_ids
string
required
Comma-separated list of function IDs (e.g., “1,2,3,4”)
status
string
Response status
data
object
Dictionary of functions keyed by function_id
{
  "status": "successful",
  "data": {
    "1": {
      "function_id": 1,
      "function_name": "sub_1000",
      "function_labels": ["crypto"]
    },
    "2": {
      "function_id": 2,
      "function_name": "sub_2000",
      "function_labels": ["network"]
    }
  }
}

Build docs developers (and LLMs) love