Reversing Labs Settings
Manage the appliance-wide Reversing Labs (file reputation) connection settings.
/api/v1/reversing-labs/settings
Get the Reversing Labs settings
Returns the current Reversing Labs connection settings. The password is never returned; hasPassword indicates whether one is stored.
/api/v1/reversing-labs/settings › Responses
The current Reversing Labs settings
enabledWhether file-reputation lookups are enabled.
endpointThe Reversing Labs hash-lookup URL. The same for every appliance, owned by Halo and reported here for reference; no request accepts it.
usernameThe Reversing Labs username.
timeoutSecondsThe lookup timeout in seconds (1-120 inclusive).
hasPasswordWhether a password is currently stored.
credentialsExternallyManagedWhether the credential is held in a secret Halo cannot write (external-secrets owns it, or the Engine has no permission on it). A write that changes the password will be refused with a 409; the endpoint, timeout and enabled state are still writable.
credentialGuidanceHow to update the credential out of band, when it is externally managed. Null otherwise.
/api/v1/reversing-labs/settings
Save the Reversing Labs settings
Saves the Reversing Labs connection settings. A password is required when configuring for the first time; a blank password on a subsequent save leaves the stored one unchanged. When enabling, a connection test must pass against the values being saved. A save that sets enabled to false ignores the credentials and timeout: the timeout range is not enforced, no connection test runs, and the stored connection values are kept where the supplied ones cannot be used. The hash-lookup URL is Halo's own and cannot be set here.
/api/v1/reversing-labs/settings › Request Body
enabledWhether file-reputation lookups are enabled.
timeoutSecondsThe lookup timeout in seconds. Must be between 1 and 120 inclusive when enabled is true, or when testing a connection; ignored by a write that sets enabled to false.
usernameThe Reversing Labs username.
passwordThe Reversing Labs password. Required on first configuration; blank on a subsequent save preserves the stored value. Never returned by any response.
/api/v1/reversing-labs/settings › Responses
The saved Reversing Labs settings
enabledWhether file-reputation lookups are enabled.
endpointThe Reversing Labs hash-lookup URL. The same for every appliance, owned by Halo and reported here for reference; no request accepts it.
usernameThe Reversing Labs username.
timeoutSecondsThe lookup timeout in seconds (1-120 inclusive).
hasPasswordWhether a password is currently stored.
credentialsExternallyManagedWhether the credential is held in a secret Halo cannot write (external-secrets owns it, or the Engine has no permission on it). A write that changes the password will be refused with a 409; the endpoint, timeout and enabled state are still writable.
credentialGuidanceHow to update the credential out of band, when it is externally managed. Null otherwise.
/api/v1/reversing-labs/test-connection
Test the Reversing Labs connection
Tests a connection to Reversing Labs using the supplied candidate credentials, without saving them. A blank password uses the stored one. The lookup is bounded by the candidate timeout and goes to Halo's own hash-lookup URL. The timeout is always validated here, including when enabled is false, because a test uses it either way.
/api/v1/reversing-labs/test-connection › Request Body
enabledWhether file-reputation lookups are enabled.
timeoutSecondsThe lookup timeout in seconds. Must be between 1 and 120 inclusive when enabled is true, or when testing a connection; ignored by a write that sets enabled to false.
usernameThe Reversing Labs username.
passwordThe Reversing Labs password. Required on first configuration; blank on a subsequent save preserves the stored value. Never returned by any response.
/api/v1/reversing-labs/test-connection › Responses
The result of the connection test
passedWhether the connection test passed.
outcomeWhat the probe found. Passed and RateLimited are the two that pass. CredentialsRejected means the endpoint answered and refused the credentials. HostNotFound, ConnectionRefused, TlsFailure, Unreachable and TimedOut mean nothing usable answered, and each names a different reason. UnexpectedStatus means the endpoint answered with a status that is not a hash-lookup response. NotRun means the probe did not run and reason says why. Treat an unrecognised value as a failure described by reason.
hostThe host that was probed. Null where no probe ran.
statusCodeThe status the endpoint answered with, where it answered at all.
timeoutSecondsThe timeout the probe was bounded by.
reasonThe reason the test failed, when it did not pass.
warningSet when the test passed but something is nonetheless wrong, currently only an exhausted lookup allowance. Null on a clean pass and on any failure.
retryAfterSecondsThe provider's retry window in seconds, when it gave one.