API reference
4 operations in quarantine. Raw spec: openapi.json.
GET
/api/v1/admin/quarantineGET /api/admin/quarantine — the org's quarantined objects, newest first.
`pending` are still held; `released` were admitted by an operator and keep their row so the override stays visible.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | — | No | Page size. Clamped to 1..=200. |
offset | query | — | No | Rows to skip, from a previous page's `next_offset`. |
Responses
| Status | Description |
|---|---|
200 |
Security: bearer
GET
/api/v1/admin/quarantine/{sha256}GET /api/admin/quarantine/{sha256} — one held or released object.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
sha256 | path | string | Yes |
Responses
| Status | Description |
|---|---|
200 |
Security: bearer
DELETE
/api/v1/admin/quarantine/{sha256}DELETE /api/admin/quarantine/{sha256} — remove the held bytes.
The row goes with them and the fact stays in the audit trail. A released object is refused (409): its bytes are admitted and its trail is evidence.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
sha256 | path | string | Yes | |
reason | query | — | No | Optional note for the audit trail. The default sentence names the action when the operator does not add one. |
Responses
| Status | Description |
|---|---|
204 |
Security: bearer
POST
/api/v1/admin/quarantine/{sha256}/releasePOST /api/admin/quarantine/{sha256}/release — admit the object anyway.
The bytes move from the quarantine key to the canonical attachment key, the row records actor + reason + timestamp, and an `audit_events` row is written in the same transaction. Repeating the call returns the first release unchanged and writes no second audit row.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
sha256 | path | string | Yes |
Request body
ReleaseQuarantineRequest
Responses
| Status | Description |
|---|---|
200 |
Security: bearer