WildFire API Reference
  • WildFire API Reference
  • All Documentation
WildFire API Reference
: Submit a Sample Verdict Change (API)
Focus
Download PDF
Focus
  1. Home
  2. WildFire
  3. WildFire API Reference
  4. Submit Files and Links through the WildFire API
  5. Submit a Sample Verdict Change (API)
Download PDF

WildFire API Reference

Submit a Sample Verdict Change (API)

Table of Contents
Changes the WildFire verdict applied to a sample. Verdict changes apply only to those samples submitted to the WildFire appliance, and the verdict for the same sample remains unchanged in the WildFire global cloud. Use this resource to update incorrect verdicts generated by local WildFire analysis.
The WildFire private cloud content package is updated to reflect any verdict changes that you make (on the firewall, select DeviceDynamic UpdatesWF-Private to enable WildFire private cloud content updates). When you change a sample verdict to malicious, the WildFire appliance generates a new signature to detect the malware and adds that signature to the WildFire private cloud content package. When you change a sample verdict to benign, the WildFire appliance removes the signature from the WildFire private cloud content package.

Resource

/submit/local-verdict-change/

Request Parameters

Use the following parameters when changing a WildFire appliance verdict for a sample:
Parameters
Description
Example
 
apikey
(Required) API key
Example:
apikey=<API KEY>
agent
(Required for Prisma Access and Prisma Cloud Compute-based WildFire public API keys) Designates the API key type
Example:
agent=pcc
Options include:
  • pcc—for use with Prisma Cloud Compute-based WildFire public API keys
  • prismaaccessapi—for use with Prisma Access-based WildFire public API keys
hash
(Required) SHA-256 hash value of the sample
Example:
hash=afe6b95ad95bc689c356f34
	ec8d9094c495e4af57c932ac413b65ef132063acc
comment
(Required) A description of the change request in quotes, with a maximum length of 2,048 characters.
Example:
comment=This
is a legitimate sample that erroneously generated a value of malware.
Modifying
to benign.
verdict
(Required) The new verdict to be applied to the sample
The verdict value can have one of the following:
  • 0: benign
  • 1: malware
  • 2: grayware
  • 4: phishing (Applicable only to samples processed through email link analysis.)
Example:
verdict=1

Example Request

Make a POST request to the /submit/local-verdict-change resource and include the API key, the SHA-256 hash value of the sample, the desired verdict for the sample, and a comment with a description of the change.
In the request, include the API key, the hash value of the sample, and the new verdict for the sample:
curl
-k -F ‘apikey=<API KEY>’ -F ‘hash=afe6b95ad95bc689c356f34ec8d9094c495e4af57c932ac413b65ef132063acc’
-F ‘verdict=1’ -F ‘comment=changing verdict from benign to malicious’
‘https://10.1.1.1/publicapi/submit/local-verdict-change’
The XML response verifies a successful verdict change. Example:
<wildfire> 
    <body>verdict is changed (old verdict: 0, new verdict:1)</body> 
    <headers/> 
</wildfire>

Technical Documentation

Company

Legal Notices

© 2025 Palo Alto Networks, Inc. All rights reserved.