Search by one source

Method: POST http://IP-Address:port/prefix/search/(auto|face|vmda|stranger)/DETECTORID/BEGINTIME/ENDTIME

Where

• auto|face|vmda|stranger – search type.

• DETECTORID – endpoint detection tool ternary ID (HOSTNAME/AVDetector.ID/EventSupplier for auto and face search, HOSTNAME/AVDetector.ID/SourceEndpoint.vmda for vmda, see Get list of detection tools).

• ENDTIME, BEGINTIME – time in ISO format.

A request for search on a single computer is also supported for auto and face search, the request structure is as follows:

http://localhost/prefix/search/(auto|face)/HOSTID/BEGINTIME/ENDTIME,

where HOSTID is a computer name.

Search by multiple sources

Method: POST http://IP-Address:port/prefix/search/(auto|face|vmda|stranger)/BEGINTIME/ENDTIME

This search type always accepts JSON in the POST body that is to include at least one section of the form:

"sources": [
		"hosts/Server1/AVDetector.1/EventSupplier"
	]

When the search request is performed, JSON is to include image in base64 format.

{
	"sources": [
					"hosts/Server1/AVDetector.1/EventSupplier",
					"hosts/Server1/AVDetector.2/EventSupplier"
			],
    "image" : "base64 encoded image"
}

Result

The request will return either error or response like:

HTTP/1.1 202 Accepted
Connection: Close
Location: /search/(auto|face|vmda|stranger)/GUID 
Cache-Control: no-cache

The Location field contains an identifier for future access to search results. Example: /search/vmda/3dc15b75-6463-4eb1-ab2d-0eb0a8f54bd3

Receiving the Accepted code does not guarantee successful execution of the search. This code only shows that the command has been taken to process.

Error codes:

400 – incorrect request.

500 – internal Server error.