SymGraph API

Build on SymGraph with a public REST API for binaries, symbols, graph data, analysis jobs, and account automation.

Getting Started

1. Create a SymGraph account and sign in.
2. Open your account settings to create an API key.
3. Use either a bearer token or the X-API-Key header for authenticated requests.
4. Start by looking up a binary by SHA256, then layer on symbols, graph data, and analysis workflows.

Authentication

SymGraph supports two authentication flows:

• Bearer tokens: authenticate with POST /api/v1/auth/login, then send Authorization: Bearer <token>.
• API keys: create keys in the product UI, then send X-API-Key: <key>.

Refresh access tokens with POST /api/v1/auth/refresh when you are using the JWT login flow.

Base URL

https://symgraph.ai/api/v1

In local development, the API is typically exposed behind the same origin and proxied through the web app.

Core Resources

Binaries

Binaries are keyed by SHA256 and act as the root object for most workflows. Query them directly, search by metadata, and attach higher-level intelligence as your analysis progresses.

Symbols

Symbols capture names, types, comments, and other recovered semantic information. Symbol history is versioned and preserves provenance so you can understand where each contribution came from.

Graph Data

Graph nodes and edges model relationships such as calls, data movement, semantic similarity, and higher-level behavioral structure within a binary.

Analysis Jobs

Analysis jobs let you submit work to the platform, poll for progress, and retrieve worker-generated output once processing completes.

Response Conventions

• Successful responses return JSON unless the endpoint is explicitly documented otherwise.
• Errors return JSON with an error field.
• Rate-limit information is exposed through X-RateLimit-* headers where applicable.

{
  "error": "descriptive error message"
}

Example

curl \
  -H "Authorization: Bearer $TOKEN" \
  https://symgraph.ai/api/v1/binaries/<sha256>/symbols

Reference

Use the interactive API reference for the complete OpenAPI surface, schemas, and endpoint-level authentication details.