hashlookup CIRCL API

Name: hashlookup CIRCL API API
Brand: hashlookup CIRCL API
Availability: InStock

✓ Official Vendor SpecSecurityThreat Detectionnone11 EndpointsREST

For Agents

Look up file hashes (MD5, SHA-1, SHA-256) against the CIRCL hashlookup known-files database to identify known-good or known-bad files during DFIR and malware triage. Supports single and bulk lookups across 11 endpoints.

Connect the hashlookup CIRCL API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the hashlookup CIRCL API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with hashlookup CIRCL API API.

Look up an MD5 hash to determine whether a file is in the known-files dataset

Look up an SHA-1 or SHA-256 hash for forensic triage of recovered files

Submit a JSON array of MD5 or SHA-1 hashes for bulk lookup in a single request

Walk parent and child relationships between related files using paginated SHA-1 traversal

GET STARTED

Start building with hashlookup CIRCL API API

Explore with Jentic

View OpenAPI Document

CIRCL hashlookup is a free, public threat-intelligence service from the Computer Incident Response Center Luxembourg that lets investigators check file hashes against a known-files database covering NSRL, manufacturer software releases, and other curated datasets. The API exposes 11 endpoints over https://hashlookup.circl.lu, supporting MD5, SHA-1, and SHA-256 lookups, bulk lookups for batches, and parent or child relationship traversal between related files. It is widely used in DFIR, malware triage, and software supply-chain checks to quickly separate known-good files from candidates that warrant deeper analysis. The service is open and licensed CC-BY, with optional session keys to retain context across queries.

Use Cases

Patterns agents use hashlookup CIRCL API API for, with concrete tasks.

★ DFIR Triage of a Forensic Image

During digital forensics and incident response, investigators commonly need to filter out known-good operating-system and application files so they can focus on suspicious binaries. CIRCL hashlookup accepts MD5, SHA-1, or SHA-256 lookups against datasets that include NSRL, allowing a triage script to run thousands of file hashes from an evidence image and quickly separate known files from unknowns. Bulk endpoints reduce round-trips and finish a typical workstation triage in minutes.

POST a JSON body with a hashes array of 500 MD5 values to /bulk/md5 and return the list that matched the CIRCL dataset.

Malware Sample Pre-Check

Before submitting a suspected sample to a sandbox, an analyst can call /lookup/sha256/{sha256} to check whether CIRCL already recognises the hash as a known-good file from a manufacturer release. This shortcuts false positives on legitimate signed binaries — a common situation when EDR alerts on a hash that matches a known build artifact.

GET /lookup/sha256/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 and return whether the file is in the known-files dataset.

Software Supply-Chain Verification

Build pipelines and software bill-of-materials tooling can use the parent and child traversal endpoints to verify that an artefact's hash maps to a known component family. /parents and /children take a SHA-1, count, and cursor, returning paginated relationship data so a CI job can confirm an installer or library belongs to an expected upstream package set.

GET /parents/{sha1}/100/0 for sha1=da39a3ee5e6b4b0d3255bfef95601890afd80709 and list the parent file hashes returned.

AI Agent SOC Assist

An AI agent invoked through Jentic can take a list of file hashes flagged by an EDR alert, query CIRCL hashlookup, and return a summary of which are known-good versus unknown — without holding any credentials, since CIRCL hashlookup is unauthenticated. Jentic standardises the call shape so the agent does not need to learn the URL pattern for each hash type.

Search Jentic for 'lookup file hash in CIRCL hashlookup', load the GET /lookup/sha1/{sha1} schema, and call it for each SHA-1 from the alert payload.

Key Endpoints

11 endpoints — circl hashlookup is a free, public threat-intelligence service from the computer incident response center luxembourg that lets investigators check file hashes against a known-files database covering nsrl, manufacturer software releases, and other curated datasets.

METHOD

PATH

DESCRIPTION

GET

/lookup/md5/{md5}

Look up a single MD5 hash

GET

/lookup/sha1/{sha1}

Look up a single SHA-1 hash

GET

/lookup/sha256/{sha256}

Look up a single SHA-256 hash

POST

/bulk/md5

Bulk lookup an array of MD5 hashes

POST

/bulk/sha1

Bulk lookup an array of SHA-1 hashes

GET

/parents/{sha1}/{count}/{cursor}

Paginated parents of a SHA-1

GET

/info

Database info and dataset coverage

GET

/lookup/md5/{md5}

Look up a single MD5 hash

GET

/lookup/sha1/{sha1}

Look up a single SHA-1 hash

GET

/lookup/sha256/{sha256}

Look up a single SHA-256 hash

POST

/bulk/md5

Bulk lookup an array of MD5 hashes

POST

/bulk/sha1

Bulk lookup an array of SHA-1 hashes

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CIRCL hashlookup is unauthenticated, so there are no credentials to manage. Jentic still routes the request through MAXsystem so the agent's egress IP and rate-limit budget are isolated from other tenants.

Intent-based discovery

Agents search Jentic by intent (e.g., 'check whether an MD5 hash is known') and Jentic returns the matching CIRCL hashlookup operation with its parameter schema, removing the need to memorise the per-hash-type URL pattern.

Time to first call

Direct CIRCL integration: a few hours to wire HTTP, error handling, and bulk batching. Through Jentic: under 15 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Cisco API

Cisco security telemetry combines well with CIRCL hashlookup for endpoint hash enrichment.

Use Cisco APIs to fetch the alert hash, then query CIRCL hashlookup to check if it is known-good before escalating.

Complementary

Circle API

Circle hosts security communities that consume CIRCL threat-intel data.

Use Circle to publish triage findings to a community space after enriching hashes via CIRCL hashlookup.

Complementary

CINNOX API

CINNOX delivers security alert messaging while CIRCL hashlookup enriches the underlying IOCs.

Use CINNOX to notify a SOC channel after CIRCL hashlookup confirms an unknown hash worth escalating.

FAQs

Specific to using hashlookup CIRCL API API through Jentic.

What authentication does the CIRCL hashlookup API use?

CIRCL hashlookup is a free public service and does not require authentication — there is no API key. Through Jentic, you can call it without configuring any credential and Jentic will execute the request directly against https://hashlookup.circl.lu.

Can I look up SHA-256 hashes with the CIRCL hashlookup API?

Yes. GET /lookup/sha256/{sha256} returns dataset metadata for a single SHA-256 hash. The API also supports MD5 via /lookup/md5/{md5} and SHA-1 via /lookup/sha1/{sha1}, with bulk equivalents for MD5 and SHA-1.

What are the rate limits for CIRCL hashlookup?

CIRCL does not publish hard rate limits in the OpenAPI spec, but the service is community-funded, so respect fair-use guidance on the project page and prefer the bulk endpoints for batches. Jentic surfaces 429 responses transparently if throttling is applied.

How do I bulk-check a list of MD5 hashes through Jentic?

Run pip install jentic, then search Jentic for 'bulk hash lookup CIRCL'. Jentic returns the POST /bulk/md5 operation. Load the schema, supply a JSON body with a 'hashes' array of MD5 strings, and execute. Sign up at https://app.jentic.com/sign-up.

What datasets does CIRCL hashlookup cover?

The dataset includes NSRL (NIST National Software Reference Library), manufacturer software releases, and other curated known-files sources. Call GET /info to retrieve current dataset metadata and coverage. Combined with /stats/top this lets you confirm freshness before relying on results for triage.

Can I traverse relationships between known files?

Yes. GET /parents/{sha1}/{count}/{cursor} and GET /children/{sha1}/{count}/{cursor} return paginated parent and child SHA-1 hashes for a given file, useful for mapping installer to component relationships in supply-chain verification.