ThreatLocker Upload Requests
upload_requestsRequest forensic file uploads from endpoints and retrieve existing upload requests for security investigation.
Instructions
Request and retrieve forensic file uploads from endpoints.
Common workflows:
Request a file upload: action=insert, uploadRequestId=, organizationId="...", computerId="...", shA256="..." (or filepath)
Retrieve an upload request: action=get, uploadRequestId="..."
Pitfalls:
The SHA-256 field is literally "shA256" (odd casing) in the API.
insert requires you to supply a fresh uploadRequestId GUID.
Writes are payload-verified, NOT live-tested.
Permissions: View Unified Audit / forensics.
Related tools: action_log (locate the file event), computers (get computerId)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hash | No | ThreatLocker hash of the file. | |
| action | Yes | insert=request a file upload from an endpoint (forensics), get=retrieve an upload request | |
| shA256 | No | SHA-256 of the file (note the API field casing "shA256"). | |
| filename | No | File name to upload. | |
| filepath | No | Full file path (use \\ for backslashes). | |
| computerId | No | Computer GUID the file lives on (required for insert). | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| organizationId | No | Organization GUID (required for insert). | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| uploadRequestId | No | Upload-request GUID. For insert, supply a NEW GUID; for get, the existing one. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |