{sha1}: Lookup file by SHA1 hash

API: circl.lu:hashlookup-circl-api
Endpoint: /lookup/sha1/{sha1}
Response format: application/json
Auth: none
Method: GET
Last Status: 200
Latency: 166ms

Description

Returns comprehensive file metadata including filename, size, package associations, and parent containers if the SHA1 hash exists in the database. Use this to identify files by their SHA1 hash and find which software packages contain them.

From spec: Lookup a file by its SHA1 hash. Returns file metadata including name, size, associated packages, and parent containers if the hash is found in the database.

Usage Tips

- Input must be a valid 40-character hexadecimal SHA1 hash - Case-insensitive: 'abc' and 'ABC' are equivalent - Returns 200 OK with 'hashlookup:trust' field even for unknown hashes (check parents array) - Rate limit: Be respectful of the public service

Parameters (1)

sha1 (string, path, required)

SHA1 hash in hexadecimal format (40 characters)

Constraints: {'pattern': '^[a-fA-F0-9]{40}$'}

Examples (1)

Lookup SHA1 hash for 'abc' test string probe-gate

Demonstrates looking up a file by its SHA1 hash (hash of string 'abc')

curl 'https://hashlookup.circl.lu/lookup/sha1/a9993e364706816aba3e25717850c26c9cd0d89d'

import requests

resp = requests.get("https://hashlookup.circl.lu/lookup/sha1/a9993e364706816aba3e25717850c26c9cd0d89d")
data = resp.json()

import zingu_apis

api = zingu_apis.api("circl")
result = api.fetch("lookup/sha1/{sha1}")

for item in result:
    print(item)

const resp = await fetch("https://hashlookup.circl.lu/lookup/sha1/a9993e364706816aba3e25717850c26c9cd0d89d");
const data = await resp.json();

Truncate

Auto Table Raw

Probe History

Latency

Status Codes

Time	Status	Latency
2026-04-16 02:45:36.598128	200	166ms
2026-04-15 04:14:13.518945	200	165ms
2026-04-14 03:00:45.258579	200	157ms
2026-04-12 15:55:17.586851	200	146ms
2026-04-10 03:22:08.293616	200	156ms
2026-04-09 03:48:48.282190	200	112ms
2026-04-08 07:32:44.937962	200	138ms
2026-04-07 00:09:04.309326	200	170ms