---
updatedAt: 2025-08-14T15:52:56.000Z
agentTools:
  siteIndex: https://developer.n-able.com/llms.txt
  projectIndex: https://developer.n-able.com/n-sight/llms.txt
---

# List Managed Antivirus Quarantine

Service name: list_mav_quarantine

## Base URL

```
https://{SERVER}/api/?apikey={yourAPIkey}&service=list_mav_quarantine
```

## Description

Lists the contents of Managed Antivirus (MAV) quarantine. The **items** parameter controls whether to include CURRENT (default), PREVIOUS or ALL items.

## Parameters

### Required parameters

Add required parameters immediately after the base URL.

```
https://{SERVER}/api/?apikey={yourAPIkey}&service=list_mav_quarantine&required_parameters={parameter-value}
```

| Parameter | Description                             | Type    | Options | Default |
| :-------- | :-------------------------------------- | :------ | :------ | :------ |
| deviceid  | The deviceid must be a valid device id. | integer | 0       | 0       |

### Optional parameters

Add optional parameters after the required parameters in the base URL.

```
https://{SERVER}/api/?apikey={yourAPIkey}&service=list_mav_quarantine&required_parameters={parameter-value}&optional_parameters={parameter-value}
```

<HTMLBlock>{`
<table style="width: 100%; border-collapse: collapse;">
<thead>
<tr>
  <th style="border: 1px solid #ddd; padding: 8px;">Parameter</th>
  <th style="border: 1px solid #ddd; padding: 8px;">Description</th>
  <th style="border: 1px solid #ddd; padding: 8px;">Type</th>
  <th style="border: 1px solid #ddd; padding: 8px;">Options</th>
  <th style="border: 1px solid #ddd; padding: 8px;">Default</th>
</tr>
</thead>
<tbody>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p><a href="describe-parameter">describe</a></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Optional. Returns a description of the entered call, the available parameters, an example of its output, and returned fields with descriptions.</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>boolean</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>true</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>0</p>
</td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>items</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Controls whether to include CURRENT, PREVIOUS or ALL items.</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>string</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>CURRENT<br>PREVIOUS<br>ALL</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>current</p>
</td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>v</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Managed Antivirus engine version<br>1 VIPRE engine <br> 2 Bitdefender engine<br>From Dashboard 2019.08.13 this call defaults to version 2 (Bitdefender).</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>integer</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>1 <br> 2</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>2</p>
</td>
</tr>
</tbody>
</table>
`}</HTMLBlock>

### Determine parameter values

Use the following associated service calls to determine parameter values.

| Parameter | Call                                                | URL Format                                                                                                   |
| :-------- | :-------------------------------------------------- | :----------------------------------------------------------------------------------------------------------- |
| deviceid  | [list\_devices\_at\_client](list-devices-at-client) | `https://{SERVER}/api/?apikey=yourAPIkey&service=list_devices_at_client&clientid=CLIENTID&devicetype=server` |
|           | [list\_servers](listing-servers)                    | `https://{SERVER}/api/?apikey=yourAPIkey&service=list_servers&siteid=SITEID`                                 |
|           | [list\_workstations](listing-workstations)          | `https://{SERVER}/api/?apikey=yourAPIkey&service=list_workstations&siteid=SITEID`                            |
| siteid    | [list\_sites](listing-sites)                        | `https://{SERVER}/api/?apikey=yourAPIkey&service=list_sites&clientid=CLIENTID`                               |
| clientid  | [list\_clients](listing-clients)                    | `https://{SERVER}/api/?apikey=yourAPIkey&service=list_clients`                                               |

## Examples

### List the contents of the MAV quarantine

```
https://{SERVER}/api/?apikey={yourAPIkey}&service=list_mav_quarantine&deviceid=DEVICEID&items=ITEMS&v=VERSION
```

#### Example response

```xml
<?xml version="1.0" ?>
<result created="2013-10-09T10:55:41+01:00" host="SERVER" status="OK">
  <quarantined_item>
    <quarantine_id>[unique id for the quarantine item]</quarantine_id>
    <scan_start>[start date and time of scan which quarantined this item]</scan_start>
    <scan_end>[end date and time of scan which quarantined this item]</scan_end>
    <guid>[unique quarantine identifier on the device]</guid>
    <threat_name>[name of threat]</threat_name>
    <threat_category>[category of threat]</threat_category>
    <status>
      [if current item, one of: QUARANTINED, RELEASE_PENDING, DELETE_PENDING, FAILED_TO_RELEASE, FAILED_TO_DELETE]
      [if previous item, one of: RELEASED, DELETED]
    </status>
    <scan_type>[one of: QUICK, DEEP, ACTIVE, CUSTOM]</scan_type>
    <traces>
      <trace>
        <type>[see list_mav_scans trace types]</type>
        <description>[description of what has been quarantined]</description>
      </trace>
      [...more trace entries if they exist...]
    </traces>
  </quarantined_item>
  [...more quarantined_item entries if they exist...]
</result>
```

## Returned fields

A result element containing zero or more entries (quarantined\_item elements in XML), each quarantined\_item having:

<HTMLBlock>{`
<table style="width: 100%; border-collapse: collapse;">
<thead>
<tr>
  <th style="border: 1px solid #ddd; padding: 8px;">Field</th>
  <th style="border: 1px solid #ddd; padding: 8px;">Description</th>
  <th style="border: 1px solid #ddd; padding: 8px;"></th>
</tr>
</thead>
<tbody>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>quarantine_id</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Unique id for the quarantined item <ul><li>For the Bitdefender engine the value is the same as the guid field below</li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>scan_start</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Start time of scan <ul><li>For the VIPRE engine the time is in UTC.</li><li>For the Bitdefender engine this field may be blank (Bitdefender can not always link quarantine items with scans) if it is provided the time will be in agent local time.</li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>scan_end</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>End time of scan <ul><li>For the VIPRE engine the time is in UTC.</li><li>For the Bitdefender engine this field may be blank (Bitdefender can not always link quarantine items with scans) if it is provided the time will be in agent local time.</li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>guid</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Unique identifier on the device for this quarantine item <ul><li>For the Bitdefender engine the value is an integer rather than a true &#39;GUID&#39; and is the same as the quarantine_id field above. The value returned can however be passed into the &#39;guids&#39; parameter of the mav_quarantine_release or mav_quarantine_remove services.</li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>threat_name</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Name of threat</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>threat_category</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Category of threat <ul><li>Note: the threat category names can differ between the VIPRE and Bitdefender engines</li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>status</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Quarantine item status, one of <ul><li><strong>VIPRE Engine</strong> <ul><li>QUARANTINED</li><li>RELEASE_PENDING</li><li>RELEASED</li><li>DELETE_PENDING</li><li>DELETED</li><li>REPORTED</li><li>FAILED_TO_QUARANTINE</li><li>FAILED_TO_RELEASE</li><li>FAILED_TO_DELETE</li></ul></li><li><strong>Bitdefender Engine</strong> <ul><li>Quarantined</li><li>Deleted</li><li>Restored</li></ul></li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>scan_type</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Scan type, one of: <ul><li><strong>VIPRE Engine</strong> <ul><li>QUICK</li><li>DEEP</li><li>ACTIVE</li><li>CUSTOM</li></ul></li></ul>For the Bitdefender engine this field may be blank (Bitdefender can not always link quarantine items with scans). If a value is present it will be one of: <ul><li><strong>Bitdefender Engine</strong> <ul><li>Active Protection</li><li>Quick</li><li>Deep</li><li>Custom</li><li>Behavioral</li><li>IDS</li></ul></li></ul></li></ul></p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>traces</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>List of threats, each threat having: <ul><li><strong>type</strong> <ul><li>Trace type, one of: <ul><li><strong>VIPRE Engine</strong> <ul><li>COOKIE</li><li>DLL_EXPORT</li><li>PROCESS</li><li>SYSTEM_DLL</li><li>REGISTRY_ENTRY</li><li>EXPORT</li><li>FILE</li><li>MASTER_BOOT_RECORD</li><li>FOLDER</li><li>ROOTKIT</li><li>ARCHIVE</li><li>SYSTEM_MODULE</li><li>PROCESS_MODULE</li><li>HOOK</li><li>DEVICE_DRIVER</li><li>UNKNOWN</li></ul></li></ul>For the Bitdefender engine this field may be blank, but if a value is present it will be one of: <ul><li><strong>Bitdefender Engine</strong> <ul><li>File</li><li>Http</li><li>Cookie</li><li>POP3</li><li>SMTP</li><li>Process</li><li>Boot Sector</li><li>Registry</li><li>ADS Stream</li></ul></li></ul></li></ul></li></ul></li><li><strong>description</strong> <ul><li>Trace description strings, could be: <ul><li>a filename</li><li>a registry key with value</li><li>a reference to a process</li><li>etc</li></ul></li></ul>Note: for the Bitdefender engine each quarantined item will always have exactly one trace element.</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
<tr>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>engine</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"><p>Managed Antivirus engine where this data originates from, either VIPRE or Bitdefender (field only present where v&gt;1)</p>
</td>
  <td style="border: 1px solid #ddd; padding: 8px;"></td>
</tr>
</tbody>
</table>
`}</HTMLBlock>