JUMP TOIntroductionVirusTotal API v3 OverviewPublic vs Premium APITechnology IntegrationsGetting startedAuthenticationAPI responsesErrorsKey conceptsObjectsCollectionsRelationshipsLegendAPI v2 to v3 Migration GuideAPI ObjectsFilesandroguardasf_infoauthentihashbundle_infoclass_infocrowdsourced_ids_resultscrowdsourced_ids_statscrowdsourced_yara_resultsdeb_infodetectiteasydmg_infodot_net_assemblydot_net_guidself_info🔒 exiftoolhtml_infoimage_code_injectionsipa_infoisoimage_infojar_infojavascript_infoknown_distributorslnk_infomacho_infomagic🔒 malware_configmonitor_infonsrl_info🔒 office_info🔒 openxml_infopackerspassword_infopdf_infope_infopopular_threat_classificationpowershell_inforombios_info🔒 rtf_infosandbox_verdictssigma_analysis_resultssigma_analysis_statssignature_infosnortsuricatassdeepswf_infotelfhashtlshtraffic_inspectiontridvba_infowireshark🔀🔒 analyses🔀 behaviours🔀 bundled_files🔀🔒 carbonblack_children🔀🔒 carbonblack_parents🔀🔒 clues🔀 collections🔀 comments🔀🔒 compressed_parents🔀 contacted_domains🔀 contacted_ips🔀 contacted_urls🔀 dropped_files🔀🔒 email_attachments🔀🔒 email_parents🔀🔒 embedded_domains🔀🔒 embedded_ips🔀🔒 embedded_urls🔀 execution_parents🔀 graphs🔀🔒 itw_domains🔀🔒 itw_ips🔀🔒 itw_urls🔀🔒 overlay_children🔀🔒 overlay_parents🔀🔒 pcap_children🔀🔒 pcap_parents🔀 pe_resource_children🔀 pe_resource_parents🔀🔒 related_references🔀🔒 related_threat_actors🔀🔒 screenshots🔀 sigma_analysis🔀🔒 similar_files🔀🔒 submissions🔀🔒 urls_for_embedded_js🔀🧑💻 user_votes🔀 votesFile behaviourdns_lookupsfiles_copiedfiles_droppedhttp_conversationsip_trafficpermissions_checkedprocesses_treesms_senttagsverdicts🔀 file🔀 attack_techniquesDomains🔀🔒 caa_records🔀🔒 cname_records🔀 collections🔀 comments🔀 communicating_files🔀🔒 downloaded_files🔀 graphs🔀 historical_ssl_certificates🔀 historical_whois🔀 immediate_parent🔀🔒 mx_records🔀🔒 ns_records🔀 parent🔀 referrer_files🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀 resolutions🔀 siblings🔀🔒 soa_records🔀 subdomains🔀🔒 urls🔀🧑💻 user_votes🔀 votesIP addresses🔀 collections🔀 comments🔀 communicating_files🔀🔒 downloaded_files🔀 graphs🔀 historical_ssl_certificates🔀 historical_whois🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀 referrer_files🔀 resolutions🔀🔒 urls🔀🧑💻 user_votes🔀 votesURLs🔀🔒 analyses🔀 collections🔀 comments🔀🔒 communicating_files🔀🔒 contacted_domains🔀🔒 contacted_ips🔀🔒 downloaded_files🔀🔒 embedded_js_files🔀 graphs🔀 last_serving_ip_address🔀 network_location🔀🔒 redirecting_urls🔀🔒 redirects_to🔀🔒 referrer_files🔀🔒 referrer_urls🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀🔒 submissions🔀🧑💻 user_votes🔀 votes🔀🔒 urls_related_by_tracker_idComments🔀 author🔀 itemGraphs🔀 comments🔀 editors🔀 group🔀 items🔀 owner🔀 viewersUsers🔀🧑💻 api_quota_group🔀 collections🔀 comments🔀 graphs🔀🧑💻 groups🔀🧑💻 groups_managed🔀🧑💻 hunting_rulesets🔀🧑💻 hunting_notifications🔀🧑💻 hunting_notification_files🔀🧑💻 intelligence_quota_group🔀 mentions🔀🧑💻 retrohunt_jobs🔀 votesSubmissionsScreenshotsVotesResolutionsSigma Analyses🔀 rulesSigma RulesSSL CertificateWhoisAnalyses🔀 itemClues🔀🔒 filesGroups🔀🧑💻 administrators🔀🧑💻 graphs🔀🧑💻 usersHunting Rulesets🔀🧑💻 editors🔀🧑💻 hunting_notification_filesHunting NotificationsIoC-Stream NotificationsRetrohunt Jobs🔀🧑💻 matching_files🔀🧑💻 ownerOperationsYARA RulesetsYARA RulesAlerts Watchlist AssetsAlerts NotificationsAlerts EventsAlerts DomainEntityAlerts IpEntityAlerts FileEntityAlerts UrlEntityAlerts AnalysisStatsAlerts AnalysisVerdictAlerts DomainRecordCollections🔀 comments🔀 domains🔀 files🔀 ip_addresses🔀 owner🔀 references🔀🔒 related_references🔀🔒 threat_actors🔀 urls🔒 Threat Actors🔀 collections🔀 comments🔀 references🔀 related_domains🔀 related_files🔀 related_ip_addresses🔀 related_references🔀 related_urlsReferences🔀 collections🔀 domains🔀 files🔀 ip_addresses🔀🔒 threat_actors🔀 urlsAttack Tactics🔀 attack_techniquesAttack Techniques🔀 attack_tactics🔀 parent_technique🔀 revoking_technique🔀 subtechniques🔀🔒 threat_actors🔒 Private Files🔀 behaviours🔀 dropped_files🔀 execution_parents🔀 embedded_urls🔀 embedded_domains🔀 embedded_ips🔒 Private File Behaviours🔀 attack_techniques🔀 file🔒 Private Analyses🔀 item🔀 submitterClustersUniversal API EndpointsFilesUpload a filepostGet a URL for uploading large filesgetGet a file reportgetRequest a file rescan (re-analyze)postGet comments on a filegetAdd a comment to a filepostGet votes on a filegetAdd a vote on a filepostGet objects related to a filegetGet object descriptors related to a filegetGet a summary of all behavior reports for a filegetGet a summary of all MITRE ATT&CK techniques observed in a filegetGet all behavior reports for a filegetGet a file behavior report from a sandboxgetGet objects related to a behaviour reportgetGet object descriptors related to a behaviour reportgetGet a detailed HTML behaviour reportgetGet a crowdsourced Sigma rule objectgetGet a crowdsourced YARA rulesetgetURLsScan URLpostGet a URL analysis reportgetRequest a URL rescan (re-analyze)postGet comments on a URLgetAdd a comment on a URLpostGet votes on a URLgetAdd a vote on a URLpostGet objects related to a URLgetGet object descriptors related to a URLgetDomains & ResolutionsGet a domain reportgetGet comments on a domaingetAdd a comment to a domainpostGet votes on a domaingetAdd a vote to a domainpostGet objects related to a domaingetGet object descriptors related to a domaingetGet a DNS resolution objectgetIP addressesGet an IP address reportgetGet comments on an IP addressgetAdd a comment to an IP addresspostGet votes on an IP addressgetAdd a vote to an IP addresspostGet objects related to an IP addressgetGet object descriptors related to an IP addressgetAnalyses, Submissions & OperationsGet a URL/file analysisgetGet objects related to an analysisgetGet object descriptors related to an analysisgetGet a submission objectgetGet an operation objectgetGraphsSearch graphsgetCreate a graphpostGet a graph objectgetUpdate a graph objectpatchDelete a graphdeleteGet comments on a graphgetAdd a comment to a graphpostGet users and groups that can view a graphgetGrant users and groups permission to see a graphpostCheck if a user or group can view a graphgetRevoke view permission from a user or groupdeleteGet users and groups that can edit a graphgetGrant users and groups permission to edit a graphpostCheck if a user or group can edit a graphgetRevoke edit graph permissions from a user or groupdeleteGet objects related to a graphgetGet object descriptors related to a graphgetCommentsGet latest commentsgetGet a comment objectgetUpdate a commentpatchDelete a commentdeleteAdd a vote to a commentpostGet objects related to a commentgetGet object descriptors related to a commentgetSearch & MetadataSearch files, URLs, domains, IPs and tag commentsgetGet VirusTotal metadatagetCollectionsCreate a new collectionpostGet a collectiongetUpdate a collectionpatchDelete a collectiondeleteGet comments on a collectiongetAdd a comment to a collectionpostGet objects related to a collectiongetGet object descriptors related to a collectiongetAdd new items to a collectionpostDelete items from a collectiondeleteAttack TacticsGet an attack tactic objectgetGet objects related to an attack tacticgetGet object descriptors related to an attack tacticgetAttack TechniquesGet an attack technique objectgetGet objects related to an attack techniquegetGet object descriptors related to an attack techniquegetPopular Threat CategoriesGet a list of popular threat categoriesgetVT EnterpriseUsers & GroupsGet a user objectgetUpdate a user objectpatchDelete a userdeleteGet a user’s API usagegetGet a user’s quota summarygetGet objects related to a usergetGet object descriptors related to a usergetGet a group objectgetUpdate a group objectpatchGet a group’s API usagegetGet administrators for a groupgetGrant group admin permissions to a list of userspostCheck if a user is a group admingetRevoke group admin permissions from a userdeleteGet group usersgetCheck if a user is a group membergetRemove a user from a groupdeleteAdd users to a grouppostGet objects related to a groupgetGet object descriptors related to a groupgetSearchAdvanced corpus searchgetGet file content search snippetsgetZipping filesCreate a password-protected ZIP with VirusTotal filespostCheck a ZIP file’s statusgetGet a ZIP file’s download URLgetDownload a ZIP filegetFilesGet a file’s download URLgetDownload a filegetGet the EVTX file generated during a file’s behavior analysisgetGet the PCAP file generated during a file’s behavior analysisgetGet the memdump file generated during a file’s behavior analysisgetCluesGet a clue rule objectgetGet objects related to a cluegetReferencesCreate a new referencepostGet a referencegetDelete a referencedeleteGet objects related to a referencegetGet object descriptors related to a referencegetThreat ActorsList threat actorsgetGet a threat actorgetGet objects related to a threat actorgetRetrieve object descriptors related to a threat actorgetCollectionsList collectionsgetExport IOCs from a collectiongetExport IOCs from a given collection's relationshipgetExport aggregations from a collectiongetSearch IoCs inside a collectiongetStatisticsGet daily stats grouped by vhashgetIoC StreamGet objects from the IoC StreamgetDelete notifications from the IoC StreamdeleteGet an IoC Stream notificationgetDelete an IoC Stream notificationdeleteVT HuntingRetrohuntGet a list of Retrohunt jobsgetCreate a new Retrohunt jobpostGet a Retrohunt job objectgetDelete a Retrohunt jobdeleteAbort a Retrohunt jobpostRetrieve matches for a Retrohunt jobgetLivehuntGet Livehunt rulesetsgetCreate a new Livehunt rulesetpostRemove all Livehunt rulesetsdeleteGet a Livehunt rulesetgetUpdate a Livehunt rulesetpatchCheck if a user or group is a Livehunt ruleset editorgetRevoke Livehunt ruleset edit permission from a user or groupdeleteDelete a Livehunt rulesetdeleteGet objects related to a Livehunt rulesetgetGet object descriptors related to a Livehunt rulesetgetGrant Livehunt ruleset edit permissions for a user or grouppostGet Livehunt notificationsgetDelete Livehunt notificationsdeleteGet a Livehunt notification objectgetDelete a Livehunt notificationdeleteRetrieve file objects for Livehunt notificationsgetYARA RulesList Crowdsourced YARA RulesgetGet a Crowdsourced YARA rulegetGet objects related to a Crowdsourced YARA rulegetGet objects descriptors related to a Crowdsourced YARA rulegetVT Private ScanningFilesUpload a filepostList private filesgetGet a URL for uploading large filesgetRescan a private filepostGet a private file reportgetGet objects related to a private filegetGet object descriptors related to a filegetAnalysesList private analysesgetGet a private analysisgetGet objects related to a private analysisgetGet object descriptors related to a private analysisgetFile behavioursGet a behaviour report from a private filegetGet the behaviour reports from a private filegetGet objects related to a private file's behaviour reportgetGet object descriptors related to a private file's behaviour reportgetGet a summary of all behavior reports for a filegetGet a summary of all MITRE ATT&CK techniques observed in a filegetGet a detailed HTML behaviour reportgetGet the EVTX file generated during a private file’s behavior analysisgetGet the PCAP file generated during a private file’s behavior analysisgetGet the memdump file generated during a private file’s behavior analysisgetVT FeedSFilesGet a per-minute file feed batchgetGet a hourly file feed batchgetDownload a file published in the file feedgetFile BehavioursGet a per-minute file behaviour feed batchgetGet an hourly file behaviour feed batchgetGet the EVTX file generated during a file’s behavior analysisgetGet the memdump file generated during a file’s behavior analysisgetGet the PCAP file generated during a file’s behavior analysisgetGet a file behaviour's detailed HTML reportgetURLsGet a minutely URL feed batchgetGet an hourly URL feed batchgetDomainsGet a minutely domain feed batchgetGet an hourly domain feed batchgetIP addressesGet a minutely IP address feed batchgetGet an hourly IP address feed batchgetVT AugmentOverviewRenderingGet a widget rendering URLgetRetrieve the widget's HTML contentgetThemingVT MonitorSoftware PublishersMonitor ItemsGet a list of MonitorItem objects by path or taggetUpload a file or create a new folderpostGet a URL for uploading files larger than 32MBgetGet attributes and metadata for a specific MonitorItemgetDelete a VirusTotal Monitor file or folderdeleteConfigure a given VirusTotal Monitor item (file or folder)patchDownload a file in VirusTotal MonitorgetGet a URL for downloading a file in VirusTotal MonitorgetGet the latest file analysesgetGet user owning the MonitorItem objectgetRetrieve partner's comments on a filegetRetrieve statistics about analyses performed on your software collectiongetRetrieve historical events about your software collectiongetAntivirus PartnersGet a list of MonitorHashes detected by an enginegetGet a list of analyses for a filegetGet a list of items with a given sha256 hashgetCreate a comment over a hashpostGet comments on a sha256 hashgetAdd a comment on a sha256 hashpatchRemove a comment detection for a hash.deleteDownload a file with a given sha256 hashgetRetrieve a download url for a file with a given sha256 hashgetDownload a daily detection bundle directlygetGet a daily detection bundle download URLgetGet a list of MonitorHashes detected by an enginegetVT AlertsOverviewWatchlistsLists all your Alerts AssetsgetCreate a new Alerts AssetpostGet an Alerts AssetgetDeletes the Alerts AssetdeleteNotificationsLists Alerts NotificationsgetGet a single Alerts NotificationgetTest APIGetting Started With Your APIExport aggregations from a collectionget https://www.virustotal.com/api/v3/collections/{id}/aggregations/download/{format}
