JUMP TOIntroductionVirusTotal API v3 OverviewPublic vs Premium APITechnology IntegrationsGetting startedAuthenticationAPI responsesErrorsKey conceptsObjectsCollectionsRelationshipsLegendAPI v2 to v3 Migration GuideIOC REPUTATION & ENRICHMENTIP addressesGet an IP address reportgetGet comments on an IP addressgetAdd a comment to an IP addresspostGet objects related to an IP addressgetGet object descriptors related to an IP addressgetGet votes on an IP addressgetAdd a vote to an IP addresspostDomains & ResolutionsGet a domain reportgetGet comments on a domaingetAdd a comment to a domainpostGet objects related to a domaingetGet object descriptors related to a domaingetGet a DNS resolution objectgetGet votes on a domaingetAdd a vote to a domainpostFilesUpload a filepostGet a URL for uploading large filesgetGet a file reportgetRequest a file rescan (re-analyze)postGet a file’s download URLgetDownload a filegetGet comments on a filegetAdd a comment to a filepostGet objects related to a filegetGet object descriptors related to a filegetGet a crowdsourced Sigma rule objectgetGet a crowdsourced YARA rulesetgetGet votes on a filegetAdd a vote on a filepostFile BehavioursGet a summary of all behavior reports for a filegetGet a summary of all MITRE ATT&CK techniques observed in a filegetGet all behavior reports for a filegetGet a file behavior report from a sandboxgetGet objects related to a behaviour reportgetGet object descriptors related to a behaviour reportgetGet a detailed HTML behaviour reportgetGet the EVTX file generated during a file’s behavior analysisgetGet the PCAP file generated during a file’s behavior analysisgetGet the memdump file generated during a file’s behavior analysisgetURLsScan URLpostGet a URL analysis reportgetRequest a URL rescan (re-analyze)postGet comments on a URLgetAdd a comment on a URLpostGet objects related to a URLgetGet object descriptors related to a URLgetGet votes on a URLgetAdd a vote on a URLpostCommentsGet latest commentsgetGet a comment objectgetDelete a commentdeleteGet objects related to a commentgetGet object descriptors related to a commentgetAdd a vote to a commentpostAnalyses, Submissions & OperationsGet a URL / file analysisgetGet objects related to an analysisgetGet object descriptors related to an analysisgetGet a submission objectgetGet an operation objectgetAttack TacticsGet an attack tactic objectgetGet objects related to an attack tacticgetGet object descriptors related to an attack tacticgetAttack TechniquesGet an attack technique objectgetGet objects related to an attack techniquegetGet object descriptors related to an attack techniquegetPopular Threat CategoriesGet a list of popular threat categoriesgetVT EnterpriseSearch & MetadataSearch for files, URLs, domains, IPs and commentsgetAdvanced corpus searchgetGet file content search snippetsgetGet VirusTotal metadatagetCollectionsCreate a new collectionpostGet a collectiongetUpdate a collectionpatchDelete a collectiondeleteGet comments on a collectiongetAdd a comment to a collectionpostGet objects related to a collectiongetGet object descriptors related to a collectiongetAdd new items to a collectionpostDelete items from a collectiondelete🔒 List collectionsget🔒 Export IOCs from a collectionget🔒 Export IOCs from a given collection's relationshipget🔒 Export aggregations from a collectionget🔒 Search IoCs inside a collectionget🔒 Threat ActorsList threat actorsgetGet a threat actorgetGet objects related to a threat actorgetRetrieve object descriptors related to a threat actorget🔒 ReferencesCreate a new referencepostGet a referencegetDelete a referencedeleteGet objects related to a referencegetGet object descriptors related to a referencegetZipping filesCreate a password-protected ZIP with VirusTotal filespostCheck a ZIP file’s statusgetGet a ZIP file’s download URLgetDownload a ZIP filegetStatisticsGet daily stats grouped by vhashgetVT HuntingYARA RulesList Crowdsourced YARA RulesgetGet a Crowdsourced YARA rulegetGet objects related to a Crowdsourced YARA rulegetGet objects descriptors related to a Crowdsourced YARA rulegetIoC StreamGet objects from the IoC StreamgetDelete notifications from the IoC StreamdeleteGet an IoC Stream notificationgetDelete an IoC Stream notificationdeleteLivehuntGet Livehunt rulesetsgetCreate a new Livehunt rulesetpostRemove all Livehunt rulesetsdeleteGet a Livehunt rulesetgetUpdate a Livehunt rulesetpatchCheck if a user or group is a Livehunt ruleset editorgetRevoke Livehunt ruleset edit permission from a user or groupdeleteDelete a Livehunt rulesetdeleteGet objects related to a Livehunt rulesetgetGet object descriptors related to a Livehunt rulesetgetGrant Livehunt ruleset edit permissions for a user or grouppostTransfer Livehunt ruleset to another userpostGet Livehunt notificationsgetDelete Livehunt notificationsdeleteGet a Livehunt notification objectgetDelete a Livehunt notificationdeleteRetrieve file objects for Livehunt notificationsgetRetrohuntGet a list of Retrohunt jobsgetCreate a new Retrohunt jobpostGet a Retrohunt job objectgetDelete a Retrohunt jobdeleteAbort a Retrohunt jobpostRetrieve matches for a Retrohunt jobgetVT GRAPHVT GraphsSearch graphsgetCreate a graphpostGet a graph objectgetUpdate a graph objectpatchDelete a graphdeleteGet comments on a graphgetAdd a comment to a graphpostGet objects related to a graphgetGet object descriptors related to a graphgetVT Graphs Permissions & ACLGet users and groups that can view a graphgetGrant users and groups permission to see a graphpostCheck if a user or group can view a graphgetRevoke view permission from a user or groupdeleteGet users and groups that can edit a graphgetGrant users and groups permission to edit a graphpostCheck if a user or group can edit a graphgetRevoke edit graph permissions from a user or groupdeleteVT Private Scanning🔒 FilesUpload a filepostList private filesgetGet a URL for uploading large filesgetRescan a private filepostGet a private file reportgetDelete a private file reportdeleteGet objects related to a private filegetGet object descriptors related to a fileget🔒 AnalysesList private analysesgetGet a private analysisgetGet objects related to a private analysisgetGet object descriptors related to a private analysisget🔒 File BehavioursGet a behaviour report from a private filegetGet the behaviour reports from a private filegetGet objects related to a private file's behaviour reportgetGet object descriptors related to a private file's behaviour reportgetGet a summary of all behavior reports for a filegetGet a summary of all MITRE ATT&CK techniques observed in a filegetGet a detailed HTML behaviour reportgetGet the EVTX file generated during a private file’s behavior analysisgetGet the PCAP file generated during a private file’s behavior analysisgetGet the memdump file generated during a private file’s behavior analysisgetVT FeedS🔒 File intelligence feedGet a per-minute file feed batchgetGet a hourly file feed batchgetDownload a file published in the file feedget🔒 Sandbox analyses feedGet a per-minute file behaviour feed batchgetGet an hourly file behaviour feed batchgetGet the EVTX file generated during a file’s behavior analysisgetGet the memdump file generated during a file’s behavior analysisgetGet the PCAP file generated during a file’s behavior analysisgetGet a file behaviour's detailed HTML reportget🔒 Domain intelligence feedGet a minutely domain feed batchgetGet an hourly domain feed batchget🔒 IP intelligence feedGet a minutely IP address feed batchgetGet an hourly IP address feed batchget🔒 URL intelligence feedGet a minutely URL feed batchgetGet an hourly URL feed batchgetVT ENTERPRISE ADMINISTRATIONUser managementGet a user objectgetUpdate a user objectpatchDelete a userdeleteGet objects related to a usergetGet object descriptors related to a usergetGroup managementGet a group objectgetUpdate a group objectpatchGet administrators for a groupgetGrant group admin permissions to a list of userspostCheck if a user is a group admingetRevoke group admin permissions from a userdeleteGet group usersgetCheck if a user is a group membergetRemove a user from a groupdeleteAdd users to a grouppostGet objects related to a groupgetGet object descriptors related to a groupgetQuota managementGet a user’s API usagegetGet a user’s quota summarygetGet a group’s API usagegetService Account ManagementCreate a new Service AccountpostGet Service Accounts of a groupgetGet a Service Account objectgetVT AugmentOverviewRenderingGet a widget rendering URLgetRetrieve the widget's HTML contentgetThemingAPI ObjectsAlerts NotificationsAlerts EventsAlerts DomainEntityAlerts IpEntityAlerts FileEntityAlerts UrlEntityAlerts AnalysisStatsAlerts AnalysisVerdictAlerts DomainRecordAlerts Watchlist AssetsAnalyses🔀 itemAttack Tactics🔀 attack_techniquesAttack Techniques🔀 attack_tactics🔀 parent_technique🔀 revoking_technique🔀 subtechniques🔀🔒 threat_actorsClues🔀🔒 filesCollections🔀 autogenerated_graphs🔀 comments🔀 domains🔀 files🔀 ip_addresses🔀 owner🔀 references🔀🔒 related_collections🔀🔒 related_references🔀🔒 threat_actors🔀 urlsComments🔀 authorDomains🔀🔒 caa_records🔀🔒 cname_records🔀 collections🔀 comments🔀 communicating_files🔀🔒 downloaded_files🔀 graphs🔀 historical_ssl_certificates🔀 historical_whois🔀 immediate_parent🔀🔒 mx_records🔀🔒 ns_records🔀 parent🔀 referrer_files🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀 resolutions🔀 siblings🔀🔒 soa_records🔀 subdomains🔀🔒 urls🔀🧑💻 user_votes🔀 votesFilesandroguardasf_infoauthentihashbundle_infoclass_infocrowdsourced_ids_resultscrowdsourced_ids_statscrowdsourced_yara_resultsdeb_infodetectiteasydmg_infodot_net_assemblydot_net_guidself_info🔒 exiftoolhtml_infoimage_code_injectionsipa_infoisoimage_infojar_infojavascript_infoknown_distributorslnk_infomacho_infomagic🔒 malware_configmonitor_infonsrl_info🔒 office_info🔒 openxml_infopackerspassword_infopdf_infope_infopopular_threat_classificationpowershell_inforombios_info🔒 rtf_infosandbox_verdictssigma_analysis_resultssigma_analysis_statssignature_infosnortsuricatassdeepswf_infotelfhashtlshtraffic_inspectiontridvba_infowireshark🔀🔒 analyses🔀 behaviours🔀 bundled_files🔀🔒 carbonblack_children🔀🔒 carbonblack_parents🔀🔒 clues🔀 collections🔀 comments🔀🔒 compressed_parents🔀 contacted_domains🔀 contacted_ips🔀 contacted_urls🔀 dropped_files🔀🔒 email_attachments🔀🔒 email_parents🔀🔒 embedded_domains🔀🔒 embedded_ips🔀🔒 embedded_urls🔀 execution_parents🔀 graphs🔀🔒 itw_domains🔀🔒 itw_ips🔀🔒 itw_urls🔀🔒 overlay_children🔀🔒 overlay_parents🔀🔒 pcap_children🔀🔒 pcap_parents🔀 pe_resource_children🔀 pe_resource_parents🔀🔒 related_references🔀🔒 related_threat_actors🔀🔒 screenshots🔀 sigma_analysis🔀🔒 similar_files🔀🔒 submissions🔀🔒 urls_for_embedded_js🔀🧑💻 user_votes🔀 votesFiles Behaviourdns_lookupsfiles_copiedfiles_droppedhttp_conversationsip_trafficpermissions_checkedprocesses_treesms_senttagsverdicts🔀 file🔀 attack_techniquesGraphs🔀 comments🔀 editors🔀 group🔀 items🔀 owner🔀 viewersGroups🔀🧑💻 administrators🔀🧑💻 graphs🔀🧑💻 usersHunting NotificationsHunting Rulesets🔀🧑💻 editors🔀🧑💻 hunting_notification_filesIoC-Stream NotificationsIP addresses🔀 collections🔀 comments🔀 communicating_files🔀🔒 downloaded_files🔀 graphs🔀 historical_ssl_certificates🔀 historical_whois🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀 referrer_files🔀 resolutions🔀🔒 urls🔀🧑💻 user_votes🔀 votesOperations🔒 Private Analyses🔀 item🔀 submitter🔒 Private Files🔀 behaviours🔀 dropped_files🔀 execution_parents🔀 embedded_urls🔀 embedded_domains🔀 embedded_ips🔒 Private Files Behaviours🔀 attack_techniques🔀 file🔒 References🔀 collections🔀🔒 threat_actorsResolutionsRetrohunt Jobs🔀🧑💻 matching_files🔀🧑💻 ownerScreenshotsSigma Analyses🔀 rulesSigma RulesSSL CertificateSubmissions🔒 Threat Actors🔀 collections🔀 comments🔀 references🔀 related_domains🔀 related_files🔀 related_ip_addresses🔀 related_references🔀 related_urlsURLs🔀🔒 analyses🔀 collections🔀 comments🔀🔒 communicating_files🔀🔒 contacted_domains🔀🔒 contacted_ips🔀🔒 downloaded_files🔀🔒 embedded_js_files🔀 graphs🔀 last_serving_ip_address🔀 network_location🔀🔒 redirecting_urls🔀🔒 redirects_to🔀🔒 referrer_files🔀🔒 referrer_urls🔀 related_comments🔀🔒 related_references🔀🔒 related_threat_actors🔀🔒 submissions🔀🧑💻 user_votes🔀 votes🔀🔒 urls_related_by_tracker_idUsers🔀🧑💻 api_quota_group🔀 collections🔀 comments🔀 graphs🔀🧑💻 groups🔀🧑💻 groups_managed🔀🧑💻 hunting_rulesets🔀🧑💻 hunting_notifications🔀🧑💻 hunting_notification_files🔀🧑💻 intelligence_quota_group🔀 mentions🔀🧑💻 retrohunt_jobs🔀 votesService Accounts🔀🧑💻 api_quota_group🔀 comments🔀🧑💻 groups🔀🧑💻 intelligence_quota_group🔀 mentionsVotesWhoisYARA RulesYARA RulesetsVT MonitorSoftware PublishersMonitor ItemsGet a list of MonitorItem objects by path or taggetUpload a file or create a new folderpostGet a URL for uploading files larger than 32MBgetGet attributes and metadata for a specific MonitorItemgetDelete a VirusTotal Monitor file or folderdeleteConfigure a given VirusTotal Monitor item (file or folder)patchDownload a file in VirusTotal MonitorgetGet a URL for downloading a file in VirusTotal MonitorgetGet the latest file analysesgetGet user owning the MonitorItem objectgetRetrieve partner's comments on a filegetRetrieve statistics about analyses performed on your software collectiongetRetrieve historical events about your software collectiongetAntivirus PartnersGet a list of MonitorHashes detected by an enginegetGet a list of analyses for a filegetGet a list of items with a given sha256 hashgetCreate a comment over a hashpostGet comments on a sha256 hashgetAdd a comment on a sha256 hashpatchRemove a comment detection for a hash.deleteDownload a file with a given sha256 hashgetRetrieve a download url for a file with a given sha256 hashgetDownload a daily detection bundle directlygetGet a daily detection bundle download URLgetGet a list of MonitorHashes detected by an enginegetVT AlertsOverviewWatchlistsLists all your Alerts AssetsgetCreate a new Alerts AssetpostGet an Alerts AssetgetDeletes the Alerts AssetdeleteNotificationsLists Alerts NotificationsgetGet a single Alerts NotificationgetScan URLpost https://www.virustotal.com/api/v3/urlsThis returns an Analysis ID. The analysis can be retrieved by using the Analysis endpoint.
