Users

Information about a VirusTotal user

Object Attributes

  • apikey: <string> account's VirusTotal API key. Only visible for the account's owner.
  • email: <string> account's email. Only visible for the account's owner and its group's admin.
  • first_name: <string> user's first name.
  • has_2fa: <boolean> whether the user has 2FA enabled or not. Only visible for the account's owner.
  • last_login: <integer> user's last login date as UTC timestamp. Only visible for the account's owner and its group's admin.
  • last_name: <string> user's last name.
  • preferences: <dictionary> VirusTotal user's preferences. Only visible for the account's owner. Every subitem is a dictionary having a string as key.
  • privileges: <dictionary> user's granted privileges. Only visible for the account's owner. Each dictionary key is a string representing the privilege's name and each dictionary value is a dictionary having the following fields:
    • expiration_date: <integer> privilege's expiration date as UTC timestamp.
    • granted: <boolean> whether that privilege is granted or not.
    • inherited_from: <string> group name the permission is inherited from.
    • inherited_via: <string> quota group where the permission is.
  • profile_phrase: <string> user's profile phrase.
  • quotas: <dictionary> user's quota details. Only visible for the account's owner and the user's group's admin. Each dictionary key is a string representing quota name and each dictionary value is a dictionary containing the following fields:
    • allowed: <integer> maximum allowed quota.
    • used: <integer> consumed quota.
  • reputation: <integer> user's community reputation.
  • status: <string> user's status.
  • user_since: <integer> user's join date as UTC timestamp.
{
    "data": {
        "attributes": {
            "apikey": "<string>",
            "email": "<string>",
            "first_name": "<string>",
            "has_2fa": <bool>,
            "last_login": <int>,
            "last_name": "<string>",
            "preferences": {
                "<string>": {}
            },
            "privileges": {
                "<string>": {
                    "expiration_date": <int>,
                    "granted": <bool>,
                    "inherited_from": "<string>",
                    "inherited_via": "<string>"
                }
            },
            "profile_phrase": "<string>",
            "quotas": {
                "<string>": {
                    "allowed": <int>,
                    "used": <int>
                }
            },
            "reputation": <int>,
            "status": "<string>",
            "user_since": <int>
        },
        "id": "<string>",
        "links": {
            "self": "https://www.virustotal.com/api/v3/users/<id>"
        },
        "type": "user"
    }
}
{
    "data": {
        "attributes": {
            "apikey": "3333333t33333333333333r333333f333333g33333333c3333333f333333333a",
            "email": "[email protected]",
            "first_name": "Sabrina",
            "has_2fa": true,
            "last_login": 1594718163,
            "last_name": "Spellman",
            "preferences": {
                "graph": {
                    "dashboard_walkthrough_version_seen": "1.0.0",
                    "last_visit": 1594136453392,
                    "main_walkthrough_version_seen": "1.0.0",
                    "search_tooltip_version_seen": "1.0.0"
                },
                "ui": {
                    "last_read_notification_date": 1594640566
                }
            },
            "privileges": {
                "admin": {
                    "granted": false
                },
                "allinfo": {
                    "granted": false
                },
                "big-files": {
                    "expiration_date": 1601510400,
                    "granted": true,
                    "inherited_from": "blablabla_group",
                    "inherited_via": "api_quota_group"
                },
                "cases": {
                    "granted": true,
                    "inherited_from": "blablabla_group",
                    "inherited_via": "intelligence_quota_group"
                },
                "click_to_accept": {
                    "granted": false
                }
            },
            "profile_phrase": "It's witching hour!",
            "quotas": {
                "api_requests_daily": {
                    "allowed": 1000000000,
                    "used": 4
                },
                "api_requests_hourly": {
                    "allowed": 60000000000,
                    "used": 4
                },
                "api_requests_monthly": {
                    "allowed": 1000000000,
                    "used": 113
                },
                "cases_creation_monthly": {
                    "allowed": 20,
                    "used": 0
                },
                "intelligence_downloads_monthly": {
                    "allowed": 0,
                    "used": 5
                }
            },
            "reputation": 1,
            "status": "active",
            "user_since": 1557214525
        },
        "id": "spellman",
        "links": {
            "self": "https://www.virustotal.com/api/v3/users/spellman"
        },
        "type": "user"
    }
}

Relationships

In addition to the previously described attributes, User objects contain relationships with other objects in our dataset that can be retrieved as explained in the Relationships section.

The following table shows a summary of available relationships for user objects.

Relationship

Description

Accessibility

Return object type

api_quota_group

Group from which the user consumes API quota.

Account owner and group admin.

A single Group object.

comments

Comments posted by the user.

Everyone.

A list of Comments.

graphs

VT Graphs the user is owner/editor/viewer of.

Everyone.

A list of Graphs.

groups

Groups the user belongs to.

Account owner.

A list of Groups.

groups_managed

Groups for which the user is an administrator.

Account owner and group admin.

A list of Groups.

hunting_notifications

Hunting notifications for the user.

Account owner.

A list of Hunting Notifications.

hunting_notification_files

Flagged files in the user's hunting notifications.

Account owner.

A list of Files.

hunting_rulesets

Hunting rulesets editable by the user.

Account owner.

A list of Hunting Rulesets.

intelligence_quota_group

Group from which the user consumes intelligence quota.

Account owner and group admin.

A single Group object.

mentions

Comments mentioning the user.

Everyone.

A list of Comments.

retrohunt_jobs

User's retrohunt jobs.

Account owner.

A list of Retrohunt Jobs.

These relationships are detailed in the subsections below.