VirusTotal

      VirusTotal Developer Hub

      Welcome to the VirusTotal developer hub. Here you'll find comprehensive guides and documentation to help you start working with VirusTotal's API as quickly as possible. Let's jump right in!

      HomeGuidesRecipesAPI ReferenceReferenceChangelogDiscussionsPage Not FoundSearch{{ state.current().meta.title }}API Logs
        HomeGuidesAPI Reference
      discard

      Searches

      • Search
      • Searching by hash

      Support

      • Frequently Asked Questions
        • Hunting
        • VTIntelligence
        • Quotas

      Searches

      • Search
      • Searching by hash

      Support

      • Frequently Asked Questions
        • Hunting
        • VTIntelligence
        • Quotas

      Introduction

      • VirusTotal API version 3 Overview
      • Public vs Premium API
      • Getting started
      • Authentication
      • API responses
      • Errors
      • Key concepts
      • Objects
      • Collections
      • Relationships
      • Legends

      API Objects

      • Files
        • androguard
        • asf_info
        • authentihash
        • bundle_info
        • class_info
        • deb_info
        • dmg_info
        • dot_net_assembly
        • dot_net_guids
        • elf_info
        • 🔒 exiftool
        • html_info
        • image_code_injections
        • ipa_info
        • isoimage_info
        • jar_info
        • macho_info
        • magic
        • 🔒 malware_config
        • monitor_info
        • nsrl_info
        • 🔒 office_info
        • 🔒 openxml_info
        • packers
        • pdf_info
        • pe_info
        • powershell_info
        • rombios_info
        • 🔒 rtf_info
        • signature_info
        • snort
        • suricata
        • ssdeep
        • swf_info
        • telfhash
        • tlsh
        • traffic_inspection
        • trid
        • vba_info
        • wireshark
        • 🔀🔒 analyses
        • 🔀 behaviours
        • 🔀 bundled_files
        • 🔀🔒 carbonblack_children
        • 🔀🔒 carbonblack_parents
        • 🔀🔒 clues
        • 🔀 comments
        • 🔀🔒 compressed_parents
        • 🔀 contacted_domains
        • 🔀 contacted_ips
        • 🔀 contacted_urls
        • 🔀 dropped_files
        • 🔀🔒 email_attachments
        • 🔀🔒 email_parents
        • 🔀🔒 embedded_domains
        • 🔀🔒 embedded_ips
        • 🔀🔒 embedded_urls
        • 🔀 execution_parents
        • 🔀 graphs
        • 🔀🔒 itw_domains
        • 🔀🔒 itw_ips
        • 🔀🔒 itw_urls
        • 🔀🔒 overlay_children
        • 🔀🔒 overlay_parents
        • 🔀🔒 pcap_children
        • 🔀🔒 pcap_parents
        • 🔀 pe_resource_children
        • 🔀 pe_resource_parents
        • 🔀 screenshots
        • 🔀🔒 sigma_analysis
        • 🔀🔒 similar_files
        • 🔀🔒 submissions
        • 🔀🔒 votes
      • File behaviour
        • dns_lookups
        • files_copied
        • files_dropped
        • http_conversations
        • ip_traffic
        • permissions_checked
        • processes_tree
        • sms_sent
        • tags
        • verdicts
      • Domains
        • 🔀🔒 caa_records
        • 🔀🔒 cname_records
        • 🔀 comments
        • 🔀 communicating_files
        • 🔀🔒 downloaded_files
        • 🔀 graphs
        • 🔀 historical_ssl_certificates
        • 🔀 historical_whois
        • 🔀 immediate_parent
        • 🔀🔒 mx_records
        • 🔀🔒 ns_records
        • 🔀 parent
        • 🔀 referrer_files
        • 🔀 related_comments
        • 🔀 resolutions
        • 🔀 siblings
        • 🔀🔒 soa_records
        • 🔀 subdomains
        • 🔀🔒 urls
      • IP addresses
        • 🔀 comments
        • 🔀 communicating_files
        • 🔀🔒 downloaded_files
        • 🔀 graphs
        • 🔀 historical_ssl_certificates
        • 🔀 historical_whois
        • 🔀 related_comments
        • 🔀 referrer_files
        • 🔀 resolutions
        • 🔀🔒 urls
      • URLs
        • 🔀🔒 analyses
        • 🔀 comments
        • 🔀🔒 contacted_domains
        • 🔀🔒 contacted_ips
        • 🔀🔒 downloaded_files
        • 🔀 graphs
        • 🔀 last_serving_ip_address
        • 🔀 network_location
        • 🔀🔒 redirecting_urls
        • 🔀🔒 redirects_to
        • 🔀 related_comments
        • 🔀🔒 submissions
      • Comments
        • 🔀 author
        • 🔀 item
      • Graphs
        • 🔀 comments
        • 🔀 editors
        • 🔀 group
        • 🔀 items
        • 🔀 owner
        • 🔀 viewers
      • Users
        • 🔀🧑‍💻 api_quota_group
        • 🔀 comments
        • 🔀 graphs
        • 🔀🧑‍💻 groups
        • 🔀🧑‍💻 groups_managed
        • 🔀🧑‍💻 hunting_rulesets
        • 🔀🧑‍💻 hunting_notifications
        • 🔀🧑‍💻 hunting_notification_files
        • 🔀🧑‍💻 intelligence_quota_group
        • 🔀 mentions
        • 🔀🧑‍💻 retrohunt_jobs
      • Submissions
      • Screenshots
      • Votes
      • Resolutions
      • Sigma Analyses
        • 🔀 rules
      • Sigma Rules
      • SSL Certificate
      • Whois
      • Analyses
      • Clues
        • 🔀 files
      • Groups
        • 🔀🧑‍💻 administrators
        • 🔀🧑‍💻 graphs
        • 🔀🧑‍💻 users
      • Hunting Rulesets
        • 🔀🧑‍💻 editors
        • 🔀🧑‍💻 hunting_notification_files
      • Hunting Notifications
      • Retrohunt Jobs
        • 🔀🧑‍💻 matching_files
        • 🔀🧑‍💻 owner
      • Operations
      • Yara Rulesets

      Public API Endpoints

      • Files
        • post
          /files
        • get
          /files/upload_url
        • get
          /files/{id}
        • post
          /files/{id}/analyse
        • get
          /files/{id}/comments
        • post
          /files/{id}/comments
        • get
          /files/{id}/votes
        • post
          /files/{id}/votes
        • get
          /files/{id}/{relationship}
        • get
          /files/{id}/relationships/{relationship}
        • get
          /files/{id}/behaviour_summary
        • get
          /file_behaviours/{sandbox_id}
        • get
          /file_behaviours/{sandbox_id}/html
        • get
          /file_behaviours/{sandbox_id}/pcap
        • get
          /sigma_analyses/{id}
        • get
          /sigma_analyses/{id}/{relationship}
        • get
          /sigma_analyses/{id}/relationships/{relationship}
        • get
          /sigma_rules/{id}
        • get
          /yara_rulesets/{id}
      • URLs
        • post
          /urls
        • get
          /urls/{id}
        • post
          /urls/{id}/analyse
        • get
          /urls/{id}/comments
        • post
          /urls/{id}/comments
        • get
          /urls/{id}/votes
        • post
          /urls/{id}/votes
        • get
          /urls/{id}/{relationship}
        • get
          /urls/{id}/relationships/{relationship}
      • Domains & Resolutions
        • get
          /domains/{domain}
        • get
          /domains/{domain}/comments
        • post
          /domains/{domain}/comments
        • get
          /domains/{domain}/{relationship}
        • get
          /domains/{domain}/relationships/{relationship}
        • get
          /domains/{domain}/votes
        • post
          /domains/{domain}/votes
        • get
          /resolutions/{id}
      • IP addresses
        • get
          /ip_addresses/{ip}
        • get
          /ip_addresses/{ip}/comments
        • post
          /ip_addresses/{ip}/comments
        • get
          /ip_addresses/{ip}/{relationship}
        • get
          /ip_addresses/{ip}/relationships/{relationship}
        • post
          /ip_addresses/{ip}/votes
        • get
          /ip_addresses/{ip}/votes
      • Analyses, Submissions & Operations
        • get
          /analyses/{id}
        • get
          /submissions/{id}
        • get
          /operations/{id}
      • Graphs
        • get
          /graphs
        • post
          /graphs
        • get
          /graphs/{id}
        • patch
          /graphs/{id}
        • delete
          /graphs/{id}
        • get
          /graphs/{id}/comments
        • post
          /graphs/{id}/comments
        • get
          /graphs/{id}/relationships/viewers
        • post
          /graphs/{id}/relationships/viewers
        • get
          /graphs/{id}/relationships/viewers/{user_or_group_id}
        • delete
          /graphs/{id}/relationships/viewers/{user_or_group_id}
        • get
          /graphs/{id}/relationships/editors
        • post
          /graphs/{id}/relationships/editors
        • get
          /graphs/{id}/relationships/editors/{user_or_group_id}
        • delete
          /graphs/{id}/relationships/editors/{user_or_group_id}
        • get
          /graphs/{id}/{relationship}
        • get
          /graphs/{id}/relationships/{relationship}
      • Comments
        • get
          /comments
        • get
          /comments/{id}
        • patch
          /comments/{id}
        • delete
          /comments/{id}
        • post
          /comments/{id}/vote
        • get
          /comments/{id}/{relationship}
        • get
          /comments/{id}/relationships/{relationship}
      • Search & Metadata
        • get
          /search
        • get
          /metadata

      VT Enterprise endpoints

      • Users & Groups
        • get
          /users/{id}
        • patch
          /users/{id}
        • delete
          /users/{id}
        • get
          /users/{id}/api_usage
        • get
          /users/{id}/overall_quotas
        • get
          /users/{id}/relationships/{relationship}
        • get
          /users/{id}/{relationship}
        • get
          /groups/{id}
        • patch
          /groups/{id}
        • get
          /groups/{id}/api_usage
        • get
          /groups/{id}/relationships/administrators
        • post
          /groups/{id}/relationships/administrators
        • get
          /groups/{id}/relationships/administrators/{user_id}
        • delete
          /groups/{id}/relationships/administrators/{user_id}
        • get
          /groups/{id}/relationships/users
        • get
          /groups/{id}/relationships/users/{user_id}
        • delete
          /groups/{id}/relationships/users/{user_id}
        • post
          /groups/{id}/relationships/users
        • get
          /groups/{id}/{relationship}
        • get
          /groups/{id}/relationships/{relationship}
      • Search
        • get
          /search
        • get
          /search/snippets/{snippet}
      • Zipping files
        • post
          /zip_files
        • get
          /zip_files/{id}
        • get
          /zip_files/{id}/download_url
        • get
          /zip_files/{id}/download
      • Files
        • get
          /files/{id}/download_url
        • get
          /files/{id}/download

      Hunting API Endpoints

      • Retrohunt
        • get
          /retrohunt_jobs
        • post
          /retrohunt_jobs
        • get
          /retrohunt_jobs/{id}
        • delete
          /retrohunt_jobs/{id}
        • post
          /retrohunt_jobs/{id}/abort
        • get
          /retrohunt_jobs/{id}/{relationship}
      • Livehunt
        • get
          /hunting_rulesets
        • post
          /hunting_rulesets
        • delete
          /hunting_rulesets
        • get
          /hunting_rulesets/{id}
        • patch
          /hunting_rulesets/{id}
        • get
          /hunting_rulesets/{id}/relationships/editors/{user_or_group_id}
        • delete
          /hunting_rulesets/{id}/relationships/editors/{user_or_group_id}
        • delete
          /hunting_rulesets/{id}
        • get
          /hunting_rulesets/{id}/relationships/{relationship}
        • post
          /hunting_rulesets/{id}/relationships/{relationship}
        • get
          /hunting_notifications
        • delete
          /hunting_notifications
        • get
          /hunting_notifications/{id}
        • delete
          /hunting_notifications/{id}
        • get
          /hunting_notification_files

      Feed API endpoints

      • Files
        • get
          /feeds/files/{time}
        • get
          /feeds/files/{token}/download
      • File Behaviours
        • get
          /feeds/file-behaviours/{time}
        • get
          /feeds/file-behaviours/{token}/pcap
        • get
          /feeds/file-behaviours/{token}/html
      • URLs
        • get
          /feeds/urls/{time}

      VT Monitor endpoints

      • Software Publishers
        • Monitor Items
        • get
          /items
        • post
          /items
        • get
          /items/upload_url
        • get
          /items/{id}
        • delete
          /items/{id}
        • patch
          /items/{id}/config
        • get
          /items/{id}/download
        • get
          /items/{id}/download_url
        • get
          /items/{id}/analyses
        • get
          /items/{id}/owner
        • get
          /items/{id}/comments
        • get
          /statistics
        • get
          /events
      • Antivirus Partners
        • get
          /hashes
        • get
          /hashes/{sha256}/analyses
        • get
          /hashes/{sha256}/items
        • post
          /hashes/{sha256}/comments
        • get
          /comments/{id}
        • patch
          /comments/{id}
        • delete
          /comments/{id}
        • get
          /files/{sha256}/download
        • get
          /files/{sha256}/download_url
        • get
          /detections_bundle/{engine_name}/download
        • get
          /detections_bundle/{engine_name}/download_url
        • get
          /statistics

      VirusTotal API v3 forms

      • Getting Started With Your API