VirusTotal

About VirusTotal

VirusTotal's API allows uploading and scanning files or URLs, retrieving finished scan reports, and posting comments without using the website interface, enabling scripted access to VirusTotal's analysis data. It covers files, URLs, domains, and IP addresses, with endpoints for scanning, rescanning, downloading, retrieving behavior and network-traffic reports, feeds, clustering, and search.

Access requires a VirusTotal Community account, from which a personal API key is issued. A basic set of endpoints is available by default through the public API, while advanced research calls require the private API and special privileges obtained by contacting VirusTotal.

The API's terms of service prohibit its use in commercial products or services, as a substitute for antivirus products, or in any project that could harm the antivirus industry, with noncompliance resulting in a permanent ban.

Key features

• Upload and scan files or URLs for malware
• Retrieve finished scan reports via API
• File behaviour and network-traffic reports
• Domain and IP address reports
• Post and retrieve comments on scanned items
• File search and threat intel feed access

Frequently asked questions