VirusTotal aggregates detection results from 70+ antivirus engines and URL scanners. The API lets you submit files, URLs, domains, and IPs for malware analysis and retrieve detection reports. Results include per-engine verdicts, behavioral analysis from sandboxes, WHOIS data, passive DNS records, and relationships between threat indicators. Used by SOC teams, threat intelligence platforms, and security researchers worldwide.
https://www.virustotal.com/api/v3
Auth type
API Key Header
Auth header
x-apikey: YOUR_API_KEY
Rate limit
4 requests/min (free) · Higher on premium
Pricing
Free tier available
Free quota
4 lookups/min, 500 lookups/day
Documentation
https://docs.virustotal.com/reference
Endpoint status
Server online — HTTP 404 — server is online but path returned an error (may require auth)738ms
(checked Mar 29, 2026)
Builder score
B
73%
builder-friendly
Pass your API key in the x-apikey request header. Register for a free API key at virustotal.com.
x-apikey: YOUR_API_KEY
Free: 4 lookups/min, 500/day, public data only. Premium plans (contact VirusTotal): higher rate limits, private scanning, live hunting, retrohunt, intelligence feeds.
| Method | Path | Description |
|---|---|---|
| GET | /files/{id} |
Get analysis report for a file by SHA-256/SHA-1/MD5 |
| POST | /files |
Upload a file for analysis (up to 650MB) |
| GET | /urls/{id} |
Get URL scan results |
| POST | /urls |
Submit a URL for scanning |
| GET | /domains/{domain} |
Get domain reputation, WHOIS, and DNS data |
| GET | /ip_addresses/{ip} |
Get IP address reputation and passive DNS |
# Check a domain's reputation curl "https://www.virustotal.com/api/v3/domains/example.com" \ -H "x-apikey: $VT_API_KEY"
{
"data": {
"id": "example.com",
"type": "domain",
"attributes": {
"last_analysis_stats": {
"malicious": 0,
"suspicious": 0,
"undetected": 67,
"harmless": 14
},
"reputation": 0,
"registrar": "ICANN"
}
}
}
Data sourced from API Map. Always verify pricing and rate limits against the official VirusTotal documentation.