# VirusTotal API

**Provider:** VirusTotal
**Category:** security
**Base URL:** `https://www.virustotal.com/api/v3`
**Auth:** api-key — `x-apikey: YOUR_API_KEY`
**Rate Limit:** 4 requests/min (free) · Higher on premium
**Free Tier:** Yes — [object Object]
**Pricing:** Free tier available (freemium)
**Docs:** https://docs.virustotal.com/reference

## Description

VirusTotal aggregates detection results from 70+ antivirus engines and URL scanners. The API lets you submit files, URLs, domains, and IPs for malware analysis and retrieve detection reports. Results include per-engine verdicts, behavioral analysis from sandboxes, WHOIS data, passive DNS records, and relationships between threat indicators. Used by SOC teams, threat intelligence platforms, and security researchers worldwide.

## Endpoints

| Method | Endpoint | Description |
|--------|----------|-------------|
| GET | `https://www.virustotal.com/api/v3/files/{id}` | Get analysis report for a file by SHA-256/SHA-1/MD5 |
| POST | `https://www.virustotal.com/api/v3/files` | Upload a file for analysis (up to 650MB) |
| GET | `https://www.virustotal.com/api/v3/urls/{id}` | Get URL scan results |
| POST | `https://www.virustotal.com/api/v3/urls` | Submit a URL for scanning |
| GET | `https://www.virustotal.com/api/v3/domains/{domain}` | Get domain reputation, WHOIS, and DNS data |
| GET | `https://www.virustotal.com/api/v3/ip_addresses/{ip}` | Get IP address reputation and passive DNS |

## Authentication

Pass your API key in the x-apikey request header. Register for a free API key at virustotal.com.

```
x-apikey: YOUR_API_KEY
```

## Sample Request

```bash
# Check a domain's reputation
curl "https://www.virustotal.com/api/v3/domains/example.com" \
  -H "x-apikey: $VT_API_KEY"
```

## Sample Response

```json
{
  "data": {
    "id": "example.com",
    "type": "domain",
    "attributes": {
      "last_analysis_stats": {
        "malicious": 0,
        "suspicious": 0,
        "undetected": 67,
        "harmless": 14
      },
      "reputation": 0,
      "registrar": "ICANN"
    }
  }
}
```

## Pricing Details

Free: 4 lookups/min, 500/day, public data only. Premium plans (contact VirusTotal): higher rate limits, private scanning, live hunting, retrohunt, intelligence feeds.

---

*Source: [API Map](https://apimap.dev/apis/virustotal/) — CC BY 4.0*