What it does
VirusTotal API v3 gives applications programmatic access to malware and URL reputation reports, analysis submissions, and related threat-intelligence objects. It uses resource-oriented REST endpoints and JSON requests and responses, covering files, URLs, domains, IP addresses, comments, and analysis results. The public API is a limited no-cost option for registered community users; broader premium endpoints, additional context, and higher quotas are separately licensed. Its focus is threat-intelligence reports and analysis workflows rather than general-purpose application data.
VirusTotal’s API v3 is useful when a security workflow needs to look up an existing file hash, domain, IP address, or URL and incorporate the returned analysis into an investigation. The official reference documents REST-style resource endpoints and JSON responses for reports, rescans, submissions, relationships, and other objects. For a first integration, start with an existing hash or URL report lookup; scan and upload actions are separate POST operations in the reference.
Every request must include the account’s API key in the x-apikey header over HTTPS. Keep that key in server-side secret storage: the documentation says it carries the user’s privileges.
The Public API is explicitly no-cost but limited to 500 requests per day and four per minute. It must not be used in commercial products or services, or in business workflows that do not contribute new files. Premium endpoints are identified in the reference, require a separate license, and expose additional threat context and higher quotas; VirusTotal asks interested users to contact it, and the pages reviewed do not give a price. Check these restrictions before using the API in an automated pipeline, because a technically valid request can still fall outside the permitted use.
Strengths
- A consistent REST and JSON model covers reports for files, URLs, domains, and IP addresses, plus analysis and relationship objects.
- The documentation distinguishes public endpoints from premium-only capabilities and explains separate API quotas and access rules.
- The no-cost Public API is available to registered users for appropriately limited, non-commercial use.
Watch out for
- Public API use requires a VirusTotal Community account and API key.
- Public access is limited to 500 requests per day and four per minute, and cannot be used in commercial products or most business workflows.
- Premium endpoints require a separate license and provide capabilities distinct from the Public API.
Best for
- Small-scale, non-commercial threat-intelligence lookups in research or personal security tooling
- Security developers comparing public and licensed API capabilities before planning an integration
Sources
- VirusTotal API v3 Overview (Oct 26, 2026)
- Public vs Premium API (Oct 26, 2026)
- Authentication (Oct 26, 2026)