{ "opencollection": "1.0.0", "info": { "name": "VirusTotal API v3 - Access Control Access Control - Group Management IoC Investigation - Files API", "version": "3.0" }, "request": { "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "items": [ { "info": { "name": "IoC Investigation - Files", "type": "folder" }, "items": [ { "info": { "name": "VirusTotal Get a URL for Uploading Large Files", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/upload_url", "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "For uploading files smaller than 32MB you can simply use the [POST /files](https://gtidocs.virustotal.com/reference/files-scan) endpoint, but for larger files you need to obtain a special upload URL first, and then send the `POST` request to the upload URL instead of sending it to `/files`. The `POST` request should have the same format expected by the [POST /files](https://gtidocs.virustotal.com/reference/files-scan) endpoint. Each upload URL can be used only once.\n\n> ๐Ÿ“˜ Files larger than 200M" }, { "info": { "name": "VirusTotal Upload a File", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/files", "body": { "type": "multipart-form", "data": [ { "name": "file", "type": "text", "value": "" }, { "name": "password", "type": "text", "value": "" } ] }, "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Upload and analyse a file\n\n> ๐Ÿ“˜ File size\n> \n> If the file to be uploaded is bigger than 32MB, please use the [/files/upload_url](https://gtidocs.virustotal.com/reference/files-upload-url) endpoint instead which admits files up to 650MB." }, { "info": { "name": "VirusTotal Get a File Report", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id", "headers": [ { "name": "x-tool", "value": "" } ], "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Returns a [File](https://gtidocs.virustotal.com/reference/object-files) object.\n" }, { "info": { "name": "VirusTotal Request a File Rescan (re-analyze)", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/files/:id/analyse", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> โ—๏ธ Caution\n> \n> This API endpoint has the potential to produce a denial of service on the scanning infrastructure if abused. Please contact us if you are going to be rescanning more than 50K files per day.\n\nFiles that have been already uploaded to Google TI can be re-analysed without uploading them again, you can use this endpoint for that purpose. The response is an object descriptor for the new analysis as in the [POST /files](https://gtidocs.virustotal.com/reference/files-scan) endpoint. Th" }, { "info": { "name": "VirusTotal Get Comments on a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/comments", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of comments to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Returns a list of [Comment](https://gtidocs.virustotal.com/reference/comment-object) objects.\n" }, { "info": { "name": "VirusTotal Add a Comment to a File", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/files/:id/comments", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "With this endpoint you can post a comment for a given file. The body for the `POST` request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments.\n\nAny word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute.\n\nReturns a [Comment](https://gtidocs.virustotal.com/reference/comment-object) object.\n\n```json Example request\n{\n \"" }, { "info": { "name": "VirusTotal Download a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/download", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "This endpoint is similar to [GET /files/{id}/download_url](https://gtidocs.virustotal.com/reference/files-download-url), but it redirects you to the download URL. The download URL you are redirected to can be reused as many times as you want for a period of 1 hour. After that period the URL expires and can't be used anymore.\n" }, { "info": { "name": "VirusTotal Get a Fileโ€™s Download URL", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/download_url", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "This endpoint returns a signed URL from where you can download the specified file. Getting the URL counts as a file download in your quota, even if you don't actually download the file, but once you have the URL you can use it to download the file multiple times without consuming any quota at all. The URL expires after 1 hour.\n\n```json Example response\n{\n \"data\": \"https://vtsamples.commondatastorage.googleapis.com/275a..fd0f?GoogleAccessId=758681729565-rc7fcckv235v1@developer.gserviceaccount.co" }, { "info": { "name": "VirusTotal Get Object Descriptors Related to a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/relationships/:relationship", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" }, { "name": "relationship", "value": "", "type": "path", "description": "Relationship name (see [table](ref:object-files#relationships))" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of related objects to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "This endpoint is the same as [/files/{id}/{relationship}](https://gtidocs.virustotal.com/reference/files-relationships) except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.\n" }, { "info": { "name": "VirusTotal Get Votes on a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/votes", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of votes to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Returns a list of [Vote](https://gtidocs.virustotal.com/reference/vote-object) objects.\n" }, { "info": { "name": "VirusTotal Add a Vote on a File", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/files/:id/votes", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" } ], "body": { "type": "json", "data": "{}" }, "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "With this endpoint you can post a vote for a given file. The body for the `POST` request must be the JSON representation of a vote object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new votes.\n\nThe verdict attribute must have be either `harmless` or `malicious`.\n\nReturns a [Vote](https://gtidocs.virustotal.com/reference/vote-object) object.\n\n```json Example request\n{\n \"data\": {\n \"type\": \"vote\",\n \"attributes\": {\n \t\"verdict" }, { "info": { "name": "VirusTotal Get Objects Related to a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/files/:id/:relationship", "params": [ { "name": "id", "value": "", "type": "path", "description": "SHA-256, SHA-1 or MD5 identifying the file" }, { "name": "relationship", "value": "", "type": "path", "description": "Relationship name (see [table](ref:object-files#relationships))" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of related objects to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "File objects have many relationships to other files and objects. As mentioned in the [Relationships](https://gtidocs.virustotal.com/reference/relationships) section, those related objects can be retrieved by sending `GET` requests to the relationship URL. \n\nSome relationships are accessible only to users who have access to VirusTotal Enterprise package.\n\nMore common relationships are described in the [File](https://gtidocs.virustotal.com/reference/object-files) object documentation and you can u" }, { "info": { "name": "VirusTotal Get a Crowdsourced Sigma Rule Object", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/sigma_rules/:id", "params": [ { "name": "id", "value": "", "type": "path", "description": "Rule ID" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Returns a [Sigma Rule](https://gtidocs.virustotal.com/reference/sigma-rule-object) object.\n" }, { "info": { "name": "VirusTotal Get a Crowdsourced YARA Ruleset", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/yara_rulesets/:id", "params": [ { "name": "id", "value": "", "type": "path", "description": "Ruleset ID to fetch." } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Returns a [YARA Ruleset](https://gtidocs.virustotal.com/reference/yara-rulesets-object) object used in our crowdsourced YARA results.\n" } ] } ], "bundled": true }