{ "opencollection": "1.0.0", "info": { "name": "VirusTotal API v3 - Access Control Access Control - Group Management Private Scanning - Files API", "version": "3.0" }, "request": { "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "items": [ { "info": { "name": "Private Scanning - Files", "type": "folder" }, "items": [ { "info": { "name": "VirusTotal List Private Files", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/private/files", "params": [ { "name": "limit", "value": "", "type": "query", "description": "Maximum number of files to retrieve (40 max)" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nReturns a list of previously analysed [private files](https://gtidocs.virustotal.com/reference/private-files-object). The files are always ordered by SHA256.\n\n```json /api/v3/private/files\n{\n \"meta\": {\n \"cursor\": ,\n \"count\": \n },\n \"data\": {\n ,\n " }, { "info": { "name": "VirusTotal Upload a File", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/private/files", "body": { "type": "multipart-form", "data": [ { "name": "command_line", "type": "text", "value": "" }, { "name": "disable_sandbox", "type": "text", "value": "" }, { "name": "enable_internet", "type": "text", "value": "" }, { "name": "file", "type": "text", "value": "" }, { "name": "intercept_tls", "type": "text", "value": "" }, { "name": "password", "type": "text", "value": "" }, { "name": "retention_period_days", "type": "text", "value": "" }, { "name": "storage_region", "type": "text", "value": "" }, { "name": "interaction_sandbox", "type": "text", "value": "" }, { "name": "interaction_timeout", "type": "text", "value": "" } ] }, "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "Upload and analyse a file with Private Scanning\n> 📘 File size\n> \n> If the file to be uploaded is bigger than 32MB, please use the [/private/files/upload_url](https://gtidocs.virustotal.com/reference/private-files-upload-url) endpoint instead which admits files up to 650MB.\n" }, { "info": { "name": "VirusTotal Get a URL for Uploading Large Files", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/private/files/upload_url", "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFor uploading files smaller than 32MB you can simply use the [POST /files](https://gtidocs.virustotal.com/reference/upload-file-private-scanning) endpoint, but for larger files you need to obtain a special upload URL first, and then send the `POST` request to the upload URL instead of sending it to `/private/files" }, { "info": { "name": "VirusTotal Get a Private File Report", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/private/files/:id", "params": [ { "name": "id", "value": "", "type": "path", "description": "File's SHA-256" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint return information about a file scanned privately. Notice that it only accepts SHA-256 as the file's ID, MD5 and SHA-1 are not supported like in its [GET /files/{id}](https://gtidocs.virustotal.com/reference/file-info) public counterpart. The SHA-256 for the analysed file can be computed by yourself " }, { "info": { "name": "VirusTotal Delete a Private File Report", "type": "http" }, "http": { "method": "DELETE", "url": "https://www.virustotal.com/api/v3/private/files/:id", "params": [ { "name": "id", "value": "", "type": "path", "description": "File's SHA-256" }, { "name": "only_from_storage", "value": "", "type": "query", "description": "If true, only the file will be deleted from storage, but the generated reports and analyses won't." } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint deletes a private file from storage, as well as all the PrivateFile and PrivateAnalysis associated with it (unless `only_from_storage=true` is used.\n" }, { "info": { "name": "VirusTotal Get Object Descriptors Related to a File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/private/files/:id/relationships/:relationship", "params": [ { "name": "id", "value": "", "type": "path", "description": "File's SHA-256" }, { "name": "relationship", "value": "", "type": "path", "description": "Relationship name (see [table](ref:private-files-object#relationships))" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of related objects to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint is the same as [/files/{id}/{relationship}](https://gtidocs.virustotal.com/reference/private-files-relationships) except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.\n" }, { "info": { "name": "VirusTotal Get Objects Related to a Private File", "type": "http" }, "http": { "method": "GET", "url": "https://www.virustotal.com/api/v3/private/files/:id/:relationship", "params": [ { "name": "id", "value": "", "type": "path", "description": "File's SHA-256" }, { "name": "relationship", "value": "", "type": "path", "description": "Relationship name (see [table](ref:private-files-object#relationships))" }, { "name": "limit", "value": "", "type": "query", "description": "Maximum number of related objects to retrieve" }, { "name": "cursor", "value": "", "type": "query", "description": "Continuation cursor" } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nAs mentioned in the [Relationships](https://gtidocs.virustotal.com/reference/relationships) section, those related objects can be retrieved by sending `GET` requests to the relationship URL. \n\nAvailable relationships are described in the [private file](https://gtidocs.virustotal.com/reference/private-files-object)" }, { "info": { "name": "VirusTotal Rescan a Private File", "type": "http" }, "http": { "method": "POST", "url": "https://www.virustotal.com/api/v3/private/files/:sha256/analyse", "params": [ { "name": "sha256", "value": "", "type": "path", "description": "File's SHA256 hash" }, { "name": "command_line", "value": "", "type": "query", "description": "Command line arguments to use when running the file in sandboxes." }, { "name": "disable_sandbox", "value": "", "type": "query", "description": "If true, then the file won't be detonated in sandbox environments. False by default." }, { "name": "enable_internet", "value": "", "type": "query", "description": "If the file should have internet access when running in sandboxes. False by default." }, { "name": "intercept_tls", "value": "", "type": "query", "description": "Intercept HTTPS/TLS/SSL communication. Intercept HTTPS to view encypted URLS, hostnames and HTTP headers. This is detectable by any sample that checks certificates, and makes JA3 hashes unusable." }, { "name": "interaction_sandbox", "value": "", "type": "query", "description": "Select the sandbox desired for interactive use." }, { "name": "interaction_timeout", "value": "", "type": "query", "description": "Interaction timeout in seconds, minimum value: 60. (1 minute.) Max value: 1800: (30 minutes)." } ], "auth": { "type": "apikey", "key": "x-apikey", "value": "{{x-apikey}}", "placement": "header" } }, "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nReanalyses a private file. The same params from [/files](https://gtidocs.virustotal.com/reference/post_files) (other than the file) are accepted. Returns a [private analysis](https://gtidocs.virustotal.com/reference/private-analyses-object).\n\n```json Example\n{\n\t\"data\": {\n\t\t\"type\": \"private_analysis\",\n\t\t\"id\": \"ZmI5" } ] } ], "bundled": true }