openapi: 3.0.3 info: title: VirusTotal API v3 - Access Control Access Control - Group Management IoC Feeds - Sandbox analyses feed API version: '3.0' description: Manage users, groups, service accounts, API quotas, and overall account usage in VirusTotal / Google Threat Intelligence. contact: name: VirusTotal / Google Threat Intelligence url: https://docs.virustotal.com/reference/overview license: name: VirusTotal Terms of Service url: https://www.virustotal.com/gui/terms-of-service x-generated-from: https://storage.googleapis.com/gtidocresources/guides/GTI_API_v3_openapi_spec_10022025.json x-last-validated: '2026-05-29' servers: - url: https://www.virustotal.com/api/v3 description: VirusTotal / GTI API v3 production. security: - VTApiKey: [] tags: - name: IoC Feeds - Sandbox analyses feed description: IoC Feeds - Sandbox analyses feed paths: /feeds/file_behaviours/hourly/{time}: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nThis endpoint returns a single package containing all minutely packages returned in [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) endpoint for a given hour. The returned file is a `.tar.bz2` file which contains the 60 minutely feeds for that hour.\n\nThe provided `time` argument must be in `YYYYMMDDhh` format. For example, time `2021012211` returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. You can download batches up to 7 days old, and the most recent batch has always a 2 hours lag with respect with to the current time. This means that if the current time in UTC is T you can download batch T-2h but any more recent.\n\nSuccessful calls to this endpoint will return a `302` redirect response to a URL from which the final batch file will be downloaded.\n" operationId: feedsFileBehaviourHourly parameters: - description: A string in format YYYYMMDDhh in: path name: time required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '200' '400': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '400' security: - VTApiKey: [] summary: VirusTotal Get an Hourly File Behaviour Feed Batch x-microcks-operation: delay: 0 dispatcher: FALLBACK /feeds/file_behaviours/{time}: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nWith this endpoint you can download an individual one-minute batches by providing a `time` consisting of a string with format `YYYYMMDDhhmm`. Time `201912010802` will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect to the current time. This means that if the current time in UTC is `T` you can download batch `T-60m` but not `T-59m` or any more recent.\n\nSuccessful calls to this endpoint will return a `302` redirect response to a URL from which the final batch file will be downloaded.\n\n> \U0001F6A7 Missing batches\n> \n> Missing batches are rare, but still can happen occasionally. This doesn't mean that you are losing any files in the feed, it just means that no batches were generated on a specific minute. The client code should be ready to accept a `404` error while retrieving a batch and proceed with the following one. However, receiving multiple `404` errors in a row for consecutive batches shouldn't happen and should be treated as an error condition.\n\nThe downloaded file is a bzip2 compressed UTF-8 text file containing one JSON structure per line, where the structure represents a FileBehaviour object as returned by the [GET /files/{id}/behaviour](https://gtidocs.virustotal.com/reference/files-relationships) endpoint and is defined by [FileBehaviourSummary Object](https://gtidocs.virustotal.com/reference/file-behaviour-summary-object).\n\nThe FileBehaviour object will contain an extra attribute (`context_attributes`), which is a JSON structure that contains links for downloading the PCAP, HTML, EVTX and memdump files generated in the analysis through our API without consuming your quota (bear in mind that you will have to use your API Key and add it to the request headers in order to get access to the behaviour reports pointed by those two links).\n\n```json Entry line structure\n{\n \"attributes\": ,\n \"context_attributes\": {\n \"file_md5\": \"\",\n \"file_sha1\": \"\",\n \"file_type_tag\": \"\",\n \"html_report\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours//html\",\n \"pcap\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours//pcap\",\n \"evtx\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours//evtx\",\n \"memdump\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours//memdump\"\n },\n \"id\": \"\",\n \"type\": \"file_behaviour\",\n \"relationshiops\": {...},\n \"links\": {...} \n}\n```\n" operationId: feedsFileBehaviour parameters: - description: A string in format YYYYMMDDhhmm in: path name: time required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '' description: '200' '400': description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Object not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit or quota exceeded. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - VTApiKey: [] summary: VirusTotal Get a Per-minute File Behaviour Feed Batch x-microcks-operation: delay: 0 dispatcher: FALLBACK /feeds/file_behaviours/{token}/evtx: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a link to this API endpoint to download the extracted EVTX from the file's Windows sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n \"context_attributes\": {\n \"evtx\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours//evtx\"\n }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n" operationId: fileBehaviourFeedEvtx parameters: - description: Download token. It is included the "evtx" context attribute at the file behaviour feed. in: path name: token required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '200' '400': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '400' security: - VTApiKey: [] summary: VirusTotal Get the EVTX File Generated During a File’s Behavior Analysis x-microcks-operation: delay: 0 dispatcher: FALLBACK /feeds/file_behaviours/{token}/html: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the the file's sandbox execution HTML report. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json\n{\n \"context_attributes\": {\n \"html_report\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours//evtx\"\n }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n" operationId: fileBehaviourFeedHtml parameters: - description: Download token. It can be found inside the behaviour object's properties in the file behaviour feed. in: path name: token required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '200' '400': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '400' security: - VTApiKey: [] summary: VirusTotal Get a File Behaviour's Detailed HTML Report x-microcks-operation: delay: 0 dispatcher: FALLBACK /feeds/file_behaviours/{token}/memdump: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted memdump from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n \"context_attributes\": {\n \"memdump\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours//memdump\"\n }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n" operationId: fileBehaviourFeedMemdump parameters: - description: Download token. It can be found inside the behaviour object's properties in the behaviour feed. in: path name: token required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '200' '400': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '400' security: - VTApiKey: [] summary: VirusTotal Get the Memdump File Generated During a File’s Behavior Analysis x-microcks-operation: delay: 0 dispatcher: FALLBACK /feeds/file_behaviours/{token}/pcap: get: tags: - IoC Feeds - Sandbox analyses feed deprecated: false description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted PCAP from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n \"context_attributes\": {\n \"pcap\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours//pcap\"\n }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n" operationId: fileBehaviourFeedPcap parameters: - description: Download token. It can be found inside the behaviour object's properties in the behaviour feed. in: path name: token required: true schema: type: string responses: '200': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '200' '400': content: application/json: examples: Result: value: '{}' schema: properties: {} type: object description: '400' security: - VTApiKey: [] summary: VirusTotal Get the PCAP File Generated During a File’s Behavior Analysis x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: Error: type: object description: Standard VirusTotal API error envelope. properties: code: type: string description: Machine-readable error code. example: NotFoundError message: type: string description: Human-readable error message. example: Resource not found required: - code - message ErrorResponse: type: object description: Error response envelope returned by the VirusTotal API. properties: error: $ref: '#/components/schemas/Error' required: - error securitySchemes: VTApiKey: type: apiKey in: header name: x-apikey description: Personal VirusTotal / GTI API key. Found in the user menu of your VirusTotal account.