VirusTotal API

www.virustotal.com · Security

Security API Key Free Tier Security Malware Threat Intelligence

Scan files, URLs, domains, and IPs against 70+ antivirus engines and website scanners. Free tier: 500 requests/day, 4 requests/minute.

Authentication

API Key authentication Free API key at virustotal.com. Pass as x-apikey header.

Sample Requests

POST Scan a URL

Submit a URL for malware scanning.

https://www.virustotal.com/api/v3/urls

Hover any highlighted part to learn what it does

Headers — extra info sent with the request

x-apikey	YOUR_KEY
Content-Type	application/x-www-form-urlencoded

Request Body — data you're sending

"url=https://example.com"

curl -X POST "https://www.virustotal.com/api/v3/urls" \
  -H "x-apikey: YOUR_KEY" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Content-Type: application/json" \
  -d '"url=https://example.com"'

import requests
headers = {
    "x-apikey": "YOUR_KEY",
    "Content-Type": "application/x-www-form-urlencoded"
}
data = "url=https://example.com"
response = requests.post(
    "https://www.virustotal.com/api/v3/urls",
    headers=headers,
    json=data,
)
print(response.json())

const url = 'https://www.virustotal.com/api/v3/urls';

const response = await fetch(url, {
  method: 'POST',
  headers: {
    'x-apikey': 'YOUR_KEY',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify("url=https://example.com"),
}); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"bytes"
	"encoding/json"
)

func main() {
	targetURL := "https://www.virustotal.com/api/v3/urls"
	jsonData, _ := json.Marshal("url=https://example.com")
	req, _ := http.NewRequest("POST", targetURL, bytes.NewBuffer(jsonData))
	req.Header.Set("x-apikey", "YOUR_KEY")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Content-Type", "application/json")

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://www.virustotal.com/api/v3/urls")

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Post.new(uri)
req["x-apikey"] = "YOUR_KEY"
req["Content-Type"] = "application/x-www-form-urlencoded"
req["Content-Type"] = "application/json"
req.body = "\"url=https://example.com\""

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://www.virustotal.com/api/v3/urls";
$opts = ["http" => [
    "method" => "POST",
    "header" => implode("\r\n", [
        "x-apikey: YOUR_KEY",
        "Content-Type: application/x-www-form-urlencoded",
        "Content-Type: application/json"
    ]),
    "content" => json_encode("url=https://example.com"),
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

GET Get URL analysis

Get the results of a URL scan.

https://www.virustotal.com/api/v3/urls/{id}

Hover any highlighted part to learn what it does

Headers — extra info sent with the request

x-apikey

YOUR_KEY

curl -X GET "https://www.virustotal.com/api/v3/urls/{id}" \
  -H "x-apikey: YOUR_KEY"

import requests
headers = {
    "x-apikey": "YOUR_KEY"
}
response = requests.get(
    "https://www.virustotal.com/api/v3/urls/{id}",
    headers=headers,
)
print(response.json())

const url = 'https://www.virustotal.com/api/v3/urls/{id}';

const response = await fetch(url, {
  headers: {
    'x-apikey': 'YOUR_KEY'
  },
}); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	targetURL := "https://www.virustotal.com/api/v3/urls/{id}"
	req, _ := http.NewRequest("GET", targetURL, nil)
	req.Header.Set("x-apikey", "YOUR_KEY")

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://www.virustotal.com/api/v3/urls/{id}")

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Get.new(uri)
req["x-apikey"] = "YOUR_KEY"

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://www.virustotal.com/api/v3/urls/{id}";
$opts = ["http" => [
    "method" => "GET",
    "header" => implode("\r\n", [
        "x-apikey: YOUR_KEY"
    ]),
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

Postman Setup Guide

Get Postman ↗

Get a free API key at virustotal.com
Set header: x-apikey: YOUR_KEY
Scan URL: POST /v3/urls with body url=https://suspicious-site.com
Check file by hash: GET /v3/files/{sha256_hash}
Free: 500 req/day, 4 req/min

What can you build with VirusTotal API?

VirusTotal API is a Security API. Developers commonly use security APIs for:

adding multi-factor authentication to your app
validating identity documents and biometrics
monitoring for data breaches and leaked credentials
running background checks and fraud screening
scanning code and infrastructure for vulnerabilities

API Key authentication. You'll receive a key after signing up. Send it with every request — in a header or query parameter. Keep it out of client-side code and never commit it to version control. VirusTotal API is free to use up to a usage limit, making it a low-risk choice to experiment with.

New to APIs? Read our beginner's guide

Open documentation ↗