While many of the endpoints and features provided by the VirusTotal API are freely accessible to all registered users, some of them are restricted to our premium customers only. Those endpoints and features constitute the VirusTotal Private API and they will be appropriately identified in this section. If you are interested in using our Private API please contact us.
- The Public API, on the other hand, is a set of endpoints available for everyone to use at no cost. The only thing you need in order to use the Public API is to sign up in VirusTotal Community and obtain your API key as described in Getting started.
Notice
The Public API is limited to 500 requests per day and a rate of 4 requests per minute.
The Public API must not be used in commercial products, services or business workflows.
The Private API returns more threat data and exposes more endpoints.
The Private API is governed by an SLA that guarantees readiness of data.
The Private API has the following advantages over the Public API:
- Allows you to choose a request rate and daily quota allowance that best suits your needs.
- Will return further details about the resources scanned by VirusTotal, for instance: VBA code stream warnings for documents, source metadata, ExifTool output, IDS output for recorded network traces, etc.
- Includes metadata generated exclusively by VirusTotal: first submission date of a given file, list of file names with which a file was submitted to VirusTotal, submission countries, prevalence, etc.
- Will give you access to behavior information about files, produced by executing Windows PEs, DMGs, Mach-Os and APKs in a virtualized sandbox environment.
- Exposes whitelisting and trusted source information.
- Allows you to perform property to sample queries: reverse searches such as give me all samples that are detected with the following signature, give me all samples that are detected by more than 10 engines, give me all samples that contain a given PE section with the following hash, etc. these search modifiers can be combined to build complex requests.
- Exposes file clustering and file similarity search calls.
- Enables you to download submitted samples for further research, along with the network traffic captures they generate upon execution and their detailed execution reports.
- Has a strict Service License Agreement (SLA) that guarantees availability and readiness of data.