These docs are for v2.0. Click to read the latest docs for v3.0.

Retrieve live feed of all URLs submitted to VirusTotal


Private API

This endpoint is available in the Private API only.

This endpoint allows you to retrieve a live feed of reports on absolutely all URLs scanned by VirusTotal. It requires you to stay relatively synced with the live submissions as only a backlog of 24 hours is provided at any given point in time.

The package argument indicates a time window to pull reports on all items received during such window. Only per-minute and hourly windows are allowed, the format is %Y%m%dT%H%M (e.g. 20160304T0900) or %Y%m%dT%H (e.g. 20160304T09). Time is expressed in UTC.

The response is a bzip2 compressed tarball. For per-minute packages the compressed package contains a unique file, the file contains a JSON per line, this JSON is a full report on a given URL processed by VirusTotal during the given time window. The URL report follows the exact same format as the response of the /url/report endpoint when allinfo=true is provided. For hourly packages, the tarball contains 60 files, one per each one-minute window.

Click Try It! to start a request and see the response here!