post
https://www.virustotal.com/api/v3/agentspace/flows
Create a new Agentic Flow.
Creates a new Flow inside the caller's group. name is required (max 255 characters). The graph itself (nodes and connections) can be supplied at creation time or added later with a partial update. A Flow only runs on its trigger while enabled is true.
{
"data": {
"type": "flow",
"attributes": {
"name": "Daily malicious-URL digest",
"enabled": true,
"nodes": [
{
"id": "n1",
"type": "NODE_TYPE_SCHEDULE_TIME",
"name": "Every morning",
"schedule_node": {
"cron_expression": "0 9 * * *",
"timezone": "UTC"
}
},
{
"id": "n2",
"type": "NODE_TYPE_RUN_PROMPT",
"name": "Summarise new detections",
"run_prompt_node": {
"prompt": "Summarise URLs first seen in the last 24h that are flagged malicious by 5+ engines."
}
},
{
"id": "n3",
"type": "NODE_TYPE_SEND_EMAIL",
"name": "Email the SOC",
"send_email_node": {
"notification_emails": [
"[email protected]"
],
"email_subject": "Daily malicious-URL digest",
"message": "See attached summary."
}
}
],
"connections": [
{
"source_node_id": "n1",
"target_node_id": "n2",
"source_handle": ""
},
{
"source_node_id": "n2",
"target_node_id": "n3",
"source_handle": ""
}
]
}
}
}