Delete associations, IoCs and TTPs from a collection

As the owner, you can use this endpoint to remove elements such as IoCs, Attack Techniques and other associations from any of your threat objects, including: Threat Actor, Campaign, Malware Family, Software or Toolkit, IoC Collection.

❗️
This endpoint currently supports IoC Collections only. All other object types are in Private Preview.

Commonly used relationships are listed below. For a full specification, refer to the Relationships section within the object definition.

associations: it allows you to disassociate the following object types: threat actor, malware family, software or toolkit, IoC collection, vulnerability.
reports: it allows you to disassociate reports.
attack_techniques: it allows you disassociate attack techniques.
files,domains,urls,ip_addresses: they allow you to disassociate IoCs.

As showed in the object creation request body template here, for the urls relationship you either use {"type": "url", "url": <a URL string>} or {"type": "url", "id": <a sha256 URL identifier>} as object descriptors. For domains and IP addresses you can use {"type": "domain", "id": <a domain>} or {"type": "ip_address", "id": <an IP address>}.

Examples

Delete an element, google.com domain, from an existing IoC collection.

import requests

object_id = "bd4dbd7a189ca9a31cb1b0bdbe64aaba6aa1454ddcfde707518b811d2bc5b363"
relationship = "domains"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/{relationship}"
payload = { "data": 
    [
        {
            "type": "domain",
            "id": "google.com"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Disassociate the CVE-2026-39958 vulnerability from your threat-actor--c4cccd20514c416294a0b91fcfd40c44 actor.

import requests

object_id = "threat-actor--c4cccd20514c416294a0b91fcfd40c44"
relationship = "associations"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "collection",
            "id": "vulnerability--cve-2026-39958"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Disassociate the report--26-10018712 report from your actor.

import requests

object_id = "threat-actor--c4cccd20514c416294a0b91fcfd40c44"
relationship = "reports"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "collection",
            "id": "report--26-10018712"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Unlink the T1087 attack technique from your actor.

import requests

object_id = "threat-actor--c4cccd20514c416294a0b91fcfd40c44"
relationship = "attack_techniques"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "attack_technique",
            "id": "T1087"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Examples

400400