Delete associations, IoCs and TTPs from a report

As the owner, you can use this endpoint to remove elements such as IoCs, Attack Techniques and other associations from any of your Reports.

❗️
This endpoint is currently in Private Preview.

Commonly used relationships are listed below. For the full specification, see the complete list here.

associations: it allows you to disassociate the following object types: threat actor, malware family, software or toolkit, IoC collection, vulnerability.
reports: it allows you to disassociate reports.
attack_techniques: it allows you disassociate attack techniques.
files,domains,urls,ip_addresses: they allow you to disassociate IoCs.

As showed in the object creation request body template here, for the urls relationship you either use {"type": "url", "url": <a URL string>} or {"type": "url", "id": <a sha256 URL identifier>} as object descriptors. For domains and IP addresses you can use {"type": "domain", "id": <a domain>} or {"type": "ip_address", "id": <an IP address>}.

Examples

Delete an element, google.com domain, from your report--0efaa5e4a4b94c54aae31ec28922c37b report.

import requests

object_id = "report--0efaa5e4a4b94c54aae31ec28922c37b"
relationship = "domains"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/{relationship}"
payload = { "data": 
    [
        {
            "type": "domain",
            "id": "google.com"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Disassociate the CVE-2026-39958 vulnerability from your report--0efaa5e4a4b94c54aae31ec28922c37b report.

import requests

object_id = "report--0efaa5e4a4b94c54aae31ec28922c37b"
relationship = "associations"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "collection",
            "id": "vulnerability--cve-2026-39958"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Disassociate the report--26-10018712 report from your report.

import requests

object_id = "report--0efaa5e4a4b94c54aae31ec28922c37b"
relationship = "reports"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "collection",
            "id": "report--26-10018712"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Unlink the T1087 attack technique from your report.

import requests

object_id = "report--0efaa5e4a4b94c54aae31ec28922c37b"
relationship = "attack_techniques"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"

payload = { "data": 
    [
        {
            "type": "attack_technique",
            "id": "T1087"
        }
    ]
}
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)

Examples

400400