---
updatedAt: 2026-02-27T11:41:48.000Z
agentTools:
  projectIndex: https://gtidocs.readme.io/llms.txt
---

# Export aggregations / commonalities from a vulnerability

Use this endpoint to export shared attributes among associated IoCs in either JSON or CSV format.

## Examples

Export commonalities from a [Vulnerability](https://gtidocs.readme.io/reference/vulnerability-object).

```python
import requests
import urllib

object_id = "vulnerability--cve-2022-30190"
format = "csv"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/aggregations/download/{format}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)
```

# OpenAPI definition

```json
{
  "info": {
    "title": "Vulnerability Intelligence",
    "version": "3.0"
  },
  "openapi": "3.1.0",
  "tags": [
    {
      "name": "Vulnerabilities"
    }
  ],
  "paths": {
    "/collections/{id}/aggregations/download/{format}": {
      "get": {
        "tags": [
          "Vulnerabilities"
        ],
        "deprecated": false,
        "description": "",
        "operationId": "export-vulnerability-aggregations",
        "parameters": [
          {
            "description": "Your API key",
            "in": "header",
            "name": "x-apikey",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Vulnerability's ID",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Export format (one of `json` or `csv`)",
            "in": "path",
            "name": "format",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{\n\t\"files\": {\n\t\t\"contacted_urls\": [\n\t\t\t{\n\t\t\t\t\"count\": 2,\n\t\t\t\t\"value\": \"http://ocsp.digicert.com/\"\n\t\t\t},\n\t\t\t{\n\t\t\t\t\"count\": 2,\n\t\t\t\t\"value\": \"http://crl3.digicert.com/Omniroot2025.crl\"\n\t\t\t}\n      ...\n\t\t],\n\t\t\"contacted_domains\": [\n\t\t\t{\n\t\t\t\t\"count\": 4,\n\t\t\t\t\"value\": \"nexusrules.officeapps.live.com\"\n\t\t\t},\n\t\t\t{\n\t\t\t\t\"count\": 4,\n\t\t\t\t\"value\": \"officeclient.microsoft.com\"\n\t\t\t},\n      ...\n\t\t],\n    ...\n\t},\n  ...\n}"
                  }
                }
              }
            },
            "description": "200"
          },
          "400": {
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{}"
                  }
                },
                "schema": {
                  "properties": {},
                  "type": "object"
                }
              }
            },
            "description": "400"
          }
        },
        "security": [],
        "summary": "Export aggregations / commonalities from a vulnerability"
      }
    }
  },
  "security": [],
  "servers": [
    {
      "url": "https://www.virustotal.com/api/v3"
    }
  ],
  "x-readme": {
    "explorer-enabled": true,
    "headers": [],
    "proxy-enabled": false,
    "samples-enabled": true
  }
}
```