🚧

IoC scanning and dataset inclusion

Any IoC submitted or queried via the API will be scanned and added to the Google Threat Intelligence dataset, making it accessible to the community. Do not submit or query indicators containing sensitive, confidential, or personally identifiable information (PII).

Retrieve summary for a list of IoCs. The request body must contain a data object with an iocs list of IoC descriptors.

Input

Accepts a data.iocs list of up to 1,000 IoC descriptors (type and id) in a single POST request.

Supported IoC Types

File hashes (SHA-256), domains, URLs, and IP addresses.

Output

Returns a concise summary object for each requested IoC, intended to improve efficiency and performance for large-scale enrichments.

Large Payloads

If the response exceeds the 30MB size limit, the API provides a GCS fallback mechanism, returning an HTTP 302 Found redirect to a short-lived (15 minutes TTL) signed URL for downloading the full JSON result.

Error Handling

Batch requests follow an "all-or-nothing" approach; if any single IoC descriptor cannot be processed, the entire request will be rejected with a 400 Bad Request.

Example

curl --request POST \
  --url https://www.virustotal.com/api/v3/iocs/summary \
  --header 'Content-Type: application/json' \
  --header 'x-apikey: <YOUR_API_KEY>' \
  --data '{
    "data": {
      "iocs": [
        {
          "type": "file",
          "id": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
        },
        {
          "type": "domain",
          "id": "example.com"
        },
        {
          "type": "ip_address",
          "id": "8.8.8.8"
        }
      ]
    }
  }'