get
https://www.virustotal.com/api/v3/saved_searches
Use this endpoint to list Saved Searches you have access to as owner, editor or viewer.
Filters
Available filters for saved searches:
creation_date: filters saved searches by their last modification date, accepting either theYYYY-MM-DDTHH:MM:SSformat or an Epoch UTC timestamp format. E.g.:creation_date:2025-10-27+,creation_date:2025-11-27T01:15:09,creation_date:2025-09-15-,creation_date:1764326675-.last_modification_date: filters saved searches by their last modification date, accepting either theYYYY-MM-DDTHH:MM:SSformat or an Epoch UTC timestamp format. E.g.:last_modification_date:2025-10-28+,last_modification_date:2025-10-27T09:31:25,last_modification_date:2025-10-26-,last_modification_date:1763721875+.shared_with_me:true: filters saved searches that were created by other users but shared with the current one. Note that this filter only supports thetruevalue.origin: filters saved searches by their origin. Available options: Crowdsourced for those created by the community, Google Threat Intelligence for those created GTIG team and Partner for those created by trusted partners. E.g.:origin:Crowdsourced,origin:"Google Threat Intelligence".owner: filters saved searches based on their creator/owner user identifier. It is particularly useful for listing saved searches created by users whose content you trust or want to follow. E.g.:owner:<user_id>.editor: filters saved searches editable by a specified user. E.g.:editor:<user_id>.viewer: Filters saved searches viewable by a specified user. E.g.:viewer:<user_id>.
Orders
Available sorting options for saved searches:
creation_date: sorts saved searches by their last modification date ascending (+) or descending (-). E.g.:creation_date+,creation_date-.last_modification_date: sorts saved searches by their last modification date ascending (+) or descending (-). E.g.:last_modification_date+,last_modification_date-(default order).name: sorts saved searches by their name ascending (+) or descending (-). E.g.:name+,name-.
Examples
List all of my saved searches, including their editors, and display only the name and description.
import requests
import urllib
filters = "shared_with_me:true"
relationships = "editors"
attributes = "name,description"
url = f"https://www.virustotal.com/api/v3/saved_searches?filter={urllib.parse.quote(filters)}&relationships={relationships}&attributes={attributes}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)Retrieve saved searches created by Ana during August and September 2025.
import requests
import urllib
filters = "owner:ana creation_date:2025-08-01+ creation_date:2025-10-01+"
url = f"https://www.virustotal.com/api/v3/saved_searches?filter={urllib.parse.quote(filters)}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)List all saved searches created by the Google Threat Intelligence team.
import requests
import urllib
filters = "origin:'Google Threat Intelligence'"
url = f"https://www.virustotal.com/api/v3/saved_searches?filter={urllib.parse.quote(filters)}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)