As an owner, use this endpoint to update attributes of your objects such as Threat Actor, Campaign, Malware Family, Software or Toolkit or IoC Collection. It supports the same JSON attributes defined in the creation endpoint.
This endpoint currently supports IoC Collections only. All other object types are in Private Preview.
Note that you don't need to include collection_type in the request body since this attribute is automatically inferred.
For IoC Collections, you may also append new indicators via raw text by using this endpoint.
This endpoint supports partial updates: only the attributes provided in the request body will be modified. However, list-based attributes follow a "full replace" logic: if a list is included in the payload, its current contents will be entirely overwritten by the new data. To add, remove or change items from a list, you must include the entire set of elements in your request. We recommend fetching the current object first to ensure existing items are preserved before submitting your update.
Examples
Set Spain as sponsor region for the Threat Actor threat-actor--8263daaaef36482a81de51621428177a. Overwrite its tags to "WIP" and "P0".
import requests
object_id = "threat-actor--8263daaaef36482a81de51621428177a"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}"
payload = {
"data": {
"type": "collection",
"attributes": {
"sponsor_region": "ES",
"tags":["WIP", "P0"]
}
}
}
headers = {"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"}
response = requests.patch(url, json=payload, headers=headers)Change the name and description of a private IoC collection.
import requests
object_id = "bd4dbd7a189ca9a31cb1b0bdbe64aaba6aa1454ddcfde707518b811d2bc5b363"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}"
payload = { "data":
{
"type": "collection",
"attributes":
{
"name": "New name",
"description": "New description."
}
}
}
headers = {
"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)Make public a private IoC collection.
import requests
object_id = "bd4dbd7a189ca9a31cb1b0bdbe64aaba6aa1454ddcfde707518b811d2bc5b363"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}"
payload = { "data":
{
"type": "collection",
"attributes":
{
"private": False
}
}
}
headers = {
"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)Add viewers to an IoC Collection.
import requests
object_id = "bd4dbd7a189ca9a31cb1b0bdbe64aaba6aa1454ddcfde707518b811d2bc5b363"
relationship = "viewers"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}"
payload = {
"data":[
{
"type": "group",
"id": "group_id"
}
]
}
headers = {
"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)