Use this endpoint to modify the attributes of an existing saved search. This is an example request body:

{
    "data": {
        "type": "saved_search",
        "attributes": {
            "name": "new saved search's name",
            "description": "new saved search's description",
            "search_query": "new saved search's query/logic",
            "private": false,
            "tags": ["saved search's associated tags"]
        }
    }
}

The private field determines the search's accessibility:

if set to false (public), the saved search is viewable by all Google Threat Intelligence users.
if set to true (private), access is restricted to the owner and any specific users/groups with whom the owner has individually shared the search.

🚧
Important Note on Updating Tags: To modify the tag list using this endpoint (adding or removing a subset of tags), you must first retrieve the current full list of tags.

To Delete All Tags: use this endpoint with an empty list of tags ([]).

To Add a New Tags: retrieve the current list, append the new tags, and submit the resulting list.

To Remove a Subset of Tags: retrieve the current list, filter out the tags to be removed, and submit the remaining list.

This endpoint is restricted to use by the owner and editors of the saved search only.

To share a saved search with certain users or the owner's entire group, check out this endpoint

Examples

Change the name and the description of the saved search with ID f60631d600b44a91a8b20cef8c77aeac.

import requests

object_id = "f60631d600b44a91a8b20cef8c77aeac"

url = f"https://www.virustotal.com/api/v3/saved_searches/{object_id}"

payload = {
    "data": {
        "type": "saved_search",
        "attributes": {
            "name": "This is the new name of the saved search",
            "description": "This is the new description of the saved search"
        }
    }
}
headers = {"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"}
response = requests.patch(url, json=payload, headers=headers)

Share the saved search with ID f60631d600b44a91a8b20cef8c77aeac with the entire community.

import requests

object_id = "f60631d600b44a91a8b20cef8c77aeac"

url = f"https://www.virustotal.com/api/v3/saved_searches/{object_id}"

payload = {
    "data": {
        "type": "saved_search",
        "attributes": {
            "private": False
        }
    }
}
headers = {"accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"}
response = requests.patch(url, json=payload, headers=headers)

200200

400400