Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.0.3
info:
title: VirusTotal API v3 - Access Control Access Control - Group Management Access Control - Quota Management API
version: '3.0'
description: Manage users, groups, service accounts, API quotas, and overall account usage in VirusTotal / Google Threat Intelligence.
contact:
name: VirusTotal / Google Threat Intelligence
url: https://docs.virustotal.com/reference/overview
license:
name: VirusTotal Terms of Service
url: https://www.virustotal.com/gui/terms-of-service
x-generated-from: https://storage.googleapis.com/gtidocresources/guides/GTI_API_v3_openapi_spec_10022025.json
x-last-validated: '2026-05-29'
servers:
- url: https://www.virustotal.com/api/v3
description: VirusTotal / GTI API v3 production.
security:
- VTApiKey: []
tags:
- name: Access Control - Quota Management
description: Access Control - Quota Management
paths:
/users/{id}/api_usage:
get:
tags:
- Access Control - Quota Management
deprecated: false
description: "This endpoint retrieves information about a the API usage, broken down by endpoint, of an user in a specific range of days (last 30 days by default). \nThe period of time can be delimited by the two query parameters **start_date** and **end_date**, being the first and last day when API usage data will be retrieved, respectively. \nThe data available includes only the last 60 natural days.\n\n> \U0001F6A7 Time range restrictions\n> \n> The maximum range of time allowed by this endpoint is 30 days. If a greater range of time is specified, this endpoint will return an error message as response.\n\nThe user can be retrieved either by user ID or by API key, but the latter only works if the requester is the user himself or an administrator of a group the user belongs to.\n\n```json Example response\n{\n \"data\": {\n \"daily\": {\n \"2020-08-10\": {\n \"urls\": 2\n },\n \"2020-08-11\": {\n \"domains\": 1,\n \"file_relationships\": 1,\n \"files\": 1\n },\n \"2020-08-12\": {\n \"analyses\": 25,\n \"file_analyse\": 3,\n \"files\": 6\n },\n \"2020-08-17\": {\n \"urls\": 3\n },\n \"2020-08-18\": {\n \"urls\": 1\n },\n \"2020-08-20\": {\n \"file_download\": 36,\n \"file_relationships\": 5,\n \"files\": 1\n },\n \"2020-08-21\": {\n \"file_analyse\": 1,\n \"file_download\": 92,\n \"files\": 1\n },\n \"2020-08-23\": {\n \"analyses\": 5,\n \"file_analyse\": 1\n },\n \"2020-08-25\": {\n \"file_download\": 51\n },\n \"2020-08-26\": {\n \"file_download\": 51\n },\n \"2020-08-28\": {\n \"file_download\": 14\n },\n \"2020-08-31\": {\n \"file_download\": 6\n },\n \"2020-09-01\": {\n \"file_download\": 81\n },\n \"2020-09-02\": {\n \"file_relationships\": 5,\n \"graphs\": 1\n },\n \"2020-09-03\": {\n \"file_relationships\": 6,\n \"graph_comments\": 1,\n \"graph_items\": 3,\n \"graphs\": 2,\n \"retrohunt_jobs\": 2\n },\n \"2020-09-05\": {\n \"comment_relationships\": 1,\n \"comments\": 4,\n \"domain_comments\": 1,\n \"domain_graphs\": 2,\n \"domain_relationships\": 1,\n \"file_analyse\": 1,\n \"statistics\": 1\n },\n \"2020-09-06\": {\n \"file_behaviours\": 6,\n \"file_relationships\": 2,\n \"graph_comments\": 1,\n \"graphs\": 5\n },\n \"2020-09-07\": {\n \"domain_relationships\": 1,\n \"intelligence_search\": 5,\n \"resolutions\": 1,\n \"search\": 6,\n \"submissions\": 1,\n \"url_relationships\": 1,\n \"urls\": 2\n }\n },\n \"total\": {\n \"analyses\": 30,\n \"comment_relationships\": 1,\n \"comments\": 4,\n \"domain_comments\": 1,\n \"domain_graphs\": 2,\n \"domain_relationships\": 2,\n \"domains\": 1,\n \"file_analyse\": 6,\n \"file_behaviours\": 6,\n \"file_download\": 331,\n \"file_relationships\": 19,\n \"files\": 9,\n \"graph_comments\": 2,\n \"graph_items\": 3,\n \"graphs\": 8,\n \"intelligence_search\": 5,\n \"resolutions\": 1,\n \"retrohunt_jobs\": 2,\n \"search\": 6,\n \"statistics\": 1,\n \"submissions\": 1,\n \"url_relationships\": 1,\n \"urls\": 8\n }\n }\n}\n```\n"
operationId: userApiUsage
parameters:
- description: User ID or API key
in: path
name: id
required: true
schema:
type: string
- description: A string in format YYYYMMDD
in: query
name: start_date
schema:
type: string
- description: A string in format YYYYMMDD
in: query
name: end_date
schema:
type: string
responses:
'200':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '200'
'400':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '400'
security:
- VTApiKey: []
summary: VirusTotal Get a User’s API Usage
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/users/{id}/overall_quotas:
get:
tags:
- Access Control - Quota Management
deprecated: false
description: "This endpoint returns a summary of a user's overall quotas including:\n\n- `allowed`: \\<_integer_> quota limit.\n- `inherited_from`: \\<_string_> group from which the quota is inherited.\n- `used`: \\<_integer_> how many quota has been used.\n\nConsumption data based on natural month and UTC.\n\n```json Example\n{\n \"data\": {\n \"api_requests_daily\": {\n \"group\": {\n \"allowed\": 99000000,\n \"inherited_from\": \"company\",\n \"used\": 45073\n },\n \"user\": {\n \"allowed\": 1000000000,\n \"used\": 17\n }\n },\n \"api_requests_hourly\": {\n \"group\": {\n \"allowed\": 3300000,\n \"inherited_from\": \"company\",\n \"used\": 653\n },\n \"user\": {\n \"allowed\": 60000000000,\n \"used\": 0\n }\n },\n \"api_requests_monthly\": {\n \"group\": {\n \"allowed\": 2000000000,\n \"inherited_from\": \"company\",\n \"used\": 142176\n },\n \"user\": {\n \"allowed\": 1000000000,\n \"used\": 137\n }\n }\n }\n}\n```\n"
operationId: getUserOverallQuotas
parameters:
- description: User ID or API key
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '200'
'400':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '400'
security:
- VTApiKey: []
summary: VirusTotal Get a User’s Quota Summary
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/groups/{id}/api_usage:
get:
tags:
- Access Control - Quota Management
deprecated: false
description: "This endpoint retrieves information about a the API usage, broken down by endpoint, of a group in a specific range of days (last 30 days by default). \nThe period of time can be delimited by the two query parameters **start_date** and **end_date**, being the first and last day when API V3 usage data will be retrieved, respectively. \nThe data available includes only the last 60 natural days.\n\n> \U0001F6A7 Time range restrictions\n> \n> The maximum range of time allowed by this endpoint is 30 days. If a greater range of time is specified, this endpoint will return an error message as response.\n\nTo use this endpoint and get the API consumption of a certain group, you must be an administrator of that group.\n\n```json Example response\n\"daily\": {\n \"2019-10-22\": {\n \"search\": 1\n },\n \"2019-10-23\": {\n \"file_behaviours\": 1,\n \"file_comments\": 1,\n \"file_graphs\": 1,\n \"file_relationships\": 20,\n \"files\": 3,\n \"intelligence_search\": 3,\n \"item_vote\": 1\n },\n \"2019-10-24\": {\n \"intelligence_search\": 2\n },\n \"2019-10-25\": {\n \"files\": 10,\n \"intelligence_search\": 3\n },\n \"2019-10-28\": {\n \"intelligence_search\": 2\n },\n \"2019-10-29\": {\n \"url_submission\": 1\n },\n \"2019-10-30\": {\n \"url_submission\": 1\n },\n \"2019-10-31\": {\n \"domain_comments\": 9,\n \"domain_graphs\": 9,\n \"domain_relationships\": 90,\n \"file_upload_url\": 1,\n \"intelligence_search\": 30,\n \"ip_addresses\": 2,\n \"ip_addresses_comments\": 4,\n \"ip_addresses_graphs\": 4,\n \"ip_addresses_relationships\": 28,\n \"item_vote\": 13,\n \"url_submission\": 1\n },\n \"2019-11-04\": {\n \"file_behaviours\": 2,\n \"file_comments\": 2,\n \"file_graphs\": 2,\n \"file_relationships\": 40,\n \"files\": 8,\n \"intelligence_search\": 4,\n \"item_vote\": 2\n },\n \"2019-11-05\": {\n \"graphs\": 1,\n \"intelligence_search\": 1\n },\n \"2019-11-06\": {\n \"domains\": 14,\n \"file_comments\": 1,\n \"file_relationships\": 11,\n \"files\": 34,\n \"ip_addresses\": 10,\n \"urls\": 10\n },\n \"2019-11-08\": {\n \"analyses\": 1,\n \"intelligence_search\": 4,\n \"item_vote\": 3,\n \"url_comments\": 3,\n \"url_graphs\": 3,\n \"url_relationships\": 12,\n \"url_submission\": 2,\n \"urls\": 9\n },\n \"2019-11-09\": {\n \"files\": 123,\n \"intelligence_search\": 13\n },\n \"2019-11-12\": {\n \"file_behaviours\": 16,\n \"file_comments\": 15,\n \"file_graphs\": 15,\n \"file_relationships\": 314,\n \"files\": 44,\n \"intelligence_search\": 3,\n \"item_vote\": 15,\n \"retrohunt_jobs\": 1\n },\n \"2019-11-13\": {\n \"file_behaviours\": 1,\n \"file_comments\": 1,\n \"file_graphs\": 1,\n \"file_relationships\": 20,\n \"files\": 2,\n \"intelligence_search\": 1,\n \"item_vote\": 1\n },\n \"2019-11-18\": {\n \"analyses\": 12,\n \"file_behaviours\": 10,\n \"file_comments\": 10,\n \"file_graphs\": 10,\n \"file_relationships\": 215,\n \"file_upload_url\": 1,\n \"files\": 51,\n \"intelligence_search\": 7,\n \"item_vote\": 10\n },\n \"2019-11-19\": {\n \"domain_comments\": 1,\n \"domain_graphs\": 1,\n \"domain_relationships\": 10,\n \"file_behaviours\": 9,\n \"file_comments\": 9,\n \"file_graphs\": 9,\n \"file_relationships\": 180,\n \"files\": 9,\n \"intelligence_search\": 11,\n \"item_vote\": 10\n },\n \"2019-11-20\": {\n \"file_behaviours\": 5,\n \"file_comments\": 5,\n \"file_graphs\": 5,\n \"file_relationships\": 100,\n \"files\": 21,\n \"intelligence_search\": 16,\n \"item_vote\": 5\n },\n \"2019-11-21\": {\n \"intelligence_search\": 8,\n \"item_vote\": 9,\n \"url_comments\": 9,\n \"url_graphs\": 9,\n \"url_relationships\": 36,\n \"urls\": 24\n }\n },\n \"total\": {\n \"analyses\": 13,\n \"domain_comments\": 10,\n \"domain_graphs\": 10,\n \"domain_relationships\": 100,\n \"domains\": 54,\n \"file_behaviours\": 44,\n \"file_comments\": 44,\n \"file_download\": 309,\n \"file_graphs\": 43,\n \"file_relationships\": 900,\n \"file_upload_url\": 2,\n \"files\": 551,\n \"graphs\": 1,\n \"intelligence_search\": 189,\n \"ip_addresses\": 14,\n \"ip_addresses_comments\": 6,\n \"ip_addresses_graphs\": 4,\n \"ip_addresses_relationships\": 39,\n \"item_vote\": 69,\n \"retrohunt_jobs\": 1,\n \"search\": 3,\n \"url_comments\": 12,\n \"url_graphs\": 12,\n \"url_relationships\": 48,\n \"url_submission\": 5,\n \"urls\": 53\n }\n }\n```\n"
operationId: groupApiUsage
parameters:
- description: Group ID
in: path
name: id
required: true
schema:
type: string
- description: A string in format YYYYMMDD
in: query
name: start_date
schema:
type: string
- description: A string in format YYYYMMDD
in: query
name: end_date
schema:
type: string
responses:
'200':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '200'
'400':
content:
application/json:
examples:
Result:
value: '{}'
schema:
properties: {}
type: object
description: '400'
security:
- VTApiKey: []
summary: VirusTotal Get a Group’s API Usage
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
securitySchemes:
VTApiKey:
type: apiKey
in: header
name: x-apikey
description: Personal VirusTotal / GTI API key. Found in the user menu of your VirusTotal account.