VirusTotal IoC Feeds - Sandbox analyses feed API

openapi: 3.0.3
info:
  title: VirusTotal API v3 - Access Control Access Control - Group Management IoC Feeds - Sandbox analyses feed API
  version: '3.0'
  description: Manage users, groups, service accounts, API quotas, and overall account usage in VirusTotal / Google Threat Intelligence.
  contact:
    name: VirusTotal / Google Threat Intelligence
    url: https://docs.virustotal.com/reference/overview
  license:
    name: VirusTotal Terms of Service
    url: https://www.virustotal.com/gui/terms-of-service
  x-generated-from: https://storage.googleapis.com/gtidocresources/guides/GTI_API_v3_openapi_spec_10022025.json
  x-last-validated: '2026-05-29'
servers:
- url: https://www.virustotal.com/api/v3
  description: VirusTotal / GTI API v3 production.
security:
- VTApiKey: []
tags:
- name: IoC Feeds - Sandbox analyses feed
  description: IoC Feeds - Sandbox analyses feed
paths:
  /feeds/file_behaviours/hourly/{time}:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nThis endpoint returns a single package containing all minutely packages returned in [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) endpoint for a given hour. The returned file is a `.tar.bz2` file which contains the 60 minutely feeds for that hour.\n\nThe provided `time` argument must be in `YYYYMMDDhh` format. For example, time `2021012211` returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. You can download batches up to 7 days old, and the most recent batch has always a 2 hours lag with respect with to the current time. This means that if the current time in UTC is T you can download batch T-2h but any more recent.\n\nSuccessful calls to this endpoint will return a `302` redirect response to a URL from which the final batch file will be downloaded.\n"
      operationId: feedsFileBehaviourHourly
      parameters:
      - description: A string in format YYYYMMDDhh
        in: path
        name: time
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get an Hourly File Behaviour Feed Batch
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /feeds/file_behaviours/{time}:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nWith this endpoint you can download an individual one-minute batches by providing a `time` consisting of a string with format `YYYYMMDDhhmm`. Time `201912010802` will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect to the current time. This means that if the current time in UTC is `T` you can download batch `T-60m` but not `T-59m` or any more recent.\n\nSuccessful calls to this endpoint will return a `302` redirect response to a URL from which the final batch file will be downloaded.\n\n> \U0001F6A7 Missing batches\n> \n> Missing batches are rare, but still can happen occasionally. This doesn't mean that you are losing any files in the feed, it just means that no batches were generated on a specific minute. The client code should be ready to accept a `404` error while retrieving a batch and proceed with the following one. However, receiving multiple `404` errors in a row for consecutive batches shouldn't happen and should be treated as an error condition.\n\nThe downloaded file is a bzip2 compressed UTF-8 text file containing one JSON structure per line, where the structure represents a FileBehaviour object as returned by the [GET /files/{id}/behaviour](https://gtidocs.virustotal.com/reference/files-relationships) endpoint and is defined by [FileBehaviourSummary Object](https://gtidocs.virustotal.com/reference/file-behaviour-summary-object).\n\nThe FileBehaviour object will contain an extra attribute (`context_attributes`), which is a JSON structure that contains links for downloading the PCAP, HTML, EVTX and memdump files generated in the analysis through our API without consuming your quota (bear in mind that you will have to use your API Key and add it to the request headers in order to get access to the behaviour reports pointed by those two links).\n\n```json Entry line structure\n{\n  \"attributes\": <FileBehaviour object attributes>,\n  \"context_attributes\": {\n    \"file_md5\": \"<string>\",\n    \"file_sha1\": \"<string>\",\n    \"file_type_tag\": \"<string>\",\n    \"html_report\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours/<TOKEN>/html\",\n    \"pcap\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours/<TOKEN>/pcap\",\n    \"evtx\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours/<TOKEN>/evtx\",\n    \"memdump\": \"https://www.virustotal.com/api/v3/feeds/file-behaviours/<TOKEN>/memdump\"\n  },\n  \"id\": \"<SHA256_Sandbox name>\",\n  \"type\": \"file_behaviour\",\n  \"relationshiops\": {...},\n  \"links\": {...} \n}\n```\n"
      operationId: feedsFileBehaviour
      parameters:
      - description: A string in format YYYYMMDDhhmm
        in: path
        name: time
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: ''
          description: '200'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Object not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit or quota exceeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - VTApiKey: []
      summary: VirusTotal Get a Per-minute File Behaviour Feed Batch
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /feeds/file_behaviours/{token}/evtx:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a link to this API endpoint to download the extracted EVTX from the file's Windows sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n  \"context_attributes\": {\n    \"evtx\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours/<TOKEN>/evtx\"\n  }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n"
      operationId: fileBehaviourFeedEvtx
      parameters:
      - description: Download token. It is included the "evtx" context attribute at the file behaviour feed.
        in: path
        name: token
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get the EVTX File Generated During a File’s Behavior Analysis
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /feeds/file_behaviours/{token}/html:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the the file's sandbox execution HTML report. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json\n{\n  \"context_attributes\": {\n    \"html_report\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours/<TOKEN>/evtx\"\n  }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n"
      operationId: fileBehaviourFeedHtml
      parameters:
      - description: Download token. It can be found inside the behaviour object's properties in the file behaviour feed.
        in: path
        name: token
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get a File Behaviour's Detailed HTML Report
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /feeds/file_behaviours/{token}/memdump:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted memdump from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n  \"context_attributes\": {\n    \"memdump\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours/<TOKEN>/memdump\"\n  }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n"
      operationId: fileBehaviourFeedMemdump
      parameters:
      - description: Download token. It can be found inside the behaviour object's properties in the behaviour feed.
        in: path
        name: token
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get the Memdump File Generated During a File’s Behavior Analysis
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /feeds/file_behaviours/{token}/pcap:
    get:
      tags:
      - IoC Feeds - Sandbox analyses feed
      deprecated: false
      description: "> \U0001F6A7 Special privileges required\n> \n> Sandbox analyses feeds endpoints are only available to users with a Sandbox feeds license. [Contact us](https://www.virustotal.com/gui/contact-us/) for more information.\n\nEach JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted PCAP from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link:\n\n```json JSON structure\n{\n  \"context_attributes\": {\n    \"pcap\": \"https://www.virustotal.com/api/v3/feeds/file_behaviours/<TOKEN>/pcap\"\n  }\n}\n```\n\nThe link only works during the feed's lifetime. Check [/feeds/file_behaviours/{time}](https://gtidocs.virustotal.com/reference/feeds-file-behaviour) for more information.\n"
      operationId: fileBehaviourFeedPcap
      parameters:
      - description: Download token. It can be found inside the behaviour object's properties in the behaviour feed.
        in: path
        name: token
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get the PCAP File Generated During a File’s Behavior Analysis
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Error:
      type: object
      description: Standard VirusTotal API error envelope.
      properties:
        code:
          type: string
          description: Machine-readable error code.
          example: NotFoundError
        message:
          type: string
          description: Human-readable error message.
          example: Resource not found
      required:
      - code
      - message
    ErrorResponse:
      type: object
      description: Error response envelope returned by the VirusTotal API.
      properties:
        error:
          $ref: '#/components/schemas/Error'
      required:
      - error
  securitySchemes:
    VTApiKey:
      type: apiKey
      in: header
      name: x-apikey
      description: Personal VirusTotal / GTI API key. Found in the user menu of your VirusTotal account.