find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/virustotal-ioc-investigation-domains-resolutions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: VirusTotal API v3 - IoC Investigation IoC Investigation…
  version: '3.0'
  description: Investigate files, URLs, IP addresses, and domains. Submit and analyse samples, retrieve reports, get comments and votes, view sandbox behaviour, traverse the relationships graph.
  contact:
    name: VirusTotal / Google Threat Intelligence
    url: https://docs.virustotal.com/reference/overview
  license:
    name: VirusTotal Terms of Service
    url: https://www.virustotal.com/gui/terms-of-service
  x-generated-from: https://storage.googleapis.com/gtidocresources/guides/GTI_API_v3_openapi_spec_10022025.json
  x-last-validated: '2026-05-29'
servers:
- url: https://www.virustotal.com/api/v3
  description: VirusTotal / GTI API v3 production.
security:
- VTApiKey: []
tags:
- name: IoC Investigation - Domains & Resolutions
  description: IoC Investigation - Domains & Resolutions
paths:
  /domains/{domain}:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: Returns a Domain object.
      operationId: domainInfo
      parameters:
      - description: Domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      - description: The name of your tool or service. This is required to obtain the gti_assesment data
        in: header
        name: x-tool
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: ''
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get a Domain Report
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /domains/{domain}/comments:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: Returns a list of Comment objects.
      operationId: domainsCommentsGet
      parameters:
      - description: Domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      - description: Maximum number of comments to retrieve
        in: query
        name: limit
        schema:
          default: 10
          format: int32
          type: integer
      - description: Continuation cursor
        in: query
        name: cursor
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get Comments on a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: 'With this endpoint you can post a comment for a given domain. The body for the POST request must be the JSON representation of a comment object. Notice however that you don''t need to provide an ID for the object, as they are automatically generated for new comments.


        Any word starting with # in your comment''s text will be considered a tag, and added to the comment''s tag attribute.


        ```json Example request

        {

        "data": {

        "type": "comment",

        "attributes": {

        "text": "Lorem #ipsum dolor sit ..."

        }

        }

        }

        ```


        Returns a Comment object.'
      operationId: domainsCommentsPost
      parameters:
      - description: Domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              properties:
                data:
                  default: '{"type": "comment", "attributes": {"text": "Lorem ipsum dolor sit ..."}}'
                  description: A comment object
                  format: json
                  type: string
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Add a Comment to a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /domains/{domain}/relationships/{relationship}:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: This endpoint is the same as /domains/{domain}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.
      operationId: domainsRelationshipsIds
      parameters:
      - description: Domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      - description: Relationship name (see [table](ref:domains-object#relationships))
        in: path
        name: relationship
        required: true
        schema:
          type: string
      - description: Maximum number of related objects to retrieve
        in: query
        name: limit
        schema:
          default: '10'
          type: string
      - description: Continuation cursor
        in: query
        name: cursor
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get Object Descriptors Related to a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /domains/{domain}/votes:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: Returns a list of Vote objects.
      operationId: domainsVotesGet
      parameters:
      - in: path
        name: domain
        required: true
        schema:
          type: string
        description: domain parameter
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get Votes on a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: 'With this endpoint you can post a vote for a given domain. The body for the POST request must be the JSON representation of a vote object. Note however that you don''t need to provide an ID for the object, as they are automatically generated for new votes.


        The verdict attribute must have be either harmless or malicious.


        ```json Example request

        {

        "data": {

        "type": "vote",

        "attributes": {

        "verdict": "harmless"

        }

        }

        }

        ```


        Returns a votes object.'
      operationId: domainVotesPost
      parameters:
      - description: hostname or domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              properties:
                data:
                  default: '{"type": "vote", "attributes": {"verdict": "harmless"}}'
                  description: Vote object
                  format: json
                  type: string
              required:
              - data
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
        '409':
          content:
            application/json:
              examples:
                Result:
                  value: "{\n  \"error\": {\n    \"code\": \"AlreadyExistsError\",\n    \"message\": \"User \\\"username\\\" already voted \\\"harmless\\\" for this domain\"\n  }\n}"
              schema:
                properties:
                  error:
                    properties:
                      code:
                        type: string
                      message:
                        type: string
                    type: object
                type: object
          description: '409'
      security:
      - VTApiKey: []
      summary: VirusTotal Add a Vote to a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /domains/{domain}/{relationship}:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: 'Domain objects have number of relationships to other Domains and objects. As mentioned in the Relationships section, those related objects can be retrieved by sending `GET` requests to the relationship URL.


        All available relationships are documented in the domain API object page.'
      operationId: domainsRelationships
      parameters:
      - description: Domain name
        in: path
        name: domain
        required: true
        schema:
          type: string
      - description: Relationship name (see [table](ref:domains-object#relationships))
        in: path
        name: relationship
        required: true
        schema:
          type: string
      - description: Maximum number of related objects to retrieve
        in: query
        name: limit
        schema:
          default: 10
          format: int32
          type: integer
      - description: Continuation cursor
        in: query
        name: cursor
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get Objects Related to a Domain
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /resolutions/{id}:
    get:
      tags:
      - IoC Investigation - Domains & Resolutions
      deprecated: false
      description: This endpoint retrieves a Resolution object by its ID. A resolution object ID is made by appending the IP and the domain it resolves to together.
      operationId: getResolutionById
      parameters:
      - description: Resolution object ID.
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '200'
        '400':
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                properties: {}
                type: object
          description: '400'
      security:
      - VTApiKey: []
      summary: VirusTotal Get a DNS Resolution Object
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  securitySchemes:
    VTApiKey:
      type: apiKey
      in: header
      name: x-apikey
      description: Personal VirusTotal / GTI API key. Found in the user menu of your VirusTotal account.