VirusTotal URL Analysis Report API

Question

Using the sample JavaScript code from https://developers.virustotal.com/reference/url-info, I tried to retrieve information for URL scanning:

1st API run to get the URL analysis id:

const apiKey = {api-key};

console.log("testing in progress");

const data = 'url={urlToScan}';
var response;

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener('readystatechange', function () {
    if (this.readyState === this.DONE) {
        console.log(this.responseText);
        response = JSON.parse(this.responseText);
        var id =response.data.id;
        console.log(id);
        getReport(id.trim());
    }
});

xhr.open('POST', 'https://www.virustotal.com/api/v3/urls');
xhr.setRequestHeader('accept', 'application/json');
xhr.setRequestHeader('x-apikey', apiKey);
xhr.setRequestHeader('content-type', 'application/x-www-form-urlencoded');

xhr.send(data);

2nd API run to get the URL report, using the ID obtained from the 1st API:

const data = null;
const apiKey = {api-key};

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener('readystatechange', function () {
    if (this.readyState === this.DONE) {
        console.log(this.responseText);
    }
});

xhr.open('GET', "https://www.virustotal.com/api/v3/urls/"+id);
xhr.setRequestHeader('accept', 'application/json');
xhr.setRequestHeader('x-apikey', apiKey);

xhr.send(data);

However, the second API returns a 404 error:

I'm not sure where does the additional '===' comes from as I've already used trim() on the id.

Any help is much appreciated!, thanks!

score 0 · Answer 1 · answered Jun 27 '23 at 10:53

As you mentioned in 1st step and also mentioned in https://developers.virustotal.com/reference/scan-url, what you receive when scanning the URL is an analysis ID, not a URL ID.

Then you'll have to use /api/v3/analyses/{id} (https://developers.virustotal.com/reference/analysis) instead of /api/v3/urls/{id} to retrieve the analysis.

If you want to retrieve the URL report directly from the analysis ID instead of the state of the analysis you can use the item relationship of the analysis (https://developers.virustotal.com/reference/item) by doing GET /api/v3/analyses/{id}/item.

VirusTotal URL Analysis Report API

1 Answers1