Go to main content

Click on your profile avatar in the top-right corner and select .

After updating, validate that your script registers the Premium tier status. You can check your remaining daily and monthly allowances by querying the /users endpoint using a curl command:

Access endpoints for malware discovery and VirusTotal Intelligence Search queries.

Review your current API key age today. If it is older than 90 days, initiate a immediately—your future self (and your SOC) will thank you.

Extract URLs and attachments from suspicious emails, submit them to VirusTotal via API, and automatically quarantine the email if malicious indicators are identified.

: Offers the full feature set with higher API quotas for large organizations.

Before deactivating your old key (if it is still active), run a series of test queries using the new key. Verify that you can:

VirusTotal is a Google-owned platform that analyzes files, URLs, and IP addresses to provide insights into potential threats. Its vast database is populated by over 350,000 users and security researchers worldwide, making it an invaluable resource for cybersecurity professionals. The VirusTotal API allows developers to programmatically access this wealth of information, enabling the automation of threat detection, analysis, and response processes.

The Premium API key removes these throttles and unlocks exclusive features:

What (e.g., Splunk, Sentinel, XSOAR) you are integrating the key into

. Organizations rely on the VirusTotal Premium API to automate malware triage, orchestrate Incident Response (IR), and enrich Security Information and Event Management (SIEM) telemetry. Unlike standard public keys, premium endpoints require proactive rotation, strict access control, and seamless deployment across enterprise tools. Public vs. Premium API Keys: Understanding the Differences

If you want, I can: