VirusTotal

The VirusTotal integration lets Elastio look up files on VirusTotal with your own VirusTotal API key. Once the key is stored, you can fetch the VirusTotal report for any file hash, for example the sha256 of a file with a finding.

The integration belongs to you, not the whole tenant: there is at most one per user in each tenant, and lookups use the key of the user who calls them. Elastio stores the key encrypted and never returns it.

1. Store your API key

POST

/gateway/integration/v1/virustotalCreate VirusTotal integration

Try it

Send your VirusTotal API key as api_key. If you already have an integration, this returns 409; use PUT instead.

curl -X POST "https://acme.app.elastio.com/gateway/integration/v1/virustotal" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$VT_API_KEY\"}"

import os, requests

BASE = "https://acme.app.elastio.com"
HEADERS = {"Authorization": f"Bearer {os.environ['ELASTIO_TOKEN']}"}

resp = requests.post(
    f"{BASE}/gateway/integration/v1/virustotal",
    headers=HEADERS,
    json={"api_key": os.environ["VT_API_KEY"]},
    timeout=30,
)
resp.raise_for_status()
print(resp.json()["id"])

$Base = "https://acme.app.elastio.com"
$Headers = @{ Authorization = "Bearer $env:ELASTIO_TOKEN" }
$body = @{ api_key = $env:VT_API_KEY } | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "$Base/gateway/integration/v1/virustotal" `
    -Headers $Headers -ContentType "application/json" -Body $body

{
  "id": "5d2c8b1a-3e4f-4a6b-9c7d-8e0f1a2b3c4d",
  "tenant_name": "acme",
  "user_id": "a1b2c3d4-e5f6-4789-a0b1-c2d3e4f5a6b7",
  "created_at": "2026-10-12T08:30:00Z",
  "updated_at": "2026-10-12T08:30:00Z"
}

To check whether you already have one, call GET /gateway/integration/v1/virustotal; it returns 404 when you don’t. To rotate the key, send a new api_key with PUT /gateway/integration/v1/virustotal (it answers 204).

2. Look up a file report

GET

/gateway/integration/v1/virustotal/files/{fileHash}Get VirusTotal file report by hash

Try it

Pass a lowercase MD5 (32 hex characters), SHA-1 (40) or SHA-256 (64) hash. The response is the raw JSON report from the VirusTotal API, so its fields are defined by VirusTotal, not by Elastio.

SHA256="275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
curl "https://acme.app.elastio.com/gateway/integration/v1/virustotal/files/$SHA256" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" | jq .

sha256 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
resp = requests.get(f"{BASE}/gateway/integration/v1/virustotal/files/{sha256.lower()}", headers=HEADERS, timeout=60)
if resp.status_code == 404:
    print("No integration, or VirusTotal has no report for this file")
else:
    resp.raise_for_status()
    report = resp.json()   # raw VirusTotal file report

$sha256 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
$report = Invoke-RestMethod -Uri "$Base/gateway/integration/v1/virustotal/files/$($sha256.ToLower())" -Headers $Headers
$report | ConvertTo-Json -Depth 10

What the errors mean:

Status	Meaning
`400`	The hash isn’t a valid MD5, SHA-1 or SHA-256.
`404`	You have no VirusTotal integration, or VirusTotal has no report for this file.
`429`	Your VirusTotal key hit VirusTotal’s rate limit. Back off and retry.
`503`	The client isn’t configured or VirusTotal returned an error.
`504`	The request to VirusTotal timed out.

Remove the integration

DELETE

/gateway/integration/v1/virustotalDelete VirusTotal integration

Try it

curl -X DELETE "https://acme.app.elastio.com/gateway/integration/v1/virustotal" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.delete(f"{BASE}/gateway/integration/v1/virustotal", headers=HEADERS, timeout=30)
resp.raise_for_status()

Invoke-RestMethod -Method Delete -Uri "$Base/gateway/integration/v1/virustotal" -Headers $Headers

All endpoints

VirusTotal

5 operations in the reference →