VirusTotal Compatible API Suite
ReversingLabs Spectra Intelligence provides comprehensive threat intelligence through file analysis, URL reputation, and threat classification services. Migrating away from an incumbent vendor can be complex and costly, especially when your security stack has been built around specific API integrations over years of development.
To simplify this process, we've built the VirusTotal Compatible API Suite - APIs powered by ReversingLabs Spectra Intelligence but delivered in VT-compatible format.
Migration challenges
Organizations that have built security automation around VirusTotal's APIs face significant barriers to migration:
- Custom API code - Years of integration work tied to VT's specific endpoints, request formats, and response schemas.
- Parsing logic dependencies - Downstream systems that depend on VT's JSON key/value pairs, field names, and data structures.
- Operational risk - Any migration introduces the possibility of broken workflows, missed detections, or gaps in coverage during the transition.
The VT Compatible API Suite addresses these concerns by letting you redirect your existing API calls to ReversingLabs without rewriting any integration code.
Why ReversingLabs Spectra Intelligence
While the API format stays familiar, the intelligence behind it offers several advantages:
- Deeper file analysis - Spectra Intelligence performs static and dynamic analysis at scale, providing richer context for every sample, including file metadata, threat classification, and behavioral indicators.
- Broader coverage - Spectra Intelligence combines intelligence from 40+ anti-malware engines with proprietary ReversingLabs analysis, delivering broader detection coverage than any single vendor.
- Enterprise-grade reliability - Spectra Intelligence is purpose-built for high-volume enterprise environments with predictable performance and dedicated support.
API suite overview
The VT Compatible API Suite includes the following core APIs that cover the vast majority of VirusTotal integration use cases.
File Report API
Endpoint: GET /api/v3/files/{hash}
Retrieve comprehensive file analysis reports using any supported hash identifier. The response format mirrors the VirusTotal v3 file report schema, so your existing parsing logic works without modification.
| Feature | Details |
|---|---|
| Hash input | Query by MD5, SHA-1, or SHA-256 passed as a path parameter, just like VT v3. |
| Authentication | API key via x-apikey header, using ReversingLabs-supplied credentials. |
| Analysis statistics | Aggregated malicious/undetected counts in last_analysis_stats. |
| Per-engine results | Individual scanner verdicts with engine name, category, and threat name in last_analysis_results. |
| File hashes | SHA-256, SHA-1, and MD5 returned for every queried sample. |
| Timestamps | first_submission_date and last_analysis_date in epoch-seconds format. |
URL Report API
Endpoint: GET /api/v3/urls/{urlid}
Retrieve URL threat analysis reports using a SHA-1 URL identifier or base64-encoded URL. Responses follow the VirusTotal v3 URL report structure, delivering per-engine analysis results and aggregate statistics.
| Feature | Details |
|---|---|
| URL input | Query by SHA-1 URL identifier or base64-encoded URL (without padding). |
| Authentication | API key via x-apikey header, using ReversingLabs-supplied credentials. |
| Analysis statistics | Malicious, suspicious, harmless, and undetected counts in last_analysis_stats. |
| Per-engine results | Individual engine verdicts with category and threat names in last_analysis_results. |
| URL metadata | Human-readable URL, unique identifier, and threat name information. |
| Timestamps | first_submission_date and last_analysis_date in epoch-seconds format. |
Migration process
The VT Compatible API Suite acts as a transparent proxy layer, accepting requests in the VirusTotal v3 format and returning responses in the same schema, powered by Spectra Intelligence on the backend.
To migrate, do the following:
- Redirect your endpoint - Point your existing API calls from the VirusTotal v3 base URL to the ReversingLabs VT-compatible endpoint.
- Authenticate with your RL credentials - Use the ReversingLabs-supplied API key in the
x-apikeyheader. - Receive VT-formatted responses - Responses arrive in the same JSON structure your code already parses, with the same field names, data types, and nesting. Your downstream logic works without changes.
Migration at a glance
| Traditional migration | VT Compatible API Suite | |
|---|---|---|
| Code changes | Extensive rewrites | Base URL swap only |
| Migration timeline | Weeks to months | Minutes to hours |
| Testing effort | Full regression testing | Minimal validation |
| Intelligence quality | Varies | Enterprise-grade from day one |
Get started
Your ReversingLabs account team can help at every step:
- Schedule a technical walkthrough with your ReversingLabs solutions engineer.
- Receive your VT-compatible API credentials and endpoint configuration.
- Update your base URL and begin routing requests through the compatibility layer.
- Validate responses against your existing parsing logic.
- Go live with no operational disruption.
To schedule a demo or request access to the VT Compatible API Suite, contact your ReversingLabs account representative or visit reversinglabs.com.
For general information about Spectra Intelligence APIs, including authentication, rate limits, and response codes, see the General information page.