VirusTotal API v3 - Threat Graphs
Create, share, edit, and search Threat Graphs — visualisations of how IoCs and threats relate. Includes the editor / viewer ACL surface for collaboration.
OpenAPI Specification
openapi: 3.0.3
info:
title: VirusTotal API v3 - Threat Graphs
version: '3.0'
description: Create, share, edit, and search Threat Graphs — visualisations of how IoCs and threats relate. Includes the editor/viewer ACL surface.
contact:
name: VirusTotal / Google Threat Intelligence
url: https://docs.virustotal.com/reference/overview
license:
name: VirusTotal Terms of Service
url: https://www.virustotal.com/gui/terms-of-service
x-generated-from: https://storage.googleapis.com/gtidocresources/guides/GTI_API_v3_openapi_spec_10022025.json
x-last-validated: '2026-05-29'
servers:
- url: https://www.virustotal.com/api/v3
description: VirusTotal / GTI API v3 production.
security:
- VTApiKey: []
tags:
- name: Threat Graphs
description: Threat Graphs
- name: Threat Graphs Permissions & ACL
description: Threat Graphs Permissions & ACL
paths:
/graphs:
get:
tags:
- Threat Graphs
deprecated: false
description: "Endpoint used to search graphs.\n\nThere are a set of multiple modifiers that you can use to refine your search results. You can combine all of them together and use them in conjunction\
\ with AND, OR and NOT operators.\n\nDate and numeric fields support the suffix plus or minus to match values greater or less than the passed value. If not sign has been added to the modifier, you\
\ will get exact matches. You can use more than once the same modifier in the same query to define ranges: `creation_date:2018-11-1+` `creation_date:2018-11-12-` will match graphs created between\
\ 2018-11-1 and 2018-11-22.\n\n**Graph-related modifiers**\n\n| Modifier | Description | Example \
\ |\n| :------------------ | :------------------------------------------------- | :------------------------------------------------------------------- |\n| id: | Filters\
\ by graph identifier. | id:g675a2fd4c8834e288afd71bbbe88f78884e7d21a8c9348b5ab45cc9281cffc3c |\n| name: | Filters by graph name. \
\ | name:Wannacry |\n| owner: | Filters by graphs owned by user. | owner:richard_hendricks \
\ |\n| group: | Filters by graphs owned by group. | group:piedpiper |\n| visible_to_user:\
\ | Filters by graphs visible to user. | visible_to_user:richard_hendricks |\n| visible_to_group: | Filters by graphs visible to group. \
\ | visible_to_group:piedpiper |\n| private: | Filters by private graphs. | private:true, private:false\
\ |\n| creation_date: | Filters by the graph creation date. | creation_date:2018-11-1 |\n\
| last_modified_date: | Filters by the last date the graph was modified. | last_modified_date:2018-11-12 |\n| total_nodes: | Filters by graphs containing\
\ some amount of nodes. | total_nodes:100 |\n| comments_count: | Filter by the number of comments of the graph. | comments_count:10+\
\ |\n| views_count: | Filter by the number of graph views. | views_count:1000+ \
\ |\n\n**Node-related modifiers**\n\n| Modifier | Description | Example |\n|\
\ :---------- | :------------------------------------------------------- | :-------------------------------------------------------------------- |\n| label: | Filters by graphs containing nodes\
\ with a specific label | label:Kill switch |\n| file: | Filters by graphs containing the file. | file:131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267\
\ |\n| domain: | Filters by graphs containing the domain. | domain:piedpiper.com |\n| ip_address: | Filters by graphs containing\
\ the ip address. | ip_address:1.1.1.1 |\n| url: | Filters by graphs containing the url. | url:<https://piedpiper.com/the-box/>\
\ |\n| actor: | Filters by graphs containing the actor. | actor:funny bear |\n| victim:\
\ | Filters by graphs containing the victim. | victim:richard_hendricks |\n| email: | Filters by graphs containing the email.\
\ | email:[[email protected]](mailto:[email protected]) |\n| department: | Filters by graphs containing the department. | department:engineers \
\ |\n\nIn addition to these modifiers, you can do a free search query. The search engine will return graphs that match the query with the content of\
\ any field in the graph.\n\n```curl All graphs\ncurl --request POST \\\n --url https://www.virustotal.com/api/v3/graphs \\\n --header 'x-apikey: <your API key>'\n```\n```curl FIlter by user\n\
curl --request POST \\\n --url https://www.virustotal.com/api/v3/graphs?filter=owner:bbunny \\\n --header 'x-apikey: <your API key>'\n```\n```curl Attributes selection\ncurl --request POST \\\n\
\ --url https://www.virustotal.com/api/v3/graphs?filter=owner:bbunny&attributes=private,graph_data \\\n --header 'x-apikey: <your API key>'\n```\n```curl Filter by domain\ncurl --request POST\
\ \\\n --url https://www.virustotal.com/api/v3/graphs?filter=domain:hooli.com \\\n --header 'x-apikey: <your API key>'\n```\n\nSupported `order` fields are: `name`, `owner`, `creation_date`, `last_modified_date`,\
\ `views_count` and `comments_count`.\n"
operationId: graphs
parameters:
- description: Return the graphs matching the given criteria only
in: query
name: filter
schema:
type: string
- description: Maximum number graphs to retrieve
in: query
name: limit
schema:
format: int32
type: integer
- description: Continuation cursor
in: query
name: cursor
schema:
type: string
- description: Sort order
in: query
name: order
schema:
type: string
- description: Specific fields to retrieve
in: query
name: attributes
schema:
type: string
security:
- VTApiKey: []
summary: VirusTotal Search Graphs
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
tags:
- Threat Graphs
deprecated: false
description: "This endpoint can be used to create new graphs. Note that private graphs will increment the usage of the private graphs quota in your Google Threat Intelligence plan. \n\n```json Request\
\ example\n{\n \"data\": {\n \"attributes\": {\n \"comments_count\": 0,\n \"creation_date\": 1599060646,\n \"graph_data\": {\n \"description\": \"test\",\n \"version\"\
: \"5.0.0\"\n },\n \"last_modified_date\": 1599117623,\n \"links\": [\n {\n \"connection_type\": \"last_serving_ip_address\",\n \"source\": \"ecd87dff4decb36ebf35cf2d327cce62fe1e5666d694c4b0f11ff67d540ff4dc\"\
,\n \"target\": \"relationships_last_serving_ip_address_ecd87dff4decb36ebf35cf2d327cce62fe1e5666d694c4b0f11ff67d540ff4dc\"\n },\n {\n \"connection_type\": \"last_serving_ip_address\"\
,\n \"source\": \"relationships_last_serving_ip_address_e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\",\n \"target\": \"138.133.35.39\"\n },\n \
\ {\n \"connection_type\": \"contacted_ips\",\n \"source\": \"e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\",\n \"target\": \"relationships_contacted_ips_e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\"\
\n },\n {\n \"connection_type\": \"contacted_ips\",\n \"source\": \"relationships_contacted_ips_e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\"\
,\n \"target\": \"138.133.35.39\"\n },\n {\n \"connection_type\": \"commonality\",\n \"source\": \"relationships_commonality_106438826\",\n \"target\"\
: \"f053cb783411211b54e2837ec01e0998e3d9bc042f599d95f7f2cb4ba348305d\"\n },\n {\n \"connection_type\": \"hunting\",\n \"source\": \"relationships_hunting_6534979578789888\"\
,\n \"target\": \"5a041d8d72fc12d21e09fd781831ff8279199025c3b3da4b13ec24d20200340f\"\n }\n ],\n \"nodes\": [\n {\n \"entity_attributes\": {\n \
\ \"has_detections\": true\n },\n \"entity_id\": \"e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\",\n \"index\": 0,\n \"text\": \"\",\n \
\ \"type\": \"url\",\n \"x\": 0,\n \"y\": 0\n },\n {\n \"entity_attributes\": {},\n \"entity_id\": \"relationships_last_serving_ip_address_e743cffce9efddfb4f1d7e7dc3c10c6d562e61b5f65e6dd3fd4f28b604fcc2f6\"\
,\n \"index\": 1,\n \"text\": \"\",\n \"type\": \"relationship\",\n \"x\": -27.425258029385414,\n \"y\": -19.198748008541706\n },\n {\n\
\ \"entity_attributes\": {\n \"country\": \"OM\",\n \"has_detections\": true\n },\n \"entity_id\": \"138.133.35.39\",\n \"fx\": -60.42155469411466,\n\
\ \"fy\": -1.7339803589372877,\n \"index\": 2,\n \"text\": \"\",\n \"type\": \"ip_address\",\n \"x\": -60.42155469411466,\n \"y\": -1.7339803589372877\n\
\ },\n {\n \"entity_attributes\": {\n \"has_detections\": false,\n \"type_tag\": \"text\"\n },\n \"entity_id\": \"733314c4b079b42174c6b55fb89755faca798378ab999ea240b3f14b0d24a90f\"\
,\n \"index\": 6,\n \"text\": \"\",\n \"type\": \"file\",\n \"x\": 27.265746471390678,\n \"y\": -9.726931961146573\n },\n {\n \
\ \"entity_attributes\": {\n \"has_detections\": false\n },\n \"entity_id\": \"www.blablabla.com\",\n \"index\": 88,\n \"text\": \"\",\n \"\
type\": \"domain\",\n \"x\": -234.75082645175817,\n \"y\": 8.15972244734705\n },\n {\n \"entity_attributes\": {\n \"intelligence_query\": \"entity:\
\ url path: blablabla\",\n \"relationship_type\": \"intelligence\"\n },\n \"entity_id\": \"intelligence_-1173580683\",\n \"index\": 154,\n \"text\"\
: \"VTI: entity: url path: blablabla\",\n \"type\": \"relationship\",\n \"x\": -27.95565446983731,\n \"y\": -64.23455937679253\n },,\n {\n \"entity_attributes\"\
: {\n \"commonalities\": [\n {\n \"commonality\": \"path\",\n \"value\": \"/\"\n }\n ],\n \"relationship_type\"\
: \"commonality\"\n },\n \"entity_id\": \"relationships_commonality_106438826\",\n \"fx\": -107.49097518267031,\n \"fy\": 198.2339878510857,\n \"index\"\
: 160,\n \"text\": \"path: /\",\n \"type\": \"relationship\",\n \"x\": -107.49097518267031,\n \"y\": 198.2339878510857\n },\n {\n \"entity_attributes\"\
: {\n \"relationship_type\": \"hunting\",\n \"ruleset_id\": \"6533973538739388\"\n },\n \"entity_id\": \"relationships_hunting_6533973538739388\",\n \
\ \"index\": 161,\n \"text\": \"\",\n \"type\": \"relationship\",\n \"x\": -130.72553403592232,\n \"y\": 346.7297024640031\n }\n ],\n \"\
private\": true\n },\n \"type\": \"graph\"\n }\n}\n```\n\n```json Response example\n{\n \"data\": {\n \"id\": \"g0538d03053194c338643183e315b134ec3463a392330430938033934f3be3f37\"\
,\n \"type\": \"graph\"\n }\n}\n```\n"
operationId: createGraphs
parameters: []
requestBody:
content:
application/json:
schema:
properties:
RAW_BODY:
format: json
type: string
type: object
security:
- VTApiKey: []
summary: VirusTotal Create a Graph
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/graphs/{id}:
delete:
tags:
- Threat Graphs
deprecated: false
description: VirusTotal Delete a Graph
operationId: graphsDelete
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
text/plain:
examples:
Result:
value: ''
description: '200'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- VTApiKey: []
summary: VirusTotal Delete a Graph
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
get:
tags:
- Threat Graphs
deprecated: false
description: "Returns a [Graph](https://gtidocs.virustotal.com/reference/graph-object) object.\n\n```json Response example\n{\n \"data\": {\n \"attributes\": {\n \"graph_data\": {\n \
\ \"description\": \"Hooli.com investigation\"\n },\n \"links\": [\n {\n \"connection_type\": \"resolutions\",\n \"source\": \"www.hooli.com\",\n \"\
target\": \"relationships_resolutions_wwwhoolicom\"\n },\n {\n \"connection_type\": \"resolutions\",\n \"source\": \"relationships_resolutions_wwwhoolicom\",\n \
\ \"target\": \"8.8.8.8\"\n }\n ],\n \"private\": false,\n \"creation_date\": 1530006951,\n \"position\": {\n \"y\": 388,\n \"x\": 897,\n \"\
scale\": \"1\"\n },\n \"nodes\": [\n {\n \"index\": 0,\n \"entity_id\": \"www.hooli.com\",\n \"text\": \"Root Node\",\n \"y\": 65,\n \
\ \"x\": -18,\n \"type\": \"domain\"\n },\n {\n \"y\": 42,\n \"index\": 1,\n \"entity_id\": \"relationships_resolutions_wwwhoolicom\",\n \
\ \"type\": \"relationship\",\n \"x\": -56\n },\n {\n \"index\": 2,\n \"entity_id\": \"8.8.8.8\",\n \"fx\": 3.3,\n \"fy\": 4.4,\n \
\ \"y\": 0,\n \"x\": -64,\n \"type\": \"ip_address\"\n },\n {\n \"index\": 2,\n \"entity_id\": \"131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267\"\
,\n \"fx\": 3.3,\n \"fy\": 4.4,\n \"y\": 0,\n \"x\": -64,\n \"type\": \"file\"\n },\n {\n \"index\": 2,\n \"entity_id\"\
: \"1a0556926f7e76419d12e4c6ad52f10388af11f2689f6c0fb6111a2b85f131de\",\n \"fx\": 3.3,\n \"fy\": 4.4,\n \"y\": 0,\n \"x\": -64,\n \"type\": \"url\"\n\
\ }\n ]\n },\n \"type\": \"graph\",\n \"id\": \"g3ad78ce6c21ae675e81ac376a6fc016c37befa6dc87484b95a2b069f8d04ef44\",\n \"links\": {\n \"self\": \"https://www.virustotal.com/api/v3/graphs/g3ad78ce6c21ae675e81ac376a6fc016c37befa6dc87484b95a2b069f8d04ef44\"\
\n }\n }\n}\n```\n"
operationId: graphsInfo
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
security:
- VTApiKey: []
summary: VirusTotal Get a Graph Object
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
patch:
tags:
- Threat Graphs
deprecated: false
description: "```json Update request example\n{\n \"data\":{\n \"attributes\": {\n \"private\": true\n },\n \"type\":\"graph\"\n }\n}\n```\n\n```json Response example\n{\n \"data\"\
: {\n \"attributes\": {\n \"private\": false,\n \"nodes\": [\n {\n \"type\":\"domain\",\n \"entity_id\":\"www.hooli.com\",\n \"x\":-18,\n \
\ \"y\":65,\n \"text\":\"Root Node\",\n \"index\":0\n },\n {\n \"type\":\"relationship\",\n \"entity_id\":\"relationships_resolutions_wwwhoolicom\"\
,\n \"x\":-56,\n \"y\":42,\n \"index\":1\n },\n {\n \"type\":\"ip_address\",\n \"entity_id\":\"8.8.8.8\",\n \"x\":-64,\n \
\ \"y\":0,\n \"index\":2,\n \"fx\":3.3,\n \"fy\":4.4\n },\n {\n \"type\":\"file\",\n \"entity_id\":\"131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267\"\
,\n \"x\":-64,\n \"y\":0,\n \"index\":2,\n \"fx\":3.3,\n \"fy\":4.4\n },\n {\n \"type\":\"url\",\n \"entity_id\":\"1a0556926f7e76419d12e4c6ad52f10388af11f2689f6c0fb6111a2b85f131de\"\
,\n \"x\":-64,\n \"y\":0,\n \"index\":2,\n \"fx\":3.3,\n \"fy\":4.4\n }\n ],\n \"links\":[\n {\n \"source\":\"\
www.hooli.com\",\n \"target\":\"relationships_resolutions_wwwhoolicom\",\n \"connection_type\":\"resolutions\"\n },\n {\n \"source\":\"relationships_resolutions_wwwhoolicom\"\
,\n \"target\":\"8.8.8.8\",\n \"connection_type\":\"resolutions\"\n }\n ],\n \"position\": {\n \"x\":897,\n \"y\":388,\n \
\ \"scale\":\"1\"\n },\n \"graph_data\": {\n \"description\": \"Hooli.com graph\"\n }\n },\n \"type\": \"graph\"\n }\n}\n```\n"
operationId: graphsUpdate
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
properties:
graph_data:
description: Highlevel graph data.
properties:
version:
description: Current version of the graph.
type: string
type: object
links:
description: Array of links.
items:
properties:
connection_type:
description: Type of the connection between the source and the target.
type: string
source:
description: Entity id of the link source.
type: string
target:
description: Entity id of the link target.
type: string
type: object
type: array
nodes:
description: Array of nodes.
items:
properties:
entity_attributes:
description: (optional) Entity related attributes.
type: object
entity_id:
description: Node entity id.
type: string
fx:
description: (optional) Force x position.
format: float
type: number
fy:
description: (optional) Force y position.
format: float
type: number
index:
description: Index of the node list.
format: int32
type: integer
text:
description: (optional) Node label.
type: string
type:
description: Node entity type.
type: string
x:
description: X position of the node.
format: float
type: number
y:
description: Y position of the node.
format: float
type: number
type: object
type: array
private:
description: Private status.
type: boolean
type: object
security:
- VTApiKey: []
summary: VirusTotal Update a Graph Object
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/graphs/{id}/comments:
get:
tags:
- Threat Graphs
deprecated: false
description: 'This endpoint returns the comments posted in a given graph. Check [Graph comments relationship page](https://gtidocs.virustotal.com/reference/graph-comments) to know more about the returned
object.
'
operationId: getGraphComments
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
- description: Maximum number of related objects to retrieve
in: query
name: limit
schema:
type: string
- description: Continuation cursor
in: query
name: cursor
schema:
format: int32
type: integer
security:
- VTApiKey: []
summary: VirusTotal Get Comments on a Graph
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
tags:
- Threat Graphs
deprecated: false
description: VirusTotal Add a Comment to a Graph
operationId: postGraphsComments
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
properties:
data:
default: '{"type": "comment", "attributes": {"text": "test"}}'
description: A comment object.
format: json
type: string
required:
- data
type: object
security:
- VTApiKey: []
summary: VirusTotal Add a Comment to a Graph
responses:
'200':
description: Successful VirusTotal API response.
content:
application/json:
schema:
$ref: '#/components/schemas/DataEnvelope'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Object not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Rate limit or quota exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/graphs/{id}/relationships/{relationship}:
get:
tags:
- Threat Graphs
deprecated: false
description: 'This endpoint is the same as [/graphs/{id}/{relationship}](https://gtidocs.virustotal.com/reference/graphs-relationships) except it returns just the related object''s IDs (and context
attributes, if any) instead of returning all attributes.
'
operationId: graphsRelationshipsIds
parameters:
- description: A 65 char length id which uniquely identify the graph.
in: path
name: id
required: true
schema:
type: string
- description: Relationship name (see [table](ref:graph-object#relationships))
in: path
name: relationship
required: true
schema:
type: string
- description: Maximum number of related objects to retrieve
in: query
name: limit
schema:
type: string
- description: Continuation cursor
in: query
name: cursor
schema:
format: int32
type: integer
responses:
'200':
content:
text/plain:
examples:
Result:
value: ''
description: '200'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
# --- truncated at 32 KB (55 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/virustotal/refs/heads/main/openapi/virustotal-threat-graphs-openapi.yml