---
title: "Upload a file"
method: POST
path: "/files"
tags: ["Private Files"]
---

# Upload a file

`POST /files`

## Request

- Base URL: `https://www.virustotal.com/api/v3/private`
- URL: `https://www.virustotal.com/api/v3/private/files`
- Auth: none required

## Headers

- `x-apikey` string, required

## Request body `multipart/form-data`

- object
  - `command_line` string: Command line arguments to use when running the file in sandboxes.
  - `disable_sandbox` string: If true, then the file won't be detonated in sandbox environments. False by default.
  - `enable_internet` string: If the file should have internet access when running in sandboxes. False by default.
  - `file` string, binary, required
  - `intercept_tls` string: Intercept HTTPS/TLS/SSL communication. Intercept HTTPS to view encypted URLS, hostnames and HTTP headers. This is detectable by any sample that checks certificates, and makes JA3 hashes unusable.
  - `password` string: Optional, password to decompress and scan a file contained in a protected ZIP file.
  - `retention_period_days` integer: Optional, number of days the report and file are kept in VT (between 1 and 28). If not set it defaults to the group's retention policy preference (1 day by default).
  - `storage_region` 'US' | 'CA' | 'EU' | 'GB': Optional, storage region where the file will be stored. By default uses the group's private_scanning.storage_region preference. Allowed values are US, CA, EU, GB
  - `interaction_sandbox` 'cape_win' | 'cape_linux': Select the sandbox desired for interactive use.
  - `interaction_timeout` integer: Interaction timeout in seconds, minimum value: 60. (1 minute.) Max value: 1800: (30 minutes)
  - `locale` 'EN_US' | 'AR_SA' | 'DE_DE' | 'ES_ES' | 'PT_BR': Preferred sandbox locale. On windows this selection will change the language and keyboard settings of the analysis machine.

## Response `200`

The analysis ID. Use [/analyses/<analysis_ID>](ref:private-analysis) API call to check the analysis status.

- object
  - `data` object
    - `id` string
    - `type` string
    - `links` object
      - `self` string

## Other responses

- `401`: If password was provided and the file isn't a ZIP, it contains more than one file, the password is incorrect, or the file is corrupt.

---

[API](https://skmtc.dev/virustotal/apis/private-scanning.md) - [All operations](https://skmtc.dev/virustotal/apis/private-scanning/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/private-scanning/revisions/f6f4e9bf7fa4?raw)