---
title: "Export IOCs from a threat"
method: GET
path: "/collections/{id}/download/{format}"
tags: ["Threat Actors, Malware & Tools, Campaigns, IoC Collections"]
---

# Export IOCs from a threat

`GET /collections/{id}/download/{format}`

## Request

- Base URL: `https://www.virustotal.com/api/v3`
- URL: `https://www.virustotal.com/api/v3/collections/{id}/download/{format}`
- Auth: none required
- TypeScript: <https://skmtc.dev/virustotal/apis/threat-landscape/docs/collections/:id/download/:format/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `id` string, required
- `format` string, required

## Headers

- `x-apikey` string, required

## Response `200`

200

- object
  - `files` string[]
  - `references` string[]
  - `threat_actors` string[]
  - `urls` string[]

## Other responses

- `400`: 400

## Changes

- **2026-11-03** `a15abb3e8389`: 3 info
  - api operation id `export-vulnerability-iocs` removed and replaced with `export-threat-iocs`
  - api tag `Threat Actors, Malware & Tools, Campaigns, IoC Collections` added
  - api tag `Vulnerabilities` removed

[Operation history](https://skmtc.dev/virustotal/apis/threat-landscape/changes/collections/:id/download/:format/get.md)

---

[API](https://skmtc.dev/virustotal/apis/threat-landscape.md) - [All operations](https://skmtc.dev/virustotal/apis/threat-landscape/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/threat-landscape/revisions/a15abb3e8389?raw)