---
title: "Get object descriptors related to a threat"
method: GET
path: "/collections/{id}/relationships/{relationship}"
tags: ["Threat Actors, Malware & Tools, Campaigns, IoC Collections"]
---

# Get object descriptors related to a threat

`GET /collections/{id}/relationships/{relationship}`

## Request

- Base URL: `https://www.virustotal.com/api/v3`
- URL: `https://www.virustotal.com/api/v3/collections/{id}/relationships/{relationship}`
- Auth: none required
- TypeScript: <https://skmtc.dev/virustotal/apis/threat-landscape/docs/collections/:id/relationships/:relationship/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `id` string, required
- `relationship` string, required

## Query parameters

- `limit` integer
- `cursor` string

## Headers

- `x-apikey` string, required

## Response `200`

200

- object

## Other responses

- `400`: 400

## Changes

- **2026-11-03** `a15abb3e8389`: 3 info
  - api operation id `get-vulnerability-related-descriptors` removed and replaced with `get-threat-related-descriptors`
  - api tag `Threat Actors, Malware & Tools, Campaigns, IoC Collections` added
  - api tag `Vulnerabilities` removed

[Operation history](https://skmtc.dev/virustotal/apis/threat-landscape/changes/collections/:id/relationships/:relationship/get.md)

---

[API](https://skmtc.dev/virustotal/apis/threat-landscape.md) - [All operations](https://skmtc.dev/virustotal/apis/threat-landscape/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/threat-landscape/revisions/a15abb3e8389?raw)