---
title: "Upload File"
method: POST
path: "/api/v3/files/"
tags: ["Files"]
---

# Upload File

`POST /api/v3/files/`

## Request

- Base URL: `https://ai.virustotal.com`
- URL: `https://ai.virustotal.com/api/v3/files/`
- Auth: one of:
  - API key in header `x-apikey`
  - HTTP bearer

Legacy multipart file upload (maximum 32 MiB).

New integrations should use POST /api/v3/submissions/{sha256} for durable receipt recovery.
This legacy route optionally accepts a password and comment; it does not provide durable receipts.

Only files confirmed absent from VirusTotal are uploaded, without consuming
query quota. Returning an existing report consumes one query. Uploads and
comments revalidate current access before starting.

## Response `200`

Successful Response

- unknown

## Other responses

- `401`: Missing VTAI token
- `403`: Invalid VTAI token
- `404`: No report found; unavailable evidence is not a safe verdict
- `422`: Invalid lookup input
- `429`: File contribution limit, report-query quota or VirusTotal quota exceeded
- `502`: Invalid upstream response or upstream request rejected
- `503`: Access, file contribution admission or VirusTotal service unavailable
- `504`: VirusTotal timeout

---

[API](https://skmtc.dev/virustotal/apis/virustotal-ai-api.md) · [All operations](https://skmtc.dev/virustotal/apis/virustotal-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/virustotal/apis/virustotal-ai-api/revisions/3c7943feccc6?raw)