---
title: "Lookup Url Report"
method: POST
path: "/api/v3/urls/lookup"
tags: ["Intelligence"]
---

# Lookup Url Report

`POST /api/v3/urls/lookup`

## Request

- Base URL: `https://ai.virustotal.com`
- URL: `https://ai.virustotal.com/api/v3/urls/lookup`
- Auth: one of:
  - API key in header `x-apikey`
  - HTTP bearer

Query URL intelligence without an explicit analysis POST from VTAI.

The complete URL is disclosed to VirusTotal. Use a domain lookup when URL
query parameters or fragments contain private information.

## Request body

- URLLookupRequest
  - `url` string, required: HTTP(S) URL without userinfo, whitespace or control characters. Sent only to VirusTotal for existing intelligence; no scan or target fetch.

## Response `200`

Successful Response

- URLResponse
  - `data` URLData, required
    - `id` string, required: Canonical object identifier returned by VirusTotal
    - `source` 'VirusTotal'
    - `last_analysis_stats` object, nullable, required: Reported category counts; null when unavailable. Zero detections do not establish safety.
    - `detections` string[], required: Non-null result strings from engines, including clean/undetected labels; these are not engine names
    - `analysis_date` string, date-time, nullable, required: UTC last_analysis_date from VirusTotal, null if absent or invalid; never the lookup time
    - `report_url` string, required: Link to the existing VirusTotal report
    - `coverage` ReportCoverage, required
      - `engines` integer, nullable, required: Number of entries in last_analysis_results; null when unavailable
      - `categories` string[], required: Distinct categories actually present in last_analysis_results; not a safety verdict
    - `type` 'url'
    - `url` string, required: Requested URL after VTAI normalization; VirusTotal canonicalizes its own identifier

## Other responses

- `401`: Missing VTAI token
- `403`: Invalid VTAI token
- `404`: No report found; unavailable evidence is not a safe verdict
- `422`: Invalid lookup input
- `429`: Shared VTAI query quota or VirusTotal quota exceeded
- `502`: Invalid upstream response or upstream request rejected
- `503`: Access, quota or VirusTotal service unavailable
- `504`: VirusTotal timeout

---

[API](https://skmtc.dev/virustotal/apis/virustotal-ai-api.md) · [All operations](https://skmtc.dev/virustotal/apis/virustotal-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/virustotal/apis/virustotal-ai-api/revisions/3c7943feccc6?raw)