ActionVirusTotalUpdated June 2026

How do I look up an existing VirusTotal URL report?

Short answer: You can get url report in VirusTotal by hand from its own interface, but it won’t repeat itself. On TinyCommand, add the VirusTotal Get URL Report action to a workflow, map its 1 input from any upstream app, and it runs automatically every time the trigger fires. No code, and a free tier to start.

Get URL Report in VirusTotal — start free
Inputs

The fields this action accepts.

Every field can be mapped from an upstream trigger, AI step, table row, or hard-coded literal.

FieldTypeRequiredDescription
Analysis ID
analysisId
stringRequiredFrom the scan submission response
Sample request
{
"analysisId": "{{trigger.analysisId}}"
}
Returns
{
"data": {
"attributes": {
"stats": {
"harmless": 70,
"malicious": 0,
"suspicious": 0,
"undetected": 15
},
"status": "completed",
"results": {}
}
}
}

Use these fields in downstream nodes for routing, logging, or error handling.

Triggered by

Apps that pair well as the trigger for Get URL Report.

Any of these apps can fire this action as part of a workflow.

FAQ

Questions about Get URL Report.

What does the Get URL Report action do in VirusTotal?
Returns the existing VirusTotal analysis for a URL, including engine-by-engine verdicts and an aggregate threat score. Cheaper and faster than Scan URL when the URL has been analyzed before.
What inputs does Get URL Report require?
Required: Analysis ID. Every input accepts a static value or a variable from any upstream node in your workflow.
Can I use dynamic inputs from earlier workflow nodes?
Yes. Any field on this action can pull values from upstream nodes, whether that's a form response, a trigger payload, an AI output, or a lookup result.
What happens if VirusTotal returns an error?
The workflow pauses on the failed node, the error message is captured in the run log, and you can retry the run with one click. Auto-retry policies are configurable per workflow with exponential backoff up to 5 attempts.
Does Get URL Report support batch operations?
Yes. Run Get URL Report inside a Loop node to process arrays. TinyCommand handles VirusTotal's rate limits automatically so you don't have to throttle manually.
More actions

Other VirusTotal actions.

Action
Scan URL
Submits a URL for fresh scanning by VirusTotal's engines. Returns an analysis ID you can poll via Get URL Report once scanning is complete.
Get URL Report in VirusTotal — start free