ActionVirusTotalUpdated May 2026

How do I look up an existing VirusTotal URL report?

Short answer: Drop the "VirusTotal → Get URL Report" action anywhere in your workflow, map the inputs from upstream nodes, and publish.

Use this action All 2 VirusTotal actions

Inputs

The fields this action accepts.

Every field can be mapped from an upstream trigger, AI step, table row, or hard-coded literal.

Field	Type	Required	Description
Analysis ID analysisId	string	Required	From the scan submission response

Sample request

{
  "analysisId": "{{trigger.analysisId}}"
}

Returns

{
  "data": {
    "attributes": {
      "stats": {
        "harmless": 70,
        "malicious": 0,
        "suspicious": 0,
        "undetected": 15
      },
      "status": "completed",
      "results": {}
    }
  }
}

Use these fields in downstream nodes for routing, logging, or error handling.

Triggered by

Apps that pair well as the trigger for Get URL Report.

Any of these apps can fire this action as part of a workflow.

Google Sheets → VirusTotal

2 Google Sheets triggers

HubSpot → VirusTotal

18 HubSpot triggers

FAQ

Questions about Get URL Report.

What does the Get URL Report action do in VirusTotal?

Returns the existing VirusTotal analysis for a URL, including engine-by-engine verdicts and an aggregate threat score. Cheaper and faster than Scan URL when the URL has been analyzed before.

What inputs does Get URL Report require?

Required: Analysis ID. Every input accepts a static value or a variable from any upstream node in your workflow.

Can I use dynamic inputs from earlier workflow nodes?

Yes. Any field on this action can pull values from upstream nodes, whether that's a form response, a trigger payload, an AI output, or a lookup result.

What happens if VirusTotal returns an error?

The workflow pauses on the failed node, the error message is captured in the run log, and you can retry the run with one click. Auto-retry policies are configurable per workflow with exponential backoff up to 5 attempts.

Does Get URL Report support batch operations?

Yes. Run Get URL Report inside a Loop node to process arrays. Tiny Command handles VirusTotal's rate limits automatically so you don't have to throttle manually.

More actions