---
updatedAt: 2025-12-24T15:31:02.000Z
agentTools:
  projectIndex: https://virustotal.readme.io/v2.0/llms.txt
---

# /url/feed

Retrieve live feed of all URLs submitted to VirusTotal

> 🚧 Private API
>
> This endpoint is available in the [Private API](docs/public-vs-private-api) only.

This endpoint allows you to retrieve a live feed of reports on absolutely all URLs scanned by VirusTotal. It requires you to stay relatively synced with the live submissions as only a backlog of 24 hours is provided at any given point in time.

The `package` argument indicates a time window to pull reports on all items received during such window. Only per-minute and hourly windows are allowed, the format is *%Y%m%dT%H%M* (e.g. `20160304T0900`) or *%Y%m%dT%H* (e.g. `20160304T09`). Time is expressed in UTC.

The response is a bzip2 compressed tarball. For per-minute packages the compressed package contains a unique file, the file contains a JSON per line, this JSON is a full report on a given URL processed by VirusTotal during the given time window. The URL report follows the exact same format as the response of the [/url/report](./reference#url-report) endpoint when `allinfo=true` is provided. For hourly packages, the tarball contains 60 files, one per each one-minute window.

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "api-v2",
    "version": "2.0"
  },
  "servers": [
    {
      "url": "https://www.virustotal.com/vtapi/v2"
    }
  ],
  "security": [
    {}
  ],
  "paths": {
    "/url/feed": {
      "get": {
        "summary": "/url/feed",
        "description": "Retrieve live feed of all URLs submitted to VirusTotal",
        "operationId": "url-feed",
        "parameters": [
          {
            "name": "apikey",
            "in": "query",
            "description": "Your API key",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "package",
            "in": "query",
            "description": "Indicates a time window to pull reports on all items received during such window",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "200",
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {}
                }
              }
            }
          },
          "400": {
            "description": "400",
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {}
                }
              }
            }
          }
        },
        "deprecated": false,
        "x-readme": {
          "code-samples": [
            {
              "language": "python",
              "code": "import requests\nimport io\nimport tarfile\nimport json\n\nurl = \"https://www.virustotal.com/vtapi/v2/url/feed\"\n\nquerystring = {\"apikey\":\"<APIKEY>\",\n               \"package\":\"<PACKAGE>\"}\n\nresponse = requests.request(\"GET\", url, params=querystring)\n\nwith io.BytesIO(response.content) as f:\n  with tarfile.open(fileobj=f, mode=\"r:bz2\") as t:\n    url_infos = [[json.loads(line) for line in t.extractfile(compressed_file)] for compressed_file in t]"
            },
            {
              "language": "curl",
              "code": "curl --location --output package.tar.bz2 --request GET   --url \"https://www.virustotal.com/vtapi/v2/url/feed?apikey=<apikey>&package=<package>\""
            }
          ],
          "samples-languages": [
            "python",
            "curl"
          ]
        }
      }
    }
  },
  "x-readme": {
    "headers": [],
    "explorer-enabled": true,
    "proxy-enabled": true
  },
  "x-readme-fauxas": true
}
```