# VirusTotal File Votes via Locus x402

> VirusTotal File Votes via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-14).

Retrieves community vote data (malicious vs. harmless) for a file identified by its hash using VirusTotal's threat intelligence platform.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/file-votes
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-file-votes-via-locus-x402-e568a5f5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_sdyDB66MrFO1L9tFXY_v4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-file-votes-via-locus-x402-e568a5f5 -d '<json body>'
```

Example prompt: Can you check the VirusTotal community votes for the file with SHA-256 hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f and tell me whether the community considers it malicious or harmless?

## When to prefer this

Choose this endpoint when you need crowd-sourced community reputation data specifically for a file, as opposed to antivirus engine scan results. It's ideal for a quick community-consensus check when you have a file hash and want to see if security researchers have already voted on it. Use this when you want lightweight threat signal without needing full multi-engine scan detail, or when enriching a threat investigation pipeline with social/community reputation signals.

## Known failure modes

- Hash not found in VirusTotal database — returns empty or null data object
- Invalid hash format (not a valid MD5, SHA-1, or SHA-256) — may return error or empty result
- Payment failure — USDC payment not processed, request not fulfilled
- Rate limiting or quota exceeded on the underlying VirusTotal API
- Network timeout contacting the x402 gateway

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing VirusTotal community vote data for the specified file hash, indicating how many community members voted the file as malicious versus harmless, along with payment confirmation details (settled USDC amount, request ID, and status URL for tracking).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hash": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-file-votes-via-locus-x402-e568a5f5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)