FileRisk, file malware scanning API

Why we built it

Any service that handles files needs to know whether uploaded files are safe. Commercial scanning engines are expensive, and handing files to an external scanning service means nobody knows where customers’ files end up. A scanning service must not become one more risk.

So we built a scanning API designed never to retain files. Website uploads, file storage, email attachments, workstations, document ingestion pipelines, and business systems connect wherever a file can be sent over an API. The same API scans files in BITBOX CLOUD.

What you can do

Three-step integration

Request a scan to get an upload address, upload the file there, and receive the verdict. If the file already sits in storage, pass a signed URL and FileRisk fetches it directly. When the same file keeps coming back, send only its SHA-256 hash for a verdict without uploading. Results are read through a query API or delivered by signed webhook.

Six verdicts with reasons

Clean, malicious, suspicious, unscannable, error, and format verified. Every verdict comes with a list of reasons showing which engine saw what, plus engine and signature versions, so you can record and explain results as they are. A timeout or engine problem is reported as an error, never as clean, and files whose contents cannot be examined, such as encrypted archives, are marked unscannable.

Several layers of checks

• Malware signatures. Known malware is detected and signatures update automatically.
• Detection rules find web shells and malicious scripts, and matched rules are recorded as reasons.
• Format spoofing detection finds files whose extension does not match their real format, double extensions, code hidden inside images, and SVGs containing scripts.
• Archive structure checks extract zip, gzip, bzip2, xz, and tar in-house to catch archive bombs and deep nesting.
• Large media format verification checks only the needed ranges of video and audio originals over 100MB to confirm the structure matches the format.
• Hash cache. Files already scanned get a verdict without uploading.

Scanning you can trust

• No files are retained. They are deleted as soon as the scan ends, leaving only the verdict and its reasons. There is no way to export a detected file.
• File bodies never pass through the API server. They go directly to the scan server.
• Errors are never reported as clean. Files that could not be examined are marked unscannable or error.
• Before launch we checked false positives and scan time against hundreds of thousands of clean files.

Get started

Integrate on the free plan right away and move up as your scan volume grows. API documentation and the OpenAPI specification are public.