Threatless

Dashboard API

JWT-authenticated endpoints used by the Threatless web app.

These routes power the dashboard. They are not required for a normal API integration, but they are useful if you build a custom UI against the same backend.

All of them need a valid access JWT (Authorization: Bearer or the web app cookie).

Scans

POST /web/scans
multipart
Scan an uploaded file. Same result DTO and quota as the public API, without URL support.
GET /web/scans/stats
page
Paginated history. Spring Pageable (page, size, sort).
GET /web/scans/stats/donuts
object
{ infected, clean } between optional startDate and endDate (YYYY-MM-DD). Defaults to the last 30 days.
GET /web/scans/stats/monthly
array
Twelve { month, infected, clean } buckets.

History rows look like:

json
{
  "id": "…",
  "filename": "suspect.bin",
  "scanDurationMillis": 42,
  "infected": false,
  "virusName": null,
  "env": "PRODUCTION",
  "status": "200",
  "error": null,
  "creationDate": "2026-04-01T12:00:00",
  "lastUpdate": "2026-04-01T12:00:00"
}

Keys

MethodPath
GET/web/keys/me
POST/web/keys body { "name": "ci" }
DELETE/web/keys/{uuid}

Billing

MethodPath
GET/web/billing/me
POST/web/billing/checkout-session body { "plan": "PRO" }
POST/web/billing/portal-session
POST/web/billing/sync optional { "checkoutSessionId": "cs_…" }

User

MethodPath
GET/web/users/me
PUT/web/users/me
GET/web/users/me/sessions
DELETE/web/users/me/sessions/{sessionId}
DELETE/web/users/me/sessions
Product integrations should prefer POST /api/v1/scans. The dashboard API exists so the official UI can stay a thin client.
Previous

Troubleshooting

Common Scan API failures and how to fix them.

Next