Scan a URL
Ask Threatless to download a public HTTP(S) file and scan it.
POST /api/v1/scans
Send url instead of file. The API downloads the resource, streams it to ClamAV, and returns the same JSON shape as a file scan.
Request
X-API-KEY
header required
API key for the account.
url
string required
Public
http or https URL. Required when file is not sent.curl
curl -X POST https://api.trythreatless.com/api/v1/scans \
-H "X-API-KEY: YOUR_API_KEY" \
-F "url=https://example.com/file.exe"
The filename in the response is the last path segment of the URL. Size is the number of bytes actually read.
Safety checks
Before any byte is scanned, Threatless:
- Rejects blank URLs and non-http(s) schemes
- Resolves the host and blocks private / loopback / link-local addresses
- Blocks metadata service hostnames
- Re-validates every redirect
Location - Aborts if
Content-Lengthis over 10 MB, or if the stream exceeds 10 MB
See Privacy for the full SSRF policy.
When to use URL vs file
| Use | Why |
|---|---|
file | You already have the bytes (upload form, CI artifact). |
url | The object lives on a public CDN or download link you do not want to proxy yourself. |
Do not send internal URLs,
file:// paths, or localhost addresses. They are rejected on purpose.