Threatless

Introduction

Learn about Threatless and how it helps you scan files and URLs for malware.

Threatless is a malware scanning platform built for developers. Drop a file or a URL into a REST endpoint, get a JSON result, and keep moving.

It exists because most antivirus tools are heavy, opaque, or designed for desktops — not for the APIs, uploads, and pipelines that actually ship software. Threatless gives you a fast ClamAV-backed scanner, an hourly quota that matches your plan, and a dashboard to watch what goes through.

Why Threatless?

  • Simple setup: create an account, generate an API key, scan with one POST.
  • Developer first: REST API, dashboard scanner, JSON results, and rate-limit headers on every response.
  • Privacy by default: file bytes are scanned in memory and discarded. Only scan metadata is kept for your history.
  • Plan-based quotas: start free at 5 scans per hour, then scale to thousands without changing your integration.
  • Self-hostable: run the Nuxt app, Spring Boot API, and bundled ClamAV with Docker.

Key features

Scanning

  • Upload a file or point at a public HTTP(S) URL.
  • ClamAV engine with daily signature updates.
  • 10 MB maximum payload size.
  • JSON result with filename, size, duration, infection status, and virus name.

API and keys

  • Authenticate public scans with X-API-KEY.
  • The dashboard scanner uses your session instead of a key.
  • Hourly quotas returned as X-RateLimit-* headers.

Workspace

  • Dashboard analytics for clean vs infected scans.
  • API key management, billing, and account settings.
  • Session list and revoke for signed-in devices.

Architecture at a glance

Your app / CI
    │  POST /api/v1/scans  +  X-API-KEY
    ▼
Threatless API
    │  in-memory INSTREAM
    ▼
ClamAV (clamd)
    │
    ▼
JSON verdict + X-RateLimit-* headers

Nothing in that path writes the file to disk for the scan itself.

Getting started

  1. Follow the Quickstart to create a key and scan your first file.
  2. Validate the integration with the EICAR test file — a harmless sample from eicar.org.
  3. Copy a client in Language examples (cURL, JavaScript, Python, Go, PHP, Ruby, Java).
  4. Read the Scan API when you need errors, URL scans, or quota headers.

Community and support

Whether you are wiring a single upload form or scanning thousands of files an hour, Threatless stays out of the way and reports clearly.

Previous

Quickstart

Create an account, generate an API key, and scan your first file in minutes.