Scan any file for malware with one API call.

Virus and malware scan API powered by Sophos — as SaaS or self-hosted in your AWS account. SDKs for Java, Python, and JavaScript/TypeScript.

Try for Free Developer docs
Scan a file
curl -X POST \
  -H "x-api-key: $ATTACHMENTAV_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"download_url": "https://example.com/report.pdf"}' \
  https://eu.developer.attachmentav.com/v1/scan/sync/download
# github.com/widdix/attachmentav-cli
export ATTACHMENTAV_API_KEY=<your-api-key>
attachmentav --json report.pdf
// npm i @attachmentav/virus-scan-sdk-ts
import { AttachmentAVApi, Configuration } from '@attachmentav/virus-scan-sdk-ts';

const api = new AttachmentAVApi(new Configuration({
  apiKey: process.env.ATTACHMENTAV_API_KEY
}));
const result = await api.scanSyncDownloadPost({
  syncDownloadScanRequest: { downloadUrl: 'https://example.com/report.pdf' }
});
# pip install attachmentav-virus-malware-scan-sdk
import os
import attachmentav

config = attachmentav.Configuration()
config.api_key['apiKeyAuth'] = os.environ['ATTACHMENTAV_API_KEY']

with attachmentav.ApiClient(config) as client:
    api = attachmentav.AttachmentAVApi(client)
    result = api.scan_sync_download_post(attachmentav.SyncDownloadScanRequest(
        download_url='https://example.com/report.pdf'))
// Maven Central: com.attachmentav:virus-scan-sdk
ApiClient client = Configuration.getDefaultApiClient();
client.setApiKey(System.getenv("ATTACHMENTAV_API_KEY"));

AttachmentAvApi api = new AttachmentAvApi();
SyncDownloadScanRequest request = new SyncDownloadScanRequest();
request.setDownloadUrl("https://example.com/report.pdf");
ScanResult result = api.scanSyncDownloadPost(request);

Result{"status":"clean","size":2903045,"realfiletype":"Adobe Portable Document Format (PDF)"}

Powered by

Every file is scanned by the Sophos® engine.

attachmentAV does not ship a home-grown scanner. Detection comes from Sophos, a commercial antivirus engine, wrapped in our highly available scanning infrastructure.

Hourly signature updates

The Sophos threat database is refreshed hourly, so protection against the latest threats reaches you without any action on your side.

Advanced detection

Signatures and advanced detection algorithms catch viruses, worms, trojans, and ransomware, including zero-day threats.

Nothing to install or maintain

No antivirus agent on your servers, no signature files to distribute, no scanner to patch.

Simple to use

Scan files for viruses and malware with ease.

A simple POST request protects your app from malware.

Synchronous

Upload a file or pass a URL and get the scan result in the HTTP response. Ideal for scanning on the upload path. Files up to 10 MB uploaded, or 200 MB downloaded from a URL.

Asynchronous

Hand over a URL and continue. Receive the scan result via a signed callback or poll for it. Ideal for large files and background pipelines. Files up to 5 GB.

Real file type detection

Don't trust file extensions or MIME types. Every scan result reports the real file type detected by the Sophos engine.

SDKs and CLI

Java com.attachmentav:virus-scan-sdk
Python attachmentav-virus-malware-scan-sdk
JavaScript / TypeScript @attachmentav/virus-scan-sdk-ts
CLI Linux, macOS, and Windows

Reliability

Always on. Answers in milliseconds.

Our API is highly available. Each regional endpoint consists of a load balancer and servers distributed among multiple data centers.

100%

uptime of the API in the last 90 days

97ms

average response time of the API in the last 30 days

View live status Uptime measured by UptimeRobot

Mitigate risks

Every upload is a risk.

Files from users, customers, and partners are untrusted input. With one API call, your application accepts clean files and rejects infected ones.

How an app scans uploads with attachmentAV1. A client uploads a file to your app. 2. Your app sends the file to the attachmentAV API. 3. The API scans the file with Sophos. 4. The API responds with the scan status, clean or infected. 5. Your app proceeds with clean files and rejects infected files.ClientYour appattachmentAV1Upload file2Send file3Scan4Scan statusclean/infected5aProceed if clean5bReject if infected

Deployment options

SaaS or self-hosted on AWS. Your choice.

Same API, same Sophos engine, same SDKs. Choose where files are scanned to match your data protection requirements.

SaaS

Get an API key and start scanning within minutes.

  • Fully managed solution
  • Highly available public API endpoint
  • Available in Europe, US, Canada, India, and Australia
  • GDPR compliant & ISO 27001 certified
Try for Free See pricing

Self-hosted on AWS

Deploy the API to your AWS account in about 15 minutes.

  • Production-ready Infrastructure as Code templates
  • Public or private API endpoint (VPC)
  • Available in 32 AWS regions
  • No sub-processor: files stay in your AWS account
Try for Free See pricing
Available worldwide, operated from the European Union

Worldwide · EU by default

Data sovereignty

Made in EU. Available globally.

attachmentAV is available worldwide and built by widdix GmbH, an independent, self-funded company based in Germany. Access to our systems is granted only to support, administrative, and security personnel based in the EU.

Scanning happens in the jurisdiction you select. Europe is the default.

  • EuropeDefault
  • United States
  • Canada
  • India
  • Australia

Data sent to a regional endpoint does not leave that jurisdiction. Files are encrypted in transit and at rest, and deleted immediately after processing.

Need full control? With the self-hosted API, scanning runs inside your own AWS account and the region of your choice.

Read about jurisdictions and security

Trusted Solution

Independently certified. Officially partnered.

ISO 27001 certified

We establish, maintain, and continually improve an information security management system that is independently audited.

GDPR compliant

We are a company based in Germany and are processing data under a DPA (Data Processing Agreement) following GDPR requirements.

Salesforce, Atlassian & Sophos partner

Our apps are reviewed and listed on the Salesforce AppExchange and the Atlassian Marketplace. We are an official Sophos OEM partner.

2.4TB

of files scanned for malware in the last 30 days as of October 8, 2026

590

infections found in the last 30 days as of October 8, 2026

1,000+

customers trust our technology

Get started with attachmentAV

Try for Free Book a Demo