Malware scanning

Files are automatically scanned upon upload to File Service, regardless of size. The scanning process runs in the background — users can continue working while a scan is in progress.

To get the scan status, use either the get upload status or get file details endpoint. The response includes a malwareScanStatus field.

Scan Statuses

Status	Description
UNSCANNED	File has been uploaded but scanning has not started yet.
QUEUED_FOR_SCAN	File is in the queue waiting to be scanned.
CLEAN	Scan finished; the file is safe.
INFECTED	Malware detected in the file.
FAILED	A system or infrastructure error occurred during scanning.
CANNOT_SCAN	The file cannot be read and therefore cannot be scanned (e.g., encrypted).

Infected Files

If a file has malware, it will be marked as INFECTED. The GET file endpoint will not return a download URL for infected files by default. To access an infected file, append forceDownloadUrl=true as a query parameter to the GET file request. The SecOps team will be notified about the infected file. It’s important to highlight that copying an infected file will result in failure. Additionally, if a folder undergoing a copy process includes an infected file, this will cause the entire copy process to fail.