Good idea....I guess nobody implemented it yet but certainly possible. This would require 3rd party anti virus engine which provides API for us to consume and scan the file. I suppose Windows Defender ATP has some API exposed to use.

Disclosure first: I run malcheck (https://malcheck.com), a virus-scanning API, so read the last part with that in mind.

This thread is old, but it still comes up in search, so here is the current state of the options as of 2026.

There is still no built-in scanning in OutSystems, so you need an external engine. The realistic choices are:

1. Run ClamAV yourself. It is open source and has a daemon (clamd) with a socket/TCP interface. You would wrap it in a small REST service (or use a ready-made REST wrapper) and call it from a Server Action. Cheapest to run, but you own the server, the signature updates and the monitoring.

2. Use the cloud provider's storage scanning if your files already land in cloud storage. AWS GuardDuty Malware Protection for S3 and Microsoft Defender for Storage (Azure Blob) scan objects on upload. These are asynchronous: the verdict arrives as an event/tag after the upload, so your app has to hold the file in a quarantine state until then.

3. Call a SaaS scanning API synchronously from a Server Action. This is the "synchronous" option the original question asked about. Providers differ mainly in engine (ClamAV vs. a commercial engine vs. multiple engines), where the file is processed, whether the file is kept or shared with a threat-intel network, and whether commercial use is allowed. Note that VirusTotal's public API is not licensed for commercial products, which is what the Forge VirusTotal connector uses.

For option 3, malcheck is what I run. It is a single ClamAV engine, servers in Tokyo, the file is deleted as soon as the result is recorded, and nothing is forwarded to any sample-sharing network. It is a plain multipart POST, so it works from a Consume REST API in OutSystems (one of our production customers calls it from an O11 app in synchronous mode). Free for the first 100 scans, then a flat monthly fee in JPY. The site and support are in Japanese, which is a limitation if your team is not.

A minimal call using the EICAR test file (you can send file=@... instead of url for an uploaded binary):

curl -X POST https://malcheck.com/api/scan -F token=YOUR_TOKEN -F url=https://secure.eicar.org/eicar.com.txt

{"data": {"id": 684728, "status": "dirty", "found": "Eicar-Test-Signature", "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "size": 68, "version": "1.4.3/28123", "scanned_at": "2026-09-14T14:31:20.000000Z", ...}}

A clean file comes back with "status": "clean". There is also an async mode (async=1, then poll GET /api/scan/{id}) for cases where you do not want to block the request; polling rather than a callback URL is easier in OutSystems because you do not need to expose an endpoint.

One OutSystems-specific note: the Consume REST API wizard does not generate multipart/form-data requests for you, so for the uploaded-binary case you either build the multipart body yourself (there are Forge components for that) or, if the file is already reachable by URL, send the URL instead.

Data handling, retention and the security-questionnaire answers are here: https://malcheck.com/security?utm_source=outsystems&utm_medium=forum

API reference: https://malcheck.com/doc.html