Hi all,
As mention above, is there any tool or component in OutSystem (or outside OS) allow us to scan file(to make sure clean file, detect virus) before upload file to server?
I have already searched in Forge and found only "VirusTotalAPI" component. I tried to use it but output return from server action ( that call REST API to scan file upload) seem not like I expected. It just said "come back later for the report".
Thank you,
Huy
I don't think there are any out-of-the-box components in Outsystems that will provide this functionality. If you're concerned about viruses being uploaded to a server through your application, you'll have to find a provider for this, and most of them are either paid, or in the case of being public, like VirusTotal, do not service commercial applications:
Disclosure: I run malcheck (https://malcheck.com), one of the paid scanning APIs, so weigh the last paragraph accordingly.
Two things worth adding to the accepted answer, since this thread still ranks for this question.
About the "come back later for the report" result: that is expected behaviour of VirusTotal, not a bug in the Forge component. VirusTotal's file endpoint queues the file and returns an analysis id; the verdict is only available on a later GET, and on the public API it can take a while. So a synchronous "scan then decide" flow does not fit it, and as Afonso said, the public API is not licensed for commercial use anyway.
If you need a synchronous verdict inside the upload request, the options in 2026 are:
- Self-hosted ClamAV (open source). Run clamd, put a small REST wrapper in front of it, call it from a Server Action. You own the server and the signature updates.
- Cloud storage scanning (AWS GuardDuty Malware Protection for S3, Microsoft Defender for Storage) if the files already go to S3/Blob. These are asynchronous, so the app must quarantine the file until the verdict event arrives.
- A SaaS scanning API called from a Server Action. When comparing them, check the engine, where the file is processed, whether the file is retained or shared with a threat-intel network, and whether commercial use is allowed.
malcheck is the last kind: one ClamAV engine, processed in Tokyo, the file is deleted as soon as the result is recorded, not forwarded to any sample-sharing network. Synchronous by default (typically well under a second for small files), with an optional async mode that you poll with GET /api/scan/{id} (no callback endpoint needed, which is convenient in OutSystems). One of our production customers calls it from an O11 app. First 100 scans are free, then a flat monthly fee in JPY. Site and support are in Japanese.
Example with the EICAR test file:
curl -X POST https://malcheck.com/api/scan -F token=YOUR_TOKEN -F url=https://secure.eicar.org/eicar.com.txt
{"data": {"id": 684728, "status": "dirty", "found": "Eicar-Test-Signature", "version": "1.4.3/28123", "scanned_at": "2026-09-14T14:31:20.000000Z", ...}}
For an uploaded binary you send file=@path instead of url. In OutSystems the Consume REST API wizard does not build multipart/form-data for you, so you either construct the multipart body (there are Forge components for it) or pass a URL if the file is already reachable.
Data handling and questionnaire answers: https://malcheck.com/security?utm_source=outsystems&utm_medium=forum
API reference: https://malcheck.com/doc.html