> For the complete documentation index, see [llms.txt](https://help.cumuluspro.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.cumuluspro.net/developer-guide/straatos-api/straatos-api-v2/malware-scanning-for-uploaded-documents.md).

# Malware Scanning for Uploaded Documents

Straatos Malware Scanning is a security feature that scans uploaded files for malicious software (such as viruses, ransomware, or other harmful code) before they are processed or stored. This helps prevent infected files from entering the system and ensures that only clean files are made available for further processing.

If malware scanning is enabled, when the Upload API is called, the files are initially stored in an isolation container. Only after the malware scan completes successfully, the files move automatically to the corresponding task, where they become available for further processing.

* If the scan completes successfully, the Upload API returns an OK status, and the file is moved to the tasl where it becomes available for processing.
* If malware is detected, the response will be “MalwareScanFileInfected” and the file is not processed.
* If you uploaded multiple files in a single Upload call, and one of them os detected with malware, then this set of files will not get uploaded.

### Prerequisites

There are some prerequisites to enable/disable the Malware Scanning.

1. An Organisation has been created for the project. You will need the OrganisationId when calling the API.
2. Your account has been invited to the Organisation and assigned to the Organisation Admin group.
3. A valid access token for an Organisation Admin account is included in the Authorization request header.

### Enabling or Disabling Malware Scanning

Malware scanning can only be configured at the Organisation level. Tenant-level and Group-level configuration is not supported.

To enable malware scanning, send a PUT request to:

{% hint style="info" icon="link-simple" %}
*{Straatos API domain}/IAM/Organisations/{OrganisationId}*
{% endhint %}

Include the Header with the access token:

```json
"Authorization": {access_token}
```

Set the malwareScanningEnabled property to either true or false:

```json
"malwareScanningEnabled": true
```

When you set everything correctly you will receive a 200 OK result.

Other possible responses:

* 400 : Bad request, please check the validity of your data
* 401/403: Unauthorized/Forbidden, please check if your access token is valid or no
* 500: Possible issue with server connection, please get in touch with our support team

Below is the cURL example:

```
url --request PUT \
  --url https://{straatos-api-domain}/IAM/Organisations/{OrganisationId} \
  --header "Authorization: Bearer {access_token}" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  --data '{
    "malwareScanningEnabled": true
  }'

```