API

Virus scan API and certificate check API

Scan an upload with ClamAV and read what a TLS certificate says, in one call each.

What it does

The Security Utilities API gives your app two small checks. Upload a file and get a ClamAV virus verdict with MD5 and SHA-256 hashes. Paste a PEM certificate and get its subject, issuer, validity window, key type and size, SANs and key usage.
It solves the "we should scan uploads" and "is this cert about to expire?" jobs without running a scanner or writing X.509 parsing yourself.
Read the limits. "Valid" for a certificate means it parses and today falls inside its own dates. No trust store is consulted and no issuer signature is checked, and the response says which checks ran. A scan is only as good as the ClamAV signatures loaded.
The same family also holds a tenant-scoped IP and domain threat log (report, check, bulk-check, stats). For open feeds and standing, see the IP and domain reputation API.
Affordable by design. Start free* within platform limits for connected ShadowCradle organizations, with affordable pricing beyond that. *Free within platform limits; usage beyond limits may be charged to maintain the platform.

Example use cases

Scan user uploads before you store them

Product teams send each upload to /virus-scan and reject or quarantine infected files. Repeat files return the stored verdict for the same hash.

Check a customer certificate

An MSP pastes a PEM from a client server and sees the expiry date, SAN names and key size before a renewal call.

Pre-flight a renewal pipeline

Ops teams fail a deploy if a new certificate is not yet valid or is near its end date.

Keep a private threat log

Security teams record bad IPs and domains for their own tenant and check candidates in bulk (up to 100 IPs per call).

Document hashes for evidence

Every scan returns MD5 and SHA-256 for the file, handy for a ticket or incident note.

Try it

Virus-scan a file

curl -s -X POST "https://app.takelan.com/api/v1/security/virus-scan" \
  -H "X-API-Key: $TAKELAN_API_KEY" \
  -F "file=@./invoice.pdf"

Response (trimmed, fictional): { "is_infected": false, "virus_name": null, "scan_engine": "clamav", "filename": "invoice.pdf", "file_hash_sha256": "9f2c...e1", "scan_duration_ms": 41 }. An empty file returns 400.

Read a certificate

jq -n --rawfile c cert.pem '{certificate: $c}' | \
  curl -s -X POST "https://app.takelan.com/api/v1/security/validate-cert" \
  -H "X-API-Key: $TAKELAN_API_KEY" -H "Content-Type: application/json" -d @-

A bad PEM returns 422 with the parser message.

Endpoints

POST /api/v1/security/virus-scan Scan: multipart file upload, ClamAV verdict and hashes.
POST /api/v1/security/validate-cert Certificate: parse a PEM and report fields and the validity window.
POST /api/v1/security/ip/check Threat log: is this IP flagged in your tenant log?
POST /api/v1/security/ip/bulk-check Threat log: check up to 100 IPs.
POST /api/v1/security/ip/report Threat log: record a malicious IP.
POST /api/v1/security/domain/check Threat log: check a domain.
POST /api/v1/security/domain/report Threat log: record a malicious domain.
GET /api/v1/security/stats Threat log: totals and breakdown.
DELETE /api/v1/security/ip/{ip_id} Threat log: remove an IP entry.
DELETE /api/v1/security/domain/{domain_id} Threat log: remove a domain entry.

MCP

Available as tools through /mcp/utils. Read tools work by default with an API key. Anything that writes is off until your tenant turns on the writes switch, and a read-only key never writes. Calls run with your own permissions. Uploaded file bytes are not exposed as MCP tools. Report and delete calls are writes. About MCP

Common questions

Is there an API to scan a file for viruses?

Yes. POST the file to /api/v1/security/virus-scan. It uses ClamAV and returns a verdict, virus name if found, and hashes.

How do I check an SSL certificate expiry date by API?

POST the PEM to /api/v1/security/validate-cert. You get not-before and not-after dates and whether today is inside them.

Does validate-cert verify the certificate chain?

No. It parses the certificate and checks its own dates only. It does not check a trust store or issuer signature, and the response says so.

Does it fetch the certificate from a live server?

No. You send the PEM text. Fetching from a host is not part of this endpoint.

Are scan results stored?

Results are recorded with the file hashes, so the same bytes return the latest stored verdict. Do not rely on a scan as your only control for hostile files.

What is the difference from the reputation API?

The tenant threat log here is your own record. The reputation API reads open feeds and platform-wide standing.

Are there rate limits?

Yes. These endpoints use platform rate limits by endpoint type; a 429 includes Retry-After. Exact numbers can differ by environment.

Can an AI agent call it?

Yes, through /mcp/utils, with writes off by default.

All API families | Takelan Utilities & APIs | Pricing