AttachmentAV
Identity & SecurityConnect AI agents to attachmentAV, a malware scanning service for files and attachments. Agents scan uploads for viruses, trojans, and ransomware before a flow moves them anywhere, and check remaining account quota.
What This Integration Enables
Most file automation starts by trusting the file. A flow picks up an attachment, hands it to an extraction step, writes the result somewhere, and only later does anyone ask what was actually in the payload. AttachmentAV inverts that order. Agents scan a file the moment it enters the flow and before anything downstream opens it, using a synchronous call for files up to 10 MB or an asynchronous call for files up to 5 GB. Scans run against a public URL, against raw bytes forwarded by FlowRunner, or directly against an object sitting in an Amazon S3 bucket, so the check fits whichever way the file arrived. Every scan returns a verdict of clean, infected, or no, and infected results carry the malware finding name plus the real file type, which is often not the extension the sender used.
Agents also read the account surface. Get Usage returns remaining credits and the quota period, so a flow can confirm it has the budget to scan a batch before starting one. Get Account Info verifies the credentials resolve to the expected tenant. List Callback Failures reports asynchronous scans whose result delivery failed, which matters because a missing verdict is the one outcome a file pipeline must never read as permission to continue. The connector exposes no triggers: it does not listen for events and nothing in AttachmentAV starts a flow. Scanning is always something your flow calls at the point a file arrives, which is the correct place for it. The asynchronous actions accept a callback URL, and that callback subscribes an external endpoint of your choosing rather than creating a FlowRunner trigger. Use the trace ID with Get Async Scan Result when you want the flow to collect the verdict itself instead of waiting on a webhook.
Without FlowRunner
With FlowRunner
Use Case Scenarios
Supplier Document Intake
An accounts payable flow watches a shared mailbox for supplier invoices. Every attachment goes to Scan File From URL before the extraction agent is allowed to read a single page. Clean files continue to parsing and to the ERP write. Infected files never reach the parser: the agent records the finding name and the real file type, moves the message to a quarantine folder, and posts the sender address to the security channel so someone can decide whether this supplier's account has been compromised. The scan is one step, and it sits ahead of everything else rather than beside it.
Large File Handling on the Asynchronous Path
A partner uploads a multi gigabyte archive to an S3 bucket for a data migration. The synchronous path tops out at 10 MB, so the agent calls Scan S3 Object (Async) with a trace ID and moves on rather than holding the flow open. Later in the run, the agent calls Get Async Scan Result with that trace ID and reads the verdict. If the archive is clean, the migration proceeds. If it is infected, the agent stops the migration before a single object is copied and reports the finding with the bucket and key. Large files get the same gate as small ones instead of an exemption.
Reconciling Missing Verdicts
At the end of each intake window the agent runs List Callback Failures to find asynchronous scans whose result never made it back. For each one it retries Get Async Scan Result, which works while the result is still inside its 24 hour retention window. Anything still unresolved is not silently released. The agent assembles the list of files with no verdict, the trace IDs, and the sender for each, and routes it to the security owner as a decision rather than clearing the queue on its own. This is where a scanning pipeline usually leaks, and it is the part worth automating deliberately.
Human-in-Loop Highlight
The dangerous file in an antivirus pipeline is not the one that comes back infected. That one is easy: the agent quarantines it and the flow stops. The dangerous file is the one with no verdict at all, because a delivery failure and a clean result look identical to a flow that only checks for the string infected. When List Callback Failures returns asynchronous scans whose callback never arrived, and a retry of Get Async Scan Result comes back empty or past its 24 hour retention, the agent refuses to guess. It posts the unresolved set to the security owner in Slack: "3 files have no scan verdict. Trace IDs [ids], senders [addresses], sizes [sizes]. Rescan, hold in quarantine, or release?" The agent has already done the retry and the reconciliation. What it will not do is convert an absent answer into an approval. This is human-in-the-loop doing the job it is actually for: the agent handles every file that produced a clear result, and stops the line for the ones that did not.
Agent Capabilities
9 actionsSynchronous Scanning
3- Scan File From URL Downloads a file from a publicly accessible URL and scans it synchronously for viruses, trojans, ransomware, and other malware using the Sophos engine. Returns the scan verdict in the same call. Files up to 10 MB are supported. Use this as the first step on any inbound attachment before an extraction agent reads it.
- Scan File Content Fetches the raw bytes of a file from the given URL and uploads them directly to attachmentAV for a synchronous scan. Use this when the file bytes must be forwarded by FlowRunner rather than downloaded by attachmentAV, for example when the source is behind credentials attachmentAV does not hold. Files up to 10 MB are supported.
- Scan S3 Object Scans an object stored in an Amazon S3 bucket synchronously. The bucket must be accessible to your attachmentAV account. Objects up to 10 MB are supported. Used when files land in object storage before they land in a flow.
Asynchronous Scanning
3- Scan File From URL (Async) Downloads a file from a publicly accessible URL and scans it asynchronously, supporting files up to 5 GB. Returns immediately with an accepted trace ID. Provide a callback URL to receive the result at an endpoint of your choosing, or keep the trace ID and collect the result later with Get Async Scan Result.
- Scan S3 Object (Async) Scans an object stored in an Amazon S3 bucket asynchronously, supporting objects up to 5 GB. Returns immediately with an accepted trace ID. Used for archives, media, and migration payloads that exceed the synchronous limit.
- Get Async Scan Result Retrieves the result of an asynchronous scan by its trace ID. Results are retained for 24 hours after the scan completes. Used to collect verdicts inside the flow rather than depending on callback delivery.
Account and Reconciliation
3- Get Usage Returns current usage and quota for the API key, including remaining credits and the quota limit and period. Used before a batch so a flow can confirm it has the budget to scan every file it is about to accept.
- Get Account Info Returns identity information for the authenticated API key, including the tenant ID. Used as a connection check to confirm credentials and region resolve to the expected account.
- List Callback Failures Lists asynchronous scans whose callback delivery to the configured callback URL failed. Used to find files that are sitting in the pipeline with no verdict, which is the gap that turns a scanning step into a formality.
Frequently Asked Questions
What can FlowRunner do with AttachmentAV?
FlowRunner agents can run Scan File From URL, Scan File Content, and Scan S3 Object in AttachmentAV, plus 6 more actions.
Does connecting AttachmentAV to FlowRunner require OAuth?
No. AttachmentAV connects to FlowRunner with an API key, no OAuth flow required.
Can AttachmentAV trigger a FlowRunner workflow automatically?
AttachmentAV doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.
Start building with AttachmentAV
$100 in credits. No card required. Connect in minutes.