{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/cloudmersive/json-schema/cloudmersive-multi-threat-file-response-schema.json",
  "title": "MultiThreatFileResponse",
  "description": "Response from a multi-threat file scan",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudmersive-multithreatscan-api-openapi.yml#/components/schemas/MultiThreatFileResponse",
  "type": "object",
  "properties": {
    "ContainedDetectionOnlyFindings": {
      "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.",
      "type": "boolean"
    },
    "DetectionPending": {
      "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.",
      "type": "boolean"
    },
    "ScanCorrelationId": {
      "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.",
      "type": "string"
    },
    "Successful": {
      "description": "True if the scan completed successfully",
      "type": "boolean"
    },
    "CleanResult": {
      "description": "True if all enabled scans returned clean results",
      "type": "boolean"
    },
    "VerifiedFileFormat": {
      "description": "Content-verified file format from virus scan",
      "type": "string"
    },
    "IsArchive": {
      "description": "True if the scanned file was detected as an archive (e.g. .zip, .rar, .7z, .tar, .gz) and its contents were scanned individually.",
      "type": "boolean"
    },
    "ArchiveContents": {
      "description": "For archives, the per-member scan results. Each member is scanned for all enabled threat types individually; the archive container itself is not sent to any scan API. Null for non-archive files.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/ArchiveEntryScanResult"
      }
    },
    "ScanResults": {
      "$ref": "#/$defs/FileScanResults"
    },
    "Errors": {
      "description": "Non-fatal conditions encountered during scanning (e.g. scan limits reached). The scan still succeeded; these flag reduced coverage or partial results. Null when none.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/ScanError"
      }
    },
    "CustomPolicyID": {
      "description": "Echo of the CustomPolicyID supplied in the request config. Omitted when no custom policy was requested.",
      "type": "string"
    },
    "CustomPolicyApplied": {
      "description": "True when the requested custom policy's settings were retrieved and applied; false when a policy was requested but could not be applied (the request-local settings were used instead). Omitted when no custom policy was requested.",
      "type": "boolean"
    },
    "ProvenanceURL": {
      "description": "Fully-qualified URL or path of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceUser": {
      "description": "User who last modified or created the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceCreationDate": {
      "format": "date-time",
      "description": "Creation date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceModifiedDate": {
      "format": "date-time",
      "description": "Last-modified date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceZoneIdentifier": {
      "description": "Mark of the Web (Zone.Identifier) information for the source file, echoed from the provenance information supplied in the request config; may include the URL the file was originally downloaded from. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceTransactionID": {
      "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceClientIP": {
      "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
      "type": "string"
    },
    "SanitizedFile": {
      "format": "byte",
      "description": "Sanitized (CDR-processed) copy of the input file, base64-encoded. Present when Content Disarm and Reconstruction is enabled in the scan configuration and produced output for this scan; omitted otherwise (including when the file's format or detected threat is not suitable for sanitization). Note the sanitized copy may be a different file format than the input: HTML inputs are returned as PDF, HEIC as JPG, ODS/ODP as XLSX/PPTX, and some conversions fall back to PDF — detect the actual format from the returned content.",
      "type": "string"
    }
  },
  "additionalProperties": false,
  "$defs": {
    "AiContentDetectionResult": {
      "description": "AI content detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no AI-generated content was detected",
          "type": "boolean"
        },
        "ContainsAiGeneratedContent": {
          "description": "Content appears to be AI-generated",
          "type": "boolean"
        },
        "AiConfidenceLevel": {
          "format": "double",
          "description": "Confidence level of AI content detection (0.0 to 1.0)",
          "type": "number"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        },
        "Verdict": {
          "description": "Categorical assessment of whether the file appears AI-generated based on its\nembedded metadata. One of: NoDeterministicAiMetadataFound, VerifiedAiGenerated,\nVerifiedAiEditedOrComposite, LikelyAiGenerated, LikelyAiEditedOrComposite,\nPossibleAiGenerated, ConflictingSignals, MetadataUnavailableOrUnreadable,\nUnsupportedFileType.",
          "type": "string"
        },
        "Provider": {
          "description": "AI provider name (for example, \"OpenAI\", \"Adobe\", \"Google\", \"Microsoft\").\nEmpty when the metadata does not identify a provider.",
          "type": "string"
        },
        "Generator": {
          "description": "AI tool or product name (for example, \"ChatGPT\", \"Adobe Firefly\", \"Stable\nDiffusion\"). Empty when the metadata does not identify a specific tool.",
          "type": "string"
        },
        "Warnings": {
          "description": "Non-fatal warnings produced during analysis, intended for diagnostic display.\nEmpty when no warnings were produced.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "DetectedFileType": {
          "description": "File type detected from the file's content (for example, \"jpeg\", \"png\", \"pdf\").\nMay differ from the file's name extension when the content was misnamed.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "ArchiveEntryScanResult": {
      "description": "Scan result for one member of an archive",
      "type": "object",
      "properties": {
        "FileName": {
          "description": "Path of the member within the archive.",
          "type": "string"
        },
        "FileSize": {
          "format": "int64",
          "description": "Uncompressed size of the member in bytes.",
          "type": "integer"
        },
        "Skipped": {
          "description": "True if this member was not scanned (e.g. a directory entry, an encrypted entry, or an extraction failure).",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the member was skipped, if applicable.",
          "type": "string"
        },
        "Result": {
          "$ref": "#/$defs/MultiThreatFileResponse"
        }
      },
      "additionalProperties": false
    },
    "DlpDetectionResult": {
      "description": "DLP (PII/PHI) detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no PII/PHI was detected",
          "type": "boolean"
        },
        "ContainsEmailAddresses": {
          "description": "Contains email addresses",
          "type": "boolean"
        },
        "ContainsPhoneNumbers": {
          "description": "Contains phone numbers",
          "type": "boolean"
        },
        "ContainsStreetAddresses": {
          "description": "Contains street addresses",
          "type": "boolean"
        },
        "ContainsPersonNames": {
          "description": "Contains person names",
          "type": "boolean"
        },
        "ContainsBirthDates": {
          "description": "Contains birth dates",
          "type": "boolean"
        },
        "ContainsPassportNumbers": {
          "description": "Contains passport numbers",
          "type": "boolean"
        },
        "ContainsDriversLicenses": {
          "description": "Contains driver's licenses",
          "type": "boolean"
        },
        "ContainsSocialSecurityNumbers": {
          "description": "Contains Social Security numbers",
          "type": "boolean"
        },
        "ContainsTaxpayerIds": {
          "description": "Contains taxpayer IDs",
          "type": "boolean"
        },
        "ContainsCreditCardNumbers": {
          "description": "Contains credit card numbers",
          "type": "boolean"
        },
        "ContainsBankAccountNumbers": {
          "description": "Contains bank account numbers",
          "type": "boolean"
        },
        "ContainsIbans": {
          "description": "Contains IBANs",
          "type": "boolean"
        },
        "ContainsHealthInsuranceNumbers": {
          "description": "Contains health insurance numbers",
          "type": "boolean"
        },
        "ContainsBearerTokens": {
          "description": "Contains bearer tokens",
          "type": "boolean"
        },
        "ContainsHttpCookies": {
          "description": "Contains HTTP cookies",
          "type": "boolean"
        },
        "ContainsPrivateKeys": {
          "description": "Contains private keys",
          "type": "boolean"
        },
        "ContainsCredentials": {
          "description": "Contains credentials",
          "type": "boolean"
        },
        "ContainsDeepWebUrls": {
          "description": "Contains deep web URLs",
          "type": "boolean"
        },
        "ContainsSourceCode": {
          "description": "Contains source code",
          "type": "boolean"
        },
        "ContainsIpAddresses": {
          "description": "Contains IP addresses",
          "type": "boolean"
        },
        "ContainsMacAddresses": {
          "description": "Contains MAC addresses",
          "type": "boolean"
        },
        "ContainsHealthInsuranceMemberIds": {
          "description": "Contains health insurance member IDs",
          "type": "boolean"
        },
        "ContainsInjuryDiseaseReferences": {
          "description": "Contains injury/disease references",
          "type": "boolean"
        },
        "ContainsTreatmentTypeDescriptions": {
          "description": "Contains treatment type descriptions",
          "type": "boolean"
        },
        "ContainsMedicalTreatmentDates": {
          "description": "Contains medical treatment dates",
          "type": "boolean"
        },
        "ContainsHealthPlanBeneficiaryNumbers": {
          "description": "Contains health plan beneficiary numbers",
          "type": "boolean"
        },
        "ContainsTreatmentPayments": {
          "description": "Contains treatment payments",
          "type": "boolean"
        },
        "ContainsVehicleIds": {
          "description": "Contains vehicle IDs",
          "type": "boolean"
        },
        "ContainsDeviceIds": {
          "description": "Contains device IDs",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "FileScanResults": {
      "description": "Individual scan results for a file scan",
      "type": "object",
      "properties": {
        "VirusScan": {
          "$ref": "#/$defs/VirusScanResult"
        },
        "NsfwDetection": {
          "$ref": "#/$defs/NsfwDetectionResult"
        },
        "AiContentDetection": {
          "$ref": "#/$defs/AiContentDetectionResult"
        },
        "FraudDetection": {
          "$ref": "#/$defs/FraudDetectionResult"
        },
        "PhishingDetection": {
          "$ref": "#/$defs/PhishingDetectionFileResult"
        },
        "SpamDetection": {
          "$ref": "#/$defs/SpamDetectionResult"
        },
        "DlpDetection": {
          "$ref": "#/$defs/DlpDetectionResult"
        },
        "PolicyEnforcement": {
          "$ref": "#/$defs/PolicyEnforcementResult"
        }
      },
      "additionalProperties": false
    },
    "FraudDetectionResult": {
      "description": "Fraud detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no fraud was detected",
          "type": "boolean"
        },
        "FraudRiskLevel": {
          "format": "double",
          "description": "Fraud risk level (0.0 to 1.0)",
          "type": "number"
        },
        "ContainsFinancialLiability": {
          "description": "Document contains financial liability language",
          "type": "boolean"
        },
        "ContainsSensitiveInformationCollection": {
          "description": "Document collects sensitive information",
          "type": "boolean"
        },
        "ContainsAssetTransfer": {
          "description": "Document involves asset transfer",
          "type": "boolean"
        },
        "ContainsPurchaseAgreement": {
          "description": "Document is a purchase agreement",
          "type": "boolean"
        },
        "ContainsEmploymentAgreement": {
          "description": "Document is an employment agreement",
          "type": "boolean"
        },
        "ContainsExpiredDocument": {
          "description": "Document is expired",
          "type": "boolean"
        },
        "ContainsAiGeneratedContent": {
          "description": "Document contains AI-generated content",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "DocumentClass": {
          "description": "Document class/type",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "MultiThreatFileResponse": {
      "description": "Response from a multi-threat file scan",
      "type": "object",
      "properties": {
        "ContainedDetectionOnlyFindings": {
          "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.",
          "type": "boolean"
        },
        "DetectionPending": {
          "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "ScanCorrelationId": {
          "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.",
          "type": "string"
        },
        "Successful": {
          "description": "True if the scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if all enabled scans returned clean results",
          "type": "boolean"
        },
        "VerifiedFileFormat": {
          "description": "Content-verified file format from virus scan",
          "type": "string"
        },
        "IsArchive": {
          "description": "True if the scanned file was detected as an archive (e.g. .zip, .rar, .7z, .tar, .gz) and its contents were scanned individually.",
          "type": "boolean"
        },
        "ArchiveContents": {
          "description": "For archives, the per-member scan results. Each member is scanned for all enabled threat types individually; the archive container itself is not sent to any scan API. Null for non-archive files.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/ArchiveEntryScanResult"
          }
        },
        "ScanResults": {
          "$ref": "#/$defs/FileScanResults"
        },
        "Errors": {
          "description": "Non-fatal conditions encountered during scanning (e.g. scan limits reached). The scan still succeeded; these flag reduced coverage or partial results. Null when none.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/ScanError"
          }
        },
        "CustomPolicyID": {
          "description": "Echo of the CustomPolicyID supplied in the request config. Omitted when no custom policy was requested.",
          "type": "string"
        },
        "CustomPolicyApplied": {
          "description": "True when the requested custom policy's settings were retrieved and applied; false when a policy was requested but could not be applied (the request-local settings were used instead). Omitted when no custom policy was requested.",
          "type": "boolean"
        },
        "ProvenanceURL": {
          "description": "Fully-qualified URL or path of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceUser": {
          "description": "User who last modified or created the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceCreationDate": {
          "format": "date-time",
          "description": "Creation date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceModifiedDate": {
          "format": "date-time",
          "description": "Last-modified date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceZoneIdentifier": {
          "description": "Mark of the Web (Zone.Identifier) information for the source file, echoed from the provenance information supplied in the request config; may include the URL the file was originally downloaded from. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceTransactionID": {
          "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "ProvenanceClientIP": {
          "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request config. Omitted when unavailable.",
          "type": "string"
        },
        "SanitizedFile": {
          "format": "byte",
          "description": "Sanitized (CDR-processed) copy of the input file, base64-encoded. Present when Content Disarm and Reconstruction is enabled in the scan configuration and produced output for this scan; omitted otherwise (including when the file's format or detected threat is not suitable for sanitization). Note the sanitized copy may be a different file format than the input: HTML inputs are returned as PDF, HEIC as JPG, ODS/ODP as XLSX/PPTX, and some conversions fall back to PDF — detect the actual format from the returned content.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "NsfwDetectionResult": {
      "description": "NSFW detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no NSFW content was found",
          "type": "boolean"
        },
        "Mode": {
          "description": "Classification mode that ran: \"Basic\" or \"Advanced\". Omitted when the scan did not run.",
          "type": "string"
        },
        "ContainsNudity": {
          "description": "Image contains nudity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsGraphicViolence": {
          "description": "Image contains graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsNonGraphicViolence": {
          "description": "Image contains non-graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsSelfHarm": {
          "description": "Image contains self-harm content. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsHate": {
          "description": "Image contains hate content. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsPotentialIllegalActivity": {
          "description": "Image contains potential illegal activity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsMedicalImagery": {
          "description": "Image contains medical imagery. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsProfanity": {
          "description": "Image contains profanity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "Score": {
          "format": "double",
          "description": "NSFW score (0.0 to 1.0)",
          "type": "number"
        },
        "ClassificationOutcome": {
          "description": "Classification outcome",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped (unsupported format)",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PhishingDetectionFileResult": {
      "description": "Phishing detection result for file scanning",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no phishing was detected",
          "type": "boolean"
        },
        "ContainsPhishing": {
          "description": "File contains phishing",
          "type": "boolean"
        },
        "UnsafeUrls": {
          "description": "List of unsafe URLs found in the file. Populated by the Basic pipeline (Basic mode, the Advanced-mode local pre-check, or the QR-code supplement); null when none were flagged.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/UnsafeUrlInfo"
          }
        },
        "ContainsPhishingQrCode": {
          "description": "QR-code phishing verdict. True: a URL decoded from an embedded QR code was classified as phishing. False: QR scanning ran and found no phishing QR codes. Null: QR scanning did not run (ScanQrCodes disabled, unsupported file format, or the QR stage was skipped).",
          "type": "boolean"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PolicyEnforcementResult": {
      "description": "Policy enforcement result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no policy violations were found",
          "type": "boolean"
        },
        "RiskScore": {
          "format": "double",
          "description": "Overall risk score (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolations": {
          "description": "List of rule violations found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/PolicyRuleViolation"
          }
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PolicyRuleViolation": {
      "description": "A single policy rule violation",
      "type": "object",
      "properties": {
        "RuleId": {
          "description": "ID of the violated rule",
          "type": "string"
        },
        "RuleViolationRiskScore": {
          "format": "double",
          "description": "Risk score for this violation (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolationRationale": {
          "description": "Rationale for the violation",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "ScanError": {
      "description": "A non-fatal condition encountered during scanning that reduced coverage or\nproduced a partial result (the scan itself still succeeded).",
      "type": "object",
      "properties": {
        "Code": {
          "description": "Stable machine-readable code, e.g. \"ScanLimitReached\".",
          "type": "string"
        },
        "Detail": {
          "description": "Human-readable detail.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "SpamDetectionResult": {
      "description": "Spam detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no spam was detected",
          "type": "boolean"
        },
        "SpamRiskLevel": {
          "format": "double",
          "description": "Spam risk level (0.0 to 1.0)",
          "type": "number"
        },
        "ContainsSpam": {
          "description": "Content contains spam",
          "type": "boolean"
        },
        "ContainsUnsolicitedSales": {
          "description": "Content contains unsolicited sales",
          "type": "boolean"
        },
        "ContainsPromotionalContent": {
          "description": "Content contains promotional material",
          "type": "boolean"
        },
        "ContainsPhishingAttempt": {
          "description": "Content contains phishing attempt",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "UnsafeUrlInfo": {
      "description": "Information about an unsafe URL",
      "type": "object",
      "properties": {
        "Url": {
          "description": "The URL",
          "type": "string"
        },
        "CleanResult": {
          "description": "True if URL is clean",
          "type": "boolean"
        },
        "IsSsrfThreat": {
          "description": "URL is an SSRF threat",
          "type": "boolean"
        },
        "ContainsPhishing": {
          "description": "URL contains phishing",
          "type": "boolean"
        },
        "ThreatTypes": {
          "description": "Threat classifications for this URL. Possible values: Phishing, Malware, UnwantedSoftware, Unsafe, SSRF, Phishing Test URL. Populated by the Basic pipeline (Basic mode, or the Advanced-mode local pre-check); null when the verdict came from the remote Advanced analysis.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false
    },
    "VirusFound": {
      "description": "Virus found detail",
      "type": "object",
      "properties": {
        "FileName": {
          "description": "Name of the file containing the virus",
          "type": "string"
        },
        "VirusName": {
          "description": "Name of the virus",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "VirusScanContentInfo": {
      "description": "Additional content information from virus scan",
      "type": "object",
      "properties": {
        "ContainsJSON": {
          "description": "File contains JSON content",
          "type": "boolean"
        },
        "ContainsXML": {
          "description": "File contains XML content",
          "type": "boolean"
        },
        "ContainsImage": {
          "description": "File contains image content",
          "type": "boolean"
        },
        "Hash_SHA1": {
          "description": "SHA-1 hash of the file",
          "type": "string"
        },
        "RelevantSubfileName": {
          "description": "Name of relevant subfile",
          "type": "string"
        },
        "RelevantSubfileHash_SHA1": {
          "description": "SHA-1 hash of relevant subfile",
          "type": "string"
        },
        "IsAuthenticodeSigned": {
          "description": "File has Authenticode signature",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "VirusScanResult": {
      "description": "Virus scan result",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no threats were found",
          "type": "boolean"
        },
        "ContainsExecutable": {
          "description": "Contains executable content",
          "type": "boolean"
        },
        "ContainsInvalidFile": {
          "description": "Contains invalid file structure",
          "type": "boolean"
        },
        "ContainsScript": {
          "description": "Contains script content",
          "type": "boolean"
        },
        "ContainsPasswordProtectedFile": {
          "description": "File is password-protected",
          "type": "boolean"
        },
        "ContainsRestrictedFileFormat": {
          "description": "File format is restricted",
          "type": "boolean"
        },
        "ContainsMacros": {
          "description": "Contains macro code",
          "type": "boolean"
        },
        "ContainsXmlExternalEntities": {
          "description": "Contains XML external entities",
          "type": "boolean"
        },
        "ContainsInsecureDeserialization": {
          "description": "Contains insecure deserialization",
          "type": "boolean"
        },
        "ContainsHtml": {
          "description": "Contains HTML content",
          "type": "boolean"
        },
        "ContainsUnsafeArchive": {
          "description": "Contains unsafe archive structure",
          "type": "boolean"
        },
        "ContainsOleEmbeddedObject": {
          "description": "Contains OLE embedded objects",
          "type": "boolean"
        },
        "ContainsUnwantedAction": {
          "description": "Contains unwanted actions",
          "type": "boolean"
        },
        "VerifiedFileFormat": {
          "description": "Content-verified file format",
          "type": "string"
        },
        "FoundViruses": {
          "description": "List of viruses found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/VirusFound"
          }
        },
        "ContentInformation": {
          "$ref": "#/$defs/VirusScanContentInfo"
        },
        "AuthenticodeSigningLevel": {
          "description": "The Authenticode signing level this API computed for the file: \"None\" or \"Signed\". Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content. Null otherwise.",
          "type": "string"
        },
        "AllowedByAuthenticode": {
          "description": "True only when the Authenticode override admitted an executable that would otherwise have been blocked. False when the file was allowed because AllowExecutables was already true — the two cases are otherwise indistinguishable to a caller who cannot see the effective policy. Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content; omitted otherwise, so an off toggle leaves the response unchanged.",
          "type": "boolean"
        },
        "ErrorMessage": {
          "description": "Error message if the scan failed",
          "type": "string"
        }
      },
      "additionalProperties": false
    }
  }
}