{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/cloudmersive/json-schema/cloudmersive-multi-threat-text-response-schema.json",
  "title": "MultiThreatTextResponse",
  "description": "Response from a multi-threat text scan",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudmersive-multithreatscan-api-openapi.yml#/components/schemas/MultiThreatTextResponse",
  "type": "object",
  "properties": {
    "ContainedDetectionOnlyFindings": {
      "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.",
      "type": "boolean"
    },
    "DetectionPending": {
      "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.",
      "type": "boolean"
    },
    "ScanCorrelationId": {
      "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.",
      "type": "string"
    },
    "Successful": {
      "description": "True if the scan completed successfully",
      "type": "boolean"
    },
    "CleanResult": {
      "description": "True if all enabled scans returned clean results",
      "type": "boolean"
    },
    "ScanResults": {
      "$ref": "#/$defs/TextScanResults"
    },
    "CustomPolicyID": {
      "description": "Echo of the CustomPolicyID supplied in the request. Omitted when no custom policy was requested.",
      "type": "string"
    },
    "CustomPolicyApplied": {
      "description": "True when the requested custom policy's settings were applied to this scan; false when a policy was requested but could not be applied (the scan ran on the request's inline settings). Omitted when no custom policy was requested.",
      "type": "boolean"
    },
    "ProvenanceURL": {
      "description": "Fully-qualified URL or path of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceUser": {
      "description": "User who last modified or created the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceCreationDate": {
      "format": "date-time",
      "description": "Creation date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceModifiedDate": {
      "format": "date-time",
      "description": "Last-modified date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceZoneIdentifier": {
      "description": "Mark of the Web (Zone.Identifier) information for the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceTransactionID": {
      "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceClientIP": {
      "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    }
  },
  "additionalProperties": false,
  "$defs": {
    "DlpDetectionResult": {
      "description": "DLP (PII/PHI) detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no PII/PHI was detected",
          "type": "boolean"
        },
        "ContainsEmailAddresses": {
          "description": "Contains email addresses",
          "type": "boolean"
        },
        "ContainsPhoneNumbers": {
          "description": "Contains phone numbers",
          "type": "boolean"
        },
        "ContainsStreetAddresses": {
          "description": "Contains street addresses",
          "type": "boolean"
        },
        "ContainsPersonNames": {
          "description": "Contains person names",
          "type": "boolean"
        },
        "ContainsBirthDates": {
          "description": "Contains birth dates",
          "type": "boolean"
        },
        "ContainsPassportNumbers": {
          "description": "Contains passport numbers",
          "type": "boolean"
        },
        "ContainsDriversLicenses": {
          "description": "Contains driver's licenses",
          "type": "boolean"
        },
        "ContainsSocialSecurityNumbers": {
          "description": "Contains Social Security numbers",
          "type": "boolean"
        },
        "ContainsTaxpayerIds": {
          "description": "Contains taxpayer IDs",
          "type": "boolean"
        },
        "ContainsCreditCardNumbers": {
          "description": "Contains credit card numbers",
          "type": "boolean"
        },
        "ContainsBankAccountNumbers": {
          "description": "Contains bank account numbers",
          "type": "boolean"
        },
        "ContainsIbans": {
          "description": "Contains IBANs",
          "type": "boolean"
        },
        "ContainsHealthInsuranceNumbers": {
          "description": "Contains health insurance numbers",
          "type": "boolean"
        },
        "ContainsBearerTokens": {
          "description": "Contains bearer tokens",
          "type": "boolean"
        },
        "ContainsHttpCookies": {
          "description": "Contains HTTP cookies",
          "type": "boolean"
        },
        "ContainsPrivateKeys": {
          "description": "Contains private keys",
          "type": "boolean"
        },
        "ContainsCredentials": {
          "description": "Contains credentials",
          "type": "boolean"
        },
        "ContainsDeepWebUrls": {
          "description": "Contains deep web URLs",
          "type": "boolean"
        },
        "ContainsSourceCode": {
          "description": "Contains source code",
          "type": "boolean"
        },
        "ContainsIpAddresses": {
          "description": "Contains IP addresses",
          "type": "boolean"
        },
        "ContainsMacAddresses": {
          "description": "Contains MAC addresses",
          "type": "boolean"
        },
        "ContainsHealthInsuranceMemberIds": {
          "description": "Contains health insurance member IDs",
          "type": "boolean"
        },
        "ContainsInjuryDiseaseReferences": {
          "description": "Contains injury/disease references",
          "type": "boolean"
        },
        "ContainsTreatmentTypeDescriptions": {
          "description": "Contains treatment type descriptions",
          "type": "boolean"
        },
        "ContainsMedicalTreatmentDates": {
          "description": "Contains medical treatment dates",
          "type": "boolean"
        },
        "ContainsHealthPlanBeneficiaryNumbers": {
          "description": "Contains health plan beneficiary numbers",
          "type": "boolean"
        },
        "ContainsTreatmentPayments": {
          "description": "Contains treatment payments",
          "type": "boolean"
        },
        "ContainsVehicleIds": {
          "description": "Contains vehicle IDs",
          "type": "boolean"
        },
        "ContainsDeviceIds": {
          "description": "Contains device IDs",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PhishingDetectionTextResult": {
      "description": "Phishing detection result for text scanning",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no phishing was detected",
          "type": "boolean"
        },
        "ContainsPhishing": {
          "description": "Text contains phishing",
          "type": "boolean"
        },
        "ContainsUnsolicitedSales": {
          "description": "Text contains unsolicited sales",
          "type": "boolean"
        },
        "ContainsPromotionalContent": {
          "description": "Text contains promotional content",
          "type": "boolean"
        },
        "ContainsWebUrls": {
          "description": "Text contains web URLs",
          "type": "boolean"
        },
        "ContainsPhoneNumbers": {
          "description": "Text contains phone numbers",
          "type": "boolean"
        },
        "ContainsEmailAddresses": {
          "description": "Text contains email addresses",
          "type": "boolean"
        },
        "ConfidenceLevel": {
          "format": "double",
          "description": "Confidence level (0.0 to 1.0)",
          "type": "number"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "UnsafeUrls": {
          "description": "List of unsafe URLs found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/UnsafeUrlInfo"
          }
        }
      },
      "additionalProperties": false
    },
    "PolicyEnforcementResult": {
      "description": "Policy enforcement result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no policy violations were found",
          "type": "boolean"
        },
        "RiskScore": {
          "format": "double",
          "description": "Overall risk score (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolations": {
          "description": "List of rule violations found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/PolicyRuleViolation"
          }
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PolicyRuleViolation": {
      "description": "A single policy rule violation",
      "type": "object",
      "properties": {
        "RuleId": {
          "description": "ID of the violated rule",
          "type": "string"
        },
        "RuleViolationRiskScore": {
          "format": "double",
          "description": "Risk score for this violation (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolationRationale": {
          "description": "Rationale for the violation",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PromptInjectionDetectionResult": {
      "description": "Prompt injection detection result. For URL scans the service downloads the URL, extracts\nreadable text (HTML via HtmlAgilityPack, otherwise sniffed plain text; binary content is\nskipped) and scans it; for text scans the submitted text is scanned directly. Both run\nthrough the Prompt Injection child API.",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no prompt injection was detected",
          "type": "boolean"
        },
        "ContainedPromptInjection": {
          "description": "The extracted content contained a prompt injection attack (inverse of CleanResult)",
          "type": "boolean"
        },
        "RiskLevel": {
          "description": "Risk level of the scanned text: Low, Medium, High, or Critical.",
          "type": "string"
        },
        "RiskScore": {
          "format": "double",
          "description": "Classifier confidence that the text contains a prompt injection, 0.0 (safe) to 1.0 (injection).",
          "type": "number"
        },
        "Skipped": {
          "description": "Scan was skipped (e.g. SSRF threat detected, binary content, or no readable text).",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "SpamDetectionResult": {
      "description": "Spam detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no spam was detected",
          "type": "boolean"
        },
        "SpamRiskLevel": {
          "format": "double",
          "description": "Spam risk level (0.0 to 1.0)",
          "type": "number"
        },
        "ContainsSpam": {
          "description": "Content contains spam",
          "type": "boolean"
        },
        "ContainsUnsolicitedSales": {
          "description": "Content contains unsolicited sales",
          "type": "boolean"
        },
        "ContainsPromotionalContent": {
          "description": "Content contains promotional material",
          "type": "boolean"
        },
        "ContainsPhishingAttempt": {
          "description": "Content contains phishing attempt",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "TextScanResults": {
      "description": "Individual scan results for a text scan",
      "type": "object",
      "properties": {
        "VirusScan": {
          "$ref": "#/$defs/VirusScanResult"
        },
        "PhishingDetection": {
          "$ref": "#/$defs/PhishingDetectionTextResult"
        },
        "SpamDetection": {
          "$ref": "#/$defs/SpamDetectionResult"
        },
        "DlpDetection": {
          "$ref": "#/$defs/DlpDetectionResult"
        },
        "PolicyEnforcement": {
          "$ref": "#/$defs/PolicyEnforcementResult"
        },
        "PromptInjectionDetection": {
          "$ref": "#/$defs/PromptInjectionDetectionResult"
        }
      },
      "additionalProperties": false
    },
    "UnsafeUrlInfo": {
      "description": "Information about an unsafe URL",
      "type": "object",
      "properties": {
        "Url": {
          "description": "The URL",
          "type": "string"
        },
        "CleanResult": {
          "description": "True if URL is clean",
          "type": "boolean"
        },
        "IsSsrfThreat": {
          "description": "URL is an SSRF threat",
          "type": "boolean"
        },
        "ContainsPhishing": {
          "description": "URL contains phishing",
          "type": "boolean"
        },
        "ThreatTypes": {
          "description": "Threat classifications for this URL. Possible values: Phishing, Malware, UnwantedSoftware, Unsafe, SSRF, Phishing Test URL. Populated by the Basic pipeline (Basic mode, or the Advanced-mode local pre-check); null when the verdict came from the remote Advanced analysis.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false
    },
    "VirusFound": {
      "description": "Virus found detail",
      "type": "object",
      "properties": {
        "FileName": {
          "description": "Name of the file containing the virus",
          "type": "string"
        },
        "VirusName": {
          "description": "Name of the virus",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "VirusScanContentInfo": {
      "description": "Additional content information from virus scan",
      "type": "object",
      "properties": {
        "ContainsJSON": {
          "description": "File contains JSON content",
          "type": "boolean"
        },
        "ContainsXML": {
          "description": "File contains XML content",
          "type": "boolean"
        },
        "ContainsImage": {
          "description": "File contains image content",
          "type": "boolean"
        },
        "Hash_SHA1": {
          "description": "SHA-1 hash of the file",
          "type": "string"
        },
        "RelevantSubfileName": {
          "description": "Name of relevant subfile",
          "type": "string"
        },
        "RelevantSubfileHash_SHA1": {
          "description": "SHA-1 hash of relevant subfile",
          "type": "string"
        },
        "IsAuthenticodeSigned": {
          "description": "File has Authenticode signature",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "VirusScanResult": {
      "description": "Virus scan result",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no threats were found",
          "type": "boolean"
        },
        "ContainsExecutable": {
          "description": "Contains executable content",
          "type": "boolean"
        },
        "ContainsInvalidFile": {
          "description": "Contains invalid file structure",
          "type": "boolean"
        },
        "ContainsScript": {
          "description": "Contains script content",
          "type": "boolean"
        },
        "ContainsPasswordProtectedFile": {
          "description": "File is password-protected",
          "type": "boolean"
        },
        "ContainsRestrictedFileFormat": {
          "description": "File format is restricted",
          "type": "boolean"
        },
        "ContainsMacros": {
          "description": "Contains macro code",
          "type": "boolean"
        },
        "ContainsXmlExternalEntities": {
          "description": "Contains XML external entities",
          "type": "boolean"
        },
        "ContainsInsecureDeserialization": {
          "description": "Contains insecure deserialization",
          "type": "boolean"
        },
        "ContainsHtml": {
          "description": "Contains HTML content",
          "type": "boolean"
        },
        "ContainsUnsafeArchive": {
          "description": "Contains unsafe archive structure",
          "type": "boolean"
        },
        "ContainsOleEmbeddedObject": {
          "description": "Contains OLE embedded objects",
          "type": "boolean"
        },
        "ContainsUnwantedAction": {
          "description": "Contains unwanted actions",
          "type": "boolean"
        },
        "VerifiedFileFormat": {
          "description": "Content-verified file format",
          "type": "string"
        },
        "FoundViruses": {
          "description": "List of viruses found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/VirusFound"
          }
        },
        "ContentInformation": {
          "$ref": "#/$defs/VirusScanContentInfo"
        },
        "AuthenticodeSigningLevel": {
          "description": "The Authenticode signing level this API computed for the file: \"None\" or \"Signed\". Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content. Null otherwise.",
          "type": "string"
        },
        "AllowedByAuthenticode": {
          "description": "True only when the Authenticode override admitted an executable that would otherwise have been blocked. False when the file was allowed because AllowExecutables was already true — the two cases are otherwise indistinguishable to a caller who cannot see the effective policy. Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content; omitted otherwise, so an off toggle leaves the response unchanged.",
          "type": "boolean"
        },
        "ErrorMessage": {
          "description": "Error message if the scan failed",
          "type": "string"
        }
      },
      "additionalProperties": false
    }
  }
}