{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/cloudmersive/json-schema/cloudmersive-multi-threat-url-request-schema.json",
  "title": "MultiThreatUrlRequest",
  "description": "Request to scan a URL for multiple threat types",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudmersive-multithreatscan-api-openapi.yml#/components/schemas/MultiThreatUrlRequest",
  "type": "object",
  "properties": {
    "Url": {
      "description": "The URL to scan (must include http:// or https://)",
      "type": "string"
    },
    "UrlSettings": {
      "$ref": "#/$defs/UrlSettings"
    },
    "VirusScan": {
      "$ref": "#/$defs/UrlVirusScanConfig"
    },
    "SsrfDetection": {
      "$ref": "#/$defs/SsrfDetectionConfig"
    },
    "PhishingDetection": {
      "$ref": "#/$defs/UrlPhishingDetectionConfig"
    },
    "PromptInjectionDetection": {
      "$ref": "#/$defs/PromptInjectionDetectionConfig"
    },
    "PolicyEnforcement": {
      "$ref": "#/$defs/PolicyEnforcementConfig"
    },
    "ContentScanning": {
      "$ref": "#/$defs/ContentScanningConfig"
    },
    "Provenance": {
      "$ref": "#/$defs/ProvenanceInfo"
    },
    "CustomPolicyID": {
      "description": "Optional ID (GUID) of a Multi-Threat URL Scanning Custom Policy created in the Cloudmersive Management Portal under Custom Policies. When set and retrievable, the policy's scan settings REPLACE the detection configurations in this request; the settings in this request are used only if the policy cannot be retrieved. Requires Managed Instance or Private Cloud.",
      "type": "string"
    }
  },
  "additionalProperties": false,
  "$defs": {
    "AdvancedVirusScanSettings": {
      "description": "Advanced Virus Scan options for URL scanning (Advanced mode). Same semantics as the\nfile endpoint's VirusScan settings.",
      "type": "object",
      "properties": {
        "AllowExecutables": {
          "description": "Allow executable files",
          "type": "boolean"
        },
        "AllowInvalidFiles": {
          "description": "Allow invalid files",
          "type": "boolean"
        },
        "AllowScripts": {
          "description": "Allow script content. Defaults to true for URL scans (web pages routinely contain script tags); set false to flag script content.",
          "type": "boolean"
        },
        "AllowPasswordProtectedFiles": {
          "description": "Allow password-protected files",
          "type": "boolean"
        },
        "AllowMacros": {
          "description": "Allow files containing macros",
          "type": "boolean"
        },
        "AllowXmlExternalEntities": {
          "description": "Allow XML external entities",
          "type": "boolean"
        },
        "AllowInsecureDeserialization": {
          "description": "Allow insecure deserialization",
          "type": "boolean"
        },
        "AllowHtml": {
          "description": "Allow HTML content",
          "type": "boolean"
        },
        "AllowUnsafeArchives": {
          "description": "Allow unsafe archives",
          "type": "boolean"
        },
        "AllowOleEmbeddedObject": {
          "description": "Allow OLE embedded objects",
          "type": "boolean"
        },
        "AllowUnwantedAction": {
          "description": "Allow unwanted actions",
          "type": "boolean"
        },
        "AllowAuthenticodeSignedExecutables": {
          "description": "Allow an executable that carries an Authenticode signature meeting MinimumAuthenticodeSigningLevel, even when AllowExecutables is false. Default false. PE files (.exe/.dll/.sys) only.",
          "type": "boolean"
        },
        "MinimumAuthenticodeSigningLevel": {
          "description": "Minimum Authenticode signing level an executable must meet to be allowed by AllowAuthenticodeSignedExecutables. Currently only \"Signed\" is supported.",
          "type": "string"
        },
        "RestrictFileTypes": {
          "description": "Restrict to specific file types (comma-separated extensions)",
          "type": "string"
        },
        "Options": {
          "description": "Comma-separated scan options",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "AiContentDetectionConfig": {
      "description": "AI-generated content detection configuration",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable AI content detection",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "ContentScanningConfig": {
      "description": "Configuration for downloading and scanning the file at a URL",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Enable content scanning",
          "type": "boolean"
        },
        "DownloadAndScan": {
          "description": "Download and scan the file at the URL",
          "type": "boolean"
        },
        "NsfwDetection": {
          "$ref": "#/$defs/NsfwDetectionConfig"
        },
        "AiContentDetection": {
          "$ref": "#/$defs/AiContentDetectionConfig"
        },
        "FraudDetection": {
          "$ref": "#/$defs/FraudDetectionConfig"
        },
        "SpamDetection": {
          "$ref": "#/$defs/SpamDetectionFileConfig"
        },
        "DlpDetection": {
          "$ref": "#/$defs/DlpDetectionFileConfig"
        },
        "PolicyEnforcement": {
          "$ref": "#/$defs/PolicyEnforcementConfig"
        }
      },
      "additionalProperties": false
    },
    "DlpDetectionFileConfig": {
      "description": "DLP detection configuration for file scanning (extends text config with RecognitionMode)",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable DLP detection",
          "type": "boolean"
        },
        "AllowEmailAddresses": {
          "description": "Allow email addresses",
          "type": "boolean"
        },
        "AllowPhoneNumbers": {
          "description": "Allow phone numbers",
          "type": "boolean"
        },
        "AllowStreetAddresses": {
          "description": "Allow street addresses",
          "type": "boolean"
        },
        "AllowPersonNames": {
          "description": "Allow person names",
          "type": "boolean"
        },
        "AllowBirthDates": {
          "description": "Allow birth dates",
          "type": "boolean"
        },
        "AllowPassportNumbers": {
          "description": "Allow passport numbers",
          "type": "boolean"
        },
        "AllowDriversLicenses": {
          "description": "Allow driver's licenses",
          "type": "boolean"
        },
        "AllowSocialSecurityNumbers": {
          "description": "Allow Social Security numbers",
          "type": "boolean"
        },
        "AllowTaxpayerIds": {
          "description": "Allow taxpayer IDs",
          "type": "boolean"
        },
        "AllowCreditCardNumbers": {
          "description": "Allow credit card numbers",
          "type": "boolean"
        },
        "AllowBankAccountNumbers": {
          "description": "Allow bank account numbers",
          "type": "boolean"
        },
        "AllowIbans": {
          "description": "Allow IBANs",
          "type": "boolean"
        },
        "AllowHealthInsuranceNumbers": {
          "description": "Allow health insurance numbers",
          "type": "boolean"
        },
        "AllowBearerTokens": {
          "description": "Allow bearer tokens",
          "type": "boolean"
        },
        "AllowHttpCookies": {
          "description": "Allow HTTP cookies",
          "type": "boolean"
        },
        "AllowPrivateKeys": {
          "description": "Allow private keys",
          "type": "boolean"
        },
        "AllowCredentials": {
          "description": "Allow credentials",
          "type": "boolean"
        },
        "AllowDeepWebUrls": {
          "description": "Allow deep web URLs",
          "type": "boolean"
        },
        "AllowSourceCode": {
          "description": "Allow source code",
          "type": "boolean"
        },
        "AllowIpAddresses": {
          "description": "Allow IP addresses",
          "type": "boolean"
        },
        "AllowMacAddresses": {
          "description": "Allow MAC addresses",
          "type": "boolean"
        },
        "AllowHealthInsuranceMemberIds": {
          "description": "Allow health insurance member IDs",
          "type": "boolean"
        },
        "AllowInjuryDiseaseReferences": {
          "description": "Allow injury/disease references",
          "type": "boolean"
        },
        "AllowTreatmentTypeDescriptions": {
          "description": "Allow treatment type descriptions",
          "type": "boolean"
        },
        "AllowMedicalTreatmentDates": {
          "description": "Allow medical treatment dates",
          "type": "boolean"
        },
        "AllowHealthPlanBeneficiaryNumbers": {
          "description": "Allow health plan beneficiary numbers",
          "type": "boolean"
        },
        "AllowTreatmentPayments": {
          "description": "Allow treatment payments",
          "type": "boolean"
        },
        "AllowVehicleIds": {
          "description": "Allow vehicle IDs",
          "type": "boolean"
        },
        "AllowDeviceIds": {
          "description": "Allow device IDs",
          "type": "boolean"
        },
        "ProvideAnalysisRationale": {
          "description": "Provide analysis rationale",
          "type": "boolean"
        },
        "CustomPolicyID": {
          "description": "Custom policy ID",
          "type": "string"
        },
        "RecognitionMode": {
          "description": "Recognition mode: Fast, FastPlus, FastMini",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "FraudDetectionConfig": {
      "description": "Fraud detection configuration",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable fraud detection",
          "type": "boolean"
        },
        "Preprocessing": {
          "description": "Preprocessing mode: Auto or None",
          "type": "string"
        },
        "ResultCrossCheck": {
          "description": "Result cross-check mode: None or Advanced",
          "type": "string"
        },
        "UserEmailAddress": {
          "description": "User email address for verification context",
          "type": "string"
        },
        "UserEmailAddressVerified": {
          "description": "Whether the user email has been verified",
          "type": "boolean"
        },
        "CustomPolicyID": {
          "description": "Optional ID (GUID) of a Fraud Detection Custom Policy created in the Cloudmersive Management Portal, applied by the underlying Fraud Detection API.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "NsfwDetectionConfig": {
      "description": "NSFW detection configuration",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable NSFW detection",
          "type": "boolean"
        },
        "Mode": {
          "description": "Classification mode: \"Basic\" (default) returns an overall NSFW risk score; \"Advanced\" additionally classifies the image into content categories (nudity, violence, self-harm, hate, illegal activity, medical imagery, profanity) with per-category allow settings.",
          "type": "string"
        },
        "MinimumScore": {
          "format": "double",
          "description": "Optional minimum NSFW score (0.0-1.0). When set, an image whose NSFW score is at or above this threshold fails the scan, in both modes. When not set: Basic mode applies a default threshold of 0.8; Advanced mode does not evaluate the score (the category allow settings decide the result).",
          "type": "number"
        },
        "AllowNudity": {
          "description": "Advanced mode only. When true, images classified as containing nudity do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowGraphicViolence": {
          "description": "Advanced mode only. When true, images classified as containing graphic violence do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowNonGraphicViolence": {
          "description": "Advanced mode only. When true, images classified as containing non-graphic violence do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowSelfHarm": {
          "description": "Advanced mode only. When true, images classified as containing self-harm content do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowHate": {
          "description": "Advanced mode only. When true, images classified as containing hate content or symbols do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowPotentialIllegalActivity": {
          "description": "Advanced mode only. When true, images classified as depicting potentially illegal activity do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowMedicalImagery": {
          "description": "Advanced mode only. When true, images classified as medical imagery do not fail the scan. Default false.",
          "type": "boolean"
        },
        "AllowProfanity": {
          "description": "Advanced mode only. When true, images classified as containing profanity do not fail the scan. Default false.",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "PolicyEnforcementConfig": {
      "description": "Policy enforcement configuration with custom rules",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable policy enforcement",
          "type": "boolean"
        },
        "Rules": {
          "description": "List of policy rules to enforce",
          "type": "array",
          "items": {
            "$ref": "#/$defs/PolicyRule"
          }
        },
        "CustomPolicyID": {
          "description": "Optional ID (GUID) of a Custom Policy created in the Cloudmersive Management Portal whose ALLOW and BLOCK rules are enforced as content rules. Used only when Rules is not supplied; when both are present, Rules takes precedence. Requires Managed Instance or Private Cloud.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PolicyRule": {
      "description": "A single policy rule",
      "type": "object",
      "properties": {
        "RuleId": {
          "description": "Unique rule identifier",
          "type": "string"
        },
        "RuleType": {
          "description": "Rule type: ALLOW or DENY",
          "type": "string"
        },
        "RuleDescription": {
          "description": "Natural language description of the policy rule",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PromptInjectionDetectionConfig": {
      "description": "Prompt injection detection configuration for a URL scan (Spec/UrlPromptInjectionDetection.md).\nDisabled by default.",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable prompt injection detection. Default false.",
          "type": "boolean"
        },
        "MinimumRiskLevel": {
          "description": "Optional additional strictness: \"Medium\" or \"High\". When set, content whose RiskLevel is at or above this level is flagged IN ADDITION to the detection service's own verdict (this setting can only add flags, never remove them). Unset uses the detection service's verdict exactly.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "ProvenanceInfo": {
      "description": "Caller-supplied provenance describing where the input file came from\n(Spec/ProvenanceFields.md §3.7). Values are opaque caller data: echoed back in the\nscan result, never validated against the source system, and never used in scan logic.\nOn the cloud-storage endpoints, source-derived provenance takes precedence\nfield-by-field; these values fill only the fields the source could not provide.",
      "type": "object",
      "properties": {
        "ProvenanceURL": {
          "description": "Fully-qualified URL or path of the source object, such as an https:// cloud storage URL or a file:// path for a network share file.",
          "type": "string"
        },
        "ProvenanceUser": {
          "description": "User who last modified or created the source object.",
          "type": "string"
        },
        "ProvenanceCreationDate": {
          "format": "date-time",
          "description": "Creation date and time (UTC) of the source object.",
          "type": "string"
        },
        "ProvenanceModifiedDate": {
          "format": "date-time",
          "description": "Last-modified date and time (UTC) of the source object.",
          "type": "string"
        },
        "ProvenanceZoneIdentifier": {
          "description": "Mark of the Web (Zone.Identifier) information for the source file, when available; may include the URL the file was originally downloaded from.",
          "type": "string"
        },
        "ProvenanceTransactionID": {
          "description": "Caller-assigned transaction identifier for the scan, useful for correlating the scan result with the caller's own systems.",
          "type": "string"
        },
        "ProvenanceClientIP": {
          "description": "IP address of the client that originated the source content or scan request.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "SpamDetectionFileConfig": {
      "description": "Spam detection configuration for file scanning",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable spam detection",
          "type": "boolean"
        },
        "Model": {
          "description": "Model to use: Normal or Advanced",
          "type": "string"
        },
        "Preprocessing": {
          "description": "Preprocessing mode: None, Compatability, Auto",
          "type": "string"
        },
        "AllowPhishing": {
          "description": "Allow phishing content",
          "type": "boolean"
        },
        "AllowUnsolicitedSales": {
          "description": "Allow unsolicited sales",
          "type": "boolean"
        },
        "AllowPromotionalContent": {
          "description": "Allow promotional content",
          "type": "boolean"
        },
        "CustomPolicyID": {
          "description": "Optional ID (GUID) of a Spam Detection Custom Policy created in the Cloudmersive Management Portal, applied by the underlying Spam Detection API.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "SsrfDetectionConfig": {
      "description": "SSRF (server-side request forgery) detection configuration for URL scanning.\nEach setting can be forced server-side via a MultiScan_Ssrf_Force_* cloud\nconfiguration key, in which case the client-supplied value is ignored.\nSee Spec/UrlScanSsrfDetectionAndAdvancedVirusScan.md.",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.",
          "type": "string"
        },
        "Enabled": {
          "description": "Enable SSRF detection. Default true. When enabled, an SSRF-flagged URL fails closed and the fetch-based scans are skipped.",
          "type": "boolean"
        },
        "AllowUnencrypted": {
          "description": "Allow unencrypted http:// URLs. Default true.",
          "type": "boolean"
        },
        "AllowSpecializedSchemes": {
          "description": "Allow schemes other than http/https (ftp:, file:, custom schemes, ...). Default false.",
          "type": "boolean"
        },
        "AllowIpLiteralHosts": {
          "description": "Allow IPv4/IPv6 literal hosts. Default false.",
          "type": "boolean"
        },
        "AllowInternalHosts": {
          "description": "Allow internal-style hostnames (localhost, metadata.google.internal, *.local, single-label hosts). Default false.",
          "type": "boolean"
        },
        "AllowCredentialsInUrl": {
          "description": "Allow credentials (user:pass@) in the URL. Default false.",
          "type": "boolean"
        },
        "AllowPrivateNetworkTargets": {
          "description": "Allow hosts whose DNS resolution includes private/reserved network addresses. Default false.",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "UrlPhishingDetectionConfig": {
      "description": "URL-specific phishing detection configuration",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Enable phishing detection",
          "type": "boolean"
        },
        "Mode": {
          "description": "Detection pipeline: \"Basic\" (local URL-reputation analysis, default) or \"Advanced\" (remote AI phishing analysis).",
          "type": "string"
        },
        "CustomPolicyID": {
          "description": "Custom policy ID. Applies to Advanced mode only.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "UrlSettings": {
      "description": "Optional top-level settings for a URL scan that apply to the request as a whole\n(as opposed to a single sub-scan). Additive; defaults preserve current behavior.\nSee Spec/UrlRecursiveLinkScan.md.",
      "type": "object",
      "properties": {
        "RecursiveLinkScanOutcomeAction": {
          "description": "Outcome action for recursive link scanning: \"Block\" (default) fails the scan when a scanned link is not clean; \"Detection\" reports it but does not affect the overall CleanResult.",
          "type": "string"
        },
        "RecursivelyScanLinks": {
          "description": "When true, after the submitted URL is scanned its landing page is parsed as HTML,\nthe links it contains are extracted, and each link is recursively scanned with the\nsame scan configuration (max link depth 1; each URL scanned at most once). If any\nscanned link is not clean, the overall result is not clean. Default false.",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "UrlVirusScanConfig": {
      "description": "URL-specific virus scan configuration",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Enable virus scanning",
          "type": "boolean"
        },
        "Mode": {
          "description": "Scan pipeline: \"Basic\" (the remote website reputation scan) or \"Advanced\" (default — after SSRF detection passes, download the URL's binary content and run the Advanced Virus Scan on the bytes). See Spec/UrlScanSsrfDetectionAndAdvancedVirusScan.md.",
          "type": "string"
        },
        "AdvancedVirusScanSettings": {
          "$ref": "#/$defs/AdvancedVirusScanSettings"
        }
      },
      "additionalProperties": false
    }
  }
}