{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/cloudmersive/json-schema/cloudmersive-multi-threat-url-response-schema.json",
  "title": "MultiThreatUrlResponse",
  "description": "Response from a multi-threat URL scan",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudmersive-multithreatscan-api-openapi.yml#/components/schemas/MultiThreatUrlResponse",
  "type": "object",
  "properties": {
    "ContainedDetectionOnlyFindings": {
      "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.",
      "type": "boolean"
    },
    "DetectionPending": {
      "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.",
      "type": "boolean"
    },
    "ScanCorrelationId": {
      "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.",
      "type": "string"
    },
    "Successful": {
      "description": "True if the scan completed successfully",
      "type": "boolean"
    },
    "CleanResult": {
      "description": "True if all enabled scans returned clean results",
      "type": "boolean"
    },
    "ScanResults": {
      "$ref": "#/$defs/UrlScanResults"
    },
    "CustomPolicyID": {
      "description": "Echo of the CustomPolicyID supplied in the request. Omitted when no custom policy was requested.",
      "type": "string"
    },
    "CustomPolicyApplied": {
      "description": "True when the requested custom policy's settings were applied to this scan; false when a policy was requested but could not be applied (the scan ran on the request's inline settings). Omitted when no custom policy was requested.",
      "type": "boolean"
    },
    "ProvenanceURL": {
      "description": "Fully-qualified URL or path of the source of the scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceUser": {
      "description": "User associated with the source of the scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceCreationDate": {
      "format": "date-time",
      "description": "Creation date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceModifiedDate": {
      "format": "date-time",
      "description": "Last-modified date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceZoneIdentifier": {
      "description": "Mark of the Web (Zone.Identifier) information for the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceTransactionID": {
      "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    },
    "ProvenanceClientIP": {
      "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.",
      "type": "string"
    }
  },
  "additionalProperties": false,
  "$defs": {
    "AiContentDetectionResult": {
      "description": "AI content detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no AI-generated content was detected",
          "type": "boolean"
        },
        "ContainsAiGeneratedContent": {
          "description": "Content appears to be AI-generated",
          "type": "boolean"
        },
        "AiConfidenceLevel": {
          "format": "double",
          "description": "Confidence level of AI content detection (0.0 to 1.0)",
          "type": "number"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        },
        "Verdict": {
          "description": "Categorical assessment of whether the file appears AI-generated based on its\nembedded metadata. One of: NoDeterministicAiMetadataFound, VerifiedAiGenerated,\nVerifiedAiEditedOrComposite, LikelyAiGenerated, LikelyAiEditedOrComposite,\nPossibleAiGenerated, ConflictingSignals, MetadataUnavailableOrUnreadable,\nUnsupportedFileType.",
          "type": "string"
        },
        "Provider": {
          "description": "AI provider name (for example, \"OpenAI\", \"Adobe\", \"Google\", \"Microsoft\").\nEmpty when the metadata does not identify a provider.",
          "type": "string"
        },
        "Generator": {
          "description": "AI tool or product name (for example, \"ChatGPT\", \"Adobe Firefly\", \"Stable\nDiffusion\"). Empty when the metadata does not identify a specific tool.",
          "type": "string"
        },
        "Warnings": {
          "description": "Non-fatal warnings produced during analysis, intended for diagnostic display.\nEmpty when no warnings were produced.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "DetectedFileType": {
          "description": "File type detected from the file's content (for example, \"jpeg\", \"png\", \"pdf\").\nMay differ from the file's name extension when the content was misnamed.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "ContentScanningResult": {
      "description": "Result of content scanning (downloading and scanning a file from URL)",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether content scanning was enabled",
          "type": "boolean"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        },
        "DownloadedFileFormat": {
          "description": "Detected file format of downloaded content",
          "type": "string"
        },
        "NsfwDetection": {
          "$ref": "#/$defs/NsfwDetectionResult"
        },
        "AiContentDetection": {
          "$ref": "#/$defs/AiContentDetectionResult"
        },
        "FraudDetection": {
          "$ref": "#/$defs/FraudDetectionResult"
        },
        "SpamDetection": {
          "$ref": "#/$defs/SpamDetectionResult"
        },
        "DlpDetection": {
          "$ref": "#/$defs/DlpDetectionResult"
        },
        "PolicyEnforcement": {
          "$ref": "#/$defs/PolicyEnforcementResult"
        }
      },
      "additionalProperties": false
    },
    "DlpDetectionResult": {
      "description": "DLP (PII/PHI) detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no PII/PHI was detected",
          "type": "boolean"
        },
        "ContainsEmailAddresses": {
          "description": "Contains email addresses",
          "type": "boolean"
        },
        "ContainsPhoneNumbers": {
          "description": "Contains phone numbers",
          "type": "boolean"
        },
        "ContainsStreetAddresses": {
          "description": "Contains street addresses",
          "type": "boolean"
        },
        "ContainsPersonNames": {
          "description": "Contains person names",
          "type": "boolean"
        },
        "ContainsBirthDates": {
          "description": "Contains birth dates",
          "type": "boolean"
        },
        "ContainsPassportNumbers": {
          "description": "Contains passport numbers",
          "type": "boolean"
        },
        "ContainsDriversLicenses": {
          "description": "Contains driver's licenses",
          "type": "boolean"
        },
        "ContainsSocialSecurityNumbers": {
          "description": "Contains Social Security numbers",
          "type": "boolean"
        },
        "ContainsTaxpayerIds": {
          "description": "Contains taxpayer IDs",
          "type": "boolean"
        },
        "ContainsCreditCardNumbers": {
          "description": "Contains credit card numbers",
          "type": "boolean"
        },
        "ContainsBankAccountNumbers": {
          "description": "Contains bank account numbers",
          "type": "boolean"
        },
        "ContainsIbans": {
          "description": "Contains IBANs",
          "type": "boolean"
        },
        "ContainsHealthInsuranceNumbers": {
          "description": "Contains health insurance numbers",
          "type": "boolean"
        },
        "ContainsBearerTokens": {
          "description": "Contains bearer tokens",
          "type": "boolean"
        },
        "ContainsHttpCookies": {
          "description": "Contains HTTP cookies",
          "type": "boolean"
        },
        "ContainsPrivateKeys": {
          "description": "Contains private keys",
          "type": "boolean"
        },
        "ContainsCredentials": {
          "description": "Contains credentials",
          "type": "boolean"
        },
        "ContainsDeepWebUrls": {
          "description": "Contains deep web URLs",
          "type": "boolean"
        },
        "ContainsSourceCode": {
          "description": "Contains source code",
          "type": "boolean"
        },
        "ContainsIpAddresses": {
          "description": "Contains IP addresses",
          "type": "boolean"
        },
        "ContainsMacAddresses": {
          "description": "Contains MAC addresses",
          "type": "boolean"
        },
        "ContainsHealthInsuranceMemberIds": {
          "description": "Contains health insurance member IDs",
          "type": "boolean"
        },
        "ContainsInjuryDiseaseReferences": {
          "description": "Contains injury/disease references",
          "type": "boolean"
        },
        "ContainsTreatmentTypeDescriptions": {
          "description": "Contains treatment type descriptions",
          "type": "boolean"
        },
        "ContainsMedicalTreatmentDates": {
          "description": "Contains medical treatment dates",
          "type": "boolean"
        },
        "ContainsHealthPlanBeneficiaryNumbers": {
          "description": "Contains health plan beneficiary numbers",
          "type": "boolean"
        },
        "ContainsTreatmentPayments": {
          "description": "Contains treatment payments",
          "type": "boolean"
        },
        "ContainsVehicleIds": {
          "description": "Contains vehicle IDs",
          "type": "boolean"
        },
        "ContainsDeviceIds": {
          "description": "Contains device IDs",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "FraudDetectionResult": {
      "description": "Fraud detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no fraud was detected",
          "type": "boolean"
        },
        "FraudRiskLevel": {
          "format": "double",
          "description": "Fraud risk level (0.0 to 1.0)",
          "type": "number"
        },
        "ContainsFinancialLiability": {
          "description": "Document contains financial liability language",
          "type": "boolean"
        },
        "ContainsSensitiveInformationCollection": {
          "description": "Document collects sensitive information",
          "type": "boolean"
        },
        "ContainsAssetTransfer": {
          "description": "Document involves asset transfer",
          "type": "boolean"
        },
        "ContainsPurchaseAgreement": {
          "description": "Document is a purchase agreement",
          "type": "boolean"
        },
        "ContainsEmploymentAgreement": {
          "description": "Document is an employment agreement",
          "type": "boolean"
        },
        "ContainsExpiredDocument": {
          "description": "Document is expired",
          "type": "boolean"
        },
        "ContainsAiGeneratedContent": {
          "description": "Document contains AI-generated content",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "DocumentClass": {
          "description": "Document class/type",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "NsfwDetectionResult": {
      "description": "NSFW detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no NSFW content was found",
          "type": "boolean"
        },
        "Mode": {
          "description": "Classification mode that ran: \"Basic\" or \"Advanced\". Omitted when the scan did not run.",
          "type": "string"
        },
        "ContainsNudity": {
          "description": "Image contains nudity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsGraphicViolence": {
          "description": "Image contains graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsNonGraphicViolence": {
          "description": "Image contains non-graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsSelfHarm": {
          "description": "Image contains self-harm content. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsHate": {
          "description": "Image contains hate content. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsPotentialIllegalActivity": {
          "description": "Image contains potential illegal activity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsMedicalImagery": {
          "description": "Image contains medical imagery. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "ContainsProfanity": {
          "description": "Image contains profanity. Populated in Advanced mode; omitted in Basic mode (not evaluated).",
          "type": "boolean"
        },
        "Score": {
          "format": "double",
          "description": "NSFW score (0.0 to 1.0)",
          "type": "number"
        },
        "ClassificationOutcome": {
          "description": "Classification outcome",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped (unsupported format)",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PhishingDetectionUrlResult": {
      "description": "Phishing detection result for URL scanning",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no phishing was detected",
          "type": "boolean"
        },
        "PhishingRiskLevel": {
          "format": "double",
          "description": "Phishing risk level (0.0 to 1.0)",
          "type": "number"
        },
        "IsSsrfThreat": {
          "description": "URL is a server-side request forgery threat",
          "type": "boolean"
        },
        "ContainsPhishing": {
          "description": "URL contains phishing",
          "type": "boolean"
        },
        "ContainsUnsolicitedSales": {
          "description": "URL contains unsolicited sales",
          "type": "boolean"
        },
        "ContainsPromotionalContent": {
          "description": "URL contains promotional content",
          "type": "boolean"
        },
        "ContainsPhishingAttempt": {
          "description": "URL contains phishing attempt",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "ThreatTypes": {
          "description": "Threat classifications for this URL. Possible values: Phishing, Malware, UnwantedSoftware, Unsafe, SSRF, Phishing Test URL. Populated by the Basic pipeline (Basic mode, or the Advanced-mode local pre-check); null when the verdict came from the remote Advanced analysis.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false
    },
    "PolicyEnforcementResult": {
      "description": "Policy enforcement result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no policy violations were found",
          "type": "boolean"
        },
        "RiskScore": {
          "format": "double",
          "description": "Overall risk score (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolations": {
          "description": "List of rule violations found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/PolicyRuleViolation"
          }
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PolicyRuleViolation": {
      "description": "A single policy rule violation",
      "type": "object",
      "properties": {
        "RuleId": {
          "description": "ID of the violated rule",
          "type": "string"
        },
        "RuleViolationRiskScore": {
          "format": "double",
          "description": "Risk score for this violation (0.0 to 1.0)",
          "type": "number"
        },
        "RuleViolationRationale": {
          "description": "Rationale for the violation",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PromptInjectionDetectionResult": {
      "description": "Prompt injection detection result. For URL scans the service downloads the URL, extracts\nreadable text (HTML via HtmlAgilityPack, otherwise sniffed plain text; binary content is\nskipped) and scans it; for text scans the submitted text is scanned directly. Both run\nthrough the Prompt Injection child API.",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no prompt injection was detected",
          "type": "boolean"
        },
        "ContainedPromptInjection": {
          "description": "The extracted content contained a prompt injection attack (inverse of CleanResult)",
          "type": "boolean"
        },
        "RiskLevel": {
          "description": "Risk level of the scanned text: Low, Medium, High, or Critical.",
          "type": "string"
        },
        "RiskScore": {
          "format": "double",
          "description": "Classifier confidence that the text contains a prompt injection, 0.0 (safe) to 1.0 (injection).",
          "type": "number"
        },
        "Skipped": {
          "description": "Scan was skipped (e.g. SSRF threat detected, binary content, or no readable text).",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "RecursiveLinkScanResult": {
      "description": "Recursive link scan result (Spec/UrlRecursiveLinkScan.md): the outcome of parsing the\nlanding page's HTML, extracting its links, and scanning each one at depth 1.",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether recursive link scanning was enabled for this request.",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether the recursion machinery ran (landing page fetched and parsed). An individual link's scan failure does not clear this flag.",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if every scanned link was clean (true when zero links were scanned).",
          "type": "boolean"
        },
        "LinksFound": {
          "format": "int32",
          "description": "Distinct in-scope links extracted from the landing page.",
          "type": "integer"
        },
        "LinksScanned": {
          "format": "int32",
          "description": "Links actually scanned (found minus those already seen / over the cap).",
          "type": "integer"
        },
        "Skipped": {
          "description": "Recursion was suppressed (e.g. SSRF-blocked landing page, non-HTML content, kill switch off).",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason recursion was skipped, when Skipped is true.",
          "type": "string"
        },
        "ScannedLinks": {
          "description": "Per-link scan summaries.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/ScannedLinkResult"
          }
        }
      },
      "additionalProperties": false
    },
    "ScannedLinkResult": {
      "description": "Compact per-link summary for a recursively scanned link.",
      "type": "object",
      "properties": {
        "Url": {
          "description": "The scanned link URL.",
          "type": "string"
        },
        "Successful": {
          "description": "Whether that link's scan completed successfully.",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "Whether that link scanned clean.",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "SpamDetectionResult": {
      "description": "Spam detection result",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no spam was detected",
          "type": "boolean"
        },
        "SpamRiskLevel": {
          "format": "double",
          "description": "Spam risk level (0.0 to 1.0)",
          "type": "number"
        },
        "ContainsSpam": {
          "description": "Content contains spam",
          "type": "boolean"
        },
        "ContainsUnsolicitedSales": {
          "description": "Content contains unsolicited sales",
          "type": "boolean"
        },
        "ContainsPromotionalContent": {
          "description": "Content contains promotional material",
          "type": "boolean"
        },
        "ContainsPhishingAttempt": {
          "description": "Content contains phishing attempt",
          "type": "boolean"
        },
        "AnalysisRationale": {
          "description": "Analysis rationale",
          "type": "string"
        },
        "Skipped": {
          "description": "Scan was skipped",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "SsrfDetectionResult": {
      "description": "SSRF (server-side request forgery) detection result for URL scanning",
      "type": "object",
      "properties": {
        "OutcomeAction": {
          "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).",
          "type": "string"
        },
        "Pending": {
          "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.",
          "type": "boolean"
        },
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no SSRF threat was found",
          "type": "boolean"
        },
        "IsSsrfThreat": {
          "description": "URL is a server-side request forgery threat",
          "type": "boolean"
        },
        "ThreatTypes": {
          "description": "SSRF threat classifications found. Possible values: UnparseableUrl, SpecializedScheme, Unencrypted, CredentialsInUrl, IpLiteralHost, InternalHost, PrivateNetworkTarget, and RedirectTarget:<type> for threats found on a download redirect hop.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "DnsResolved": {
          "description": "Whether the host's DNS name resolved during the private-network check. Null when the DNS step did not run (IP-literal host, check disabled, or an earlier lexical threat).",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "UrlScanResults": {
      "description": "Individual scan results for a URL scan",
      "type": "object",
      "properties": {
        "VirusScan": {
          "$ref": "#/$defs/VirusScanUrlResult"
        },
        "SsrfDetection": {
          "$ref": "#/$defs/SsrfDetectionResult"
        },
        "PhishingDetection": {
          "$ref": "#/$defs/PhishingDetectionUrlResult"
        },
        "PromptInjectionDetection": {
          "$ref": "#/$defs/PromptInjectionDetectionResult"
        },
        "PolicyEnforcement": {
          "$ref": "#/$defs/PolicyEnforcementResult"
        },
        "ContentScanning": {
          "$ref": "#/$defs/ContentScanningResult"
        },
        "RecursiveLinkScan": {
          "$ref": "#/$defs/RecursiveLinkScanResult"
        }
      },
      "additionalProperties": false
    },
    "VirusFound": {
      "description": "Virus found detail",
      "type": "object",
      "properties": {
        "FileName": {
          "description": "Name of the file containing the virus",
          "type": "string"
        },
        "VirusName": {
          "description": "Name of the virus",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "VirusScanContentInfo": {
      "description": "Additional content information from virus scan",
      "type": "object",
      "properties": {
        "ContainsJSON": {
          "description": "File contains JSON content",
          "type": "boolean"
        },
        "ContainsXML": {
          "description": "File contains XML content",
          "type": "boolean"
        },
        "ContainsImage": {
          "description": "File contains image content",
          "type": "boolean"
        },
        "Hash_SHA1": {
          "description": "SHA-1 hash of the file",
          "type": "string"
        },
        "RelevantSubfileName": {
          "description": "Name of relevant subfile",
          "type": "string"
        },
        "RelevantSubfileHash_SHA1": {
          "description": "SHA-1 hash of relevant subfile",
          "type": "string"
        },
        "IsAuthenticodeSigned": {
          "description": "File has Authenticode signature",
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "VirusScanResult": {
      "description": "Virus scan result",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no threats were found",
          "type": "boolean"
        },
        "ContainsExecutable": {
          "description": "Contains executable content",
          "type": "boolean"
        },
        "ContainsInvalidFile": {
          "description": "Contains invalid file structure",
          "type": "boolean"
        },
        "ContainsScript": {
          "description": "Contains script content",
          "type": "boolean"
        },
        "ContainsPasswordProtectedFile": {
          "description": "File is password-protected",
          "type": "boolean"
        },
        "ContainsRestrictedFileFormat": {
          "description": "File format is restricted",
          "type": "boolean"
        },
        "ContainsMacros": {
          "description": "Contains macro code",
          "type": "boolean"
        },
        "ContainsXmlExternalEntities": {
          "description": "Contains XML external entities",
          "type": "boolean"
        },
        "ContainsInsecureDeserialization": {
          "description": "Contains insecure deserialization",
          "type": "boolean"
        },
        "ContainsHtml": {
          "description": "Contains HTML content",
          "type": "boolean"
        },
        "ContainsUnsafeArchive": {
          "description": "Contains unsafe archive structure",
          "type": "boolean"
        },
        "ContainsOleEmbeddedObject": {
          "description": "Contains OLE embedded objects",
          "type": "boolean"
        },
        "ContainsUnwantedAction": {
          "description": "Contains unwanted actions",
          "type": "boolean"
        },
        "VerifiedFileFormat": {
          "description": "Content-verified file format",
          "type": "string"
        },
        "FoundViruses": {
          "description": "List of viruses found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/VirusFound"
          }
        },
        "ContentInformation": {
          "$ref": "#/$defs/VirusScanContentInfo"
        },
        "AuthenticodeSigningLevel": {
          "description": "The Authenticode signing level this API computed for the file: \"None\" or \"Signed\". Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content. Null otherwise.",
          "type": "string"
        },
        "AllowedByAuthenticode": {
          "description": "True only when the Authenticode override admitted an executable that would otherwise have been blocked. False when the file was allowed because AllowExecutables was already true — the two cases are otherwise indistinguishable to a caller who cannot see the effective policy. Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content; omitted otherwise, so an off toggle leaves the response unchanged.",
          "type": "boolean"
        },
        "ErrorMessage": {
          "description": "Error message if the scan failed",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "VirusScanUrlResult": {
      "description": "Virus scan result for URL scanning",
      "type": "object",
      "properties": {
        "Enabled": {
          "description": "Whether this scan was enabled",
          "type": "boolean"
        },
        "Successful": {
          "description": "Whether this scan completed successfully",
          "type": "boolean"
        },
        "CleanResult": {
          "description": "True if no threats were found",
          "type": "boolean"
        },
        "WebsiteThreatType": {
          "description": "Website threat type: None, Malware, Phishing, ForcedDownload, UnableToConnect",
          "type": "string"
        },
        "FoundViruses": {
          "description": "List of viruses found",
          "type": "array",
          "items": {
            "$ref": "#/$defs/VirusFound"
          }
        },
        "WebsiteHttpResponseCode": {
          "format": "int32",
          "description": "HTTP response code from the website",
          "type": "integer"
        },
        "AdvancedScanResult": {
          "$ref": "#/$defs/VirusScanResult"
        },
        "Skipped": {
          "description": "Scan was skipped (e.g. SSRF threat detected)",
          "type": "boolean"
        },
        "SkipReason": {
          "description": "Reason the scan was skipped",
          "type": "string"
        },
        "ErrorMessage": {
          "description": "Error message when the scan did not complete (e.g. the download exceeded the maximum size)",
          "type": "string"
        }
      },
      "additionalProperties": false
    }
  }
}