{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/intodns-ai/json-schema/intodns-ai-csp-scan-result-schema.json",
  "title": "CspScanResult",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/intodns-ai-openapi.json#/components/schemas/CspScanResult",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Normalized start URL of the crawl"
    },
    "origin": {
      "type": "string"
    },
    "pagesCrawled": {
      "type": "integer",
      "description": "Number of same-origin pages successfully crawled (max 20)"
    },
    "pagesFailed": {
      "type": "integer"
    },
    "truncated": {
      "type": "boolean",
      "description": "True when more pages were discovered than the crawl budget allowed"
    },
    "currentCsp": {
      "type": "object",
      "description": "The policy currently deployed, if any",
      "properties": {
        "source": {
          "type": [
            "string",
            "null"
          ],
          "enum": [
            "header",
            "report-only",
            "meta"
          ],
          "description": "Where the policy was found; null when the site has no CSP"
        },
        "policy": {
          "type": [
            "string",
            "null"
          ]
        }
      }
    },
    "findings": {
      "type": "array",
      "description": "Weaknesses detected in the current policy (or the absence of one)",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "severity": {
            "type": "string",
            "enum": [
              "critical",
              "high",
              "medium",
              "info"
            ]
          },
          "title": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "directive": {
            "type": "string"
          }
        }
      }
    },
    "inventory": {
      "type": "array",
      "description": "Observed resource origins grouped by CSP directive ('self' first, externals sorted)",
      "items": {
        "type": "object",
        "properties": {
          "directive": {
            "type": "string"
          },
          "origins": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        }
      }
    },
    "inlineScripts": {
      "type": "integer",
      "description": "Total inline script blocks across crawled pages"
    },
    "inlineStyles": {
      "type": "integer"
    },
    "eventHandlerAttrs": {
      "type": "integer",
      "description": "Total inline event-handler attributes (onclick, onload, ...)"
    },
    "synthesis": {
      "type": "object",
      "description": "Generated starter policy built from observed resources",
      "properties": {
        "policyString": {
          "type": "string",
          "description": "Ready-to-deploy Content-Security-Policy value"
        },
        "reportOnlyString": {
          "type": "string",
          "description": "Content-Security-Policy-Report-Only value for safe rollout"
        },
        "notes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    }
  }
}