{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-purview/json-schema/microsoft-purview-dlp-matched-rule-schema.json",
  "title": "DlpMatchedRule",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-purview-dlp-policies-api-openapi.yml#/components/schemas/DlpMatchedRule",
  "type": "object",
  "properties": {
    "ruleId": {
      "type": "string"
    },
    "ruleName": {
      "type": "string"
    },
    "policyId": {
      "type": "string"
    },
    "policyName": {
      "type": "string"
    },
    "severity": {
      "type": "string",
      "enum": [
        "low",
        "medium",
        "high"
      ]
    },
    "actions": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/DlpAction"
      }
    }
  },
  "$defs": {
    "DlpAction": {
      "type": "object",
      "properties": {
        "actionType": {
          "type": "string",
          "enum": [
            "notifyUser",
            "blockAccess",
            "auditOnly",
            "encrypt",
            "applyLabel"
          ]
        },
        "description": {
          "type": "string"
        },
        "policyId": {
          "type": "string"
        }
      }
    }
  }
}